Data Protection Notice

Last revised: 11 August 2026

Previous revision: 10 May 2026.

MyUSE (My Understanding Substance Use Experiences) is a support and harm-reduction web-based application for higher education students. It provides confidential, always-on support to students who want to understand their illicit substance use experiences and access relevant guidance and resources.

MyUSE was developed through University College Cork and is now provided across a number of participating higher education institutions.

MyUSE operates as a multi-tenant platform. This means that each participating institution has its own separate MyUSE environment and data store. Information collected through one institution's MyUSE service is not combined with, or made available to, another participating institution through the MyUSE platform.

MyUSE is a web-based application which is accessed through the MyUSE website provided for your participating higher education institution, or through MyUSE when installed as a Progressive Web App (PWA).

MyUSE uses a series of questions and activities which you can complete without providing your name or other directly identifying details. These questions relate to your experiences of illicit substance use, your wellbeing, goals, decision making and related factors.

Depending on the answers you provide, MyUSE will direct you to relevant guidance, feedback, harm-reduction information and supports.

Your MyUSE journey is processed within the tenant environment associated with the institution through which you access MyUSE.

We take your privacy seriously. Any data provided through MyUSE will be treated in accordance with applicable Irish and European data protection legislation, including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

This Notice explains the purpose of MyUSE, the types of information processed through the platform, why that information is used, how it is protected, and your rights in relation to personal data.

MyUSE is provided through a multi-tenant technical architecture. Each participating higher education institution operates within a distinct tenant environment. Data associated with one institution is not made available to other participating institutions through the MyUSE platform.

This Notice is kept under review and may be updated from time to time. Where material changes are made, the updated Notice will be made available through the MyUSE website.

MyUSE allows users to provide information about their experiences of drug use and related matters in order to receive tailored guidance, feedback and support.

MyUSE may also collect statistical information about engagement with the application. This information helps the MyUSE team and participating institutions understand how the application is used, evaluate the effectiveness of the service, improve the guidance and supports offered to students, and support the ongoing research and development of the MyUSE platform.

MyUSE is designed so that you are not required to provide your name, student number, email address or other directly identifying information in order to complete the application.

A randomly generated MyUSE user identifier and access code are used to allow the application to associate your answers and progress with your MyUSE session.

MyUSE will not use the answers you provide within the application to identify you or contact you, and participating institutions will not take individual action against you on the basis of anonymous answers about illicit substance use provided through MyUSE.

The application uses the information you provide to determine which guidance, feedback and support resources are most relevant to you.

Where processing relies on your consent, including optional session-storage and analytics functionality, you may withdraw that consent at any time through the MyUSE cookie preferences.

If you contact the MyUSE team directly by email or another support channel, the contact details and information you provide in that communication will only be used for the purposes of responding to your query or resolving the issue you have reported. Contact information supplied in this way will not be linked to your anonymous MyUSE questionnaire responses.

MyUSE is operated as a multi-tenant application for participating higher education institutions.

Each participating institution is assigned a separate tenant environment and separate database for MyUSE data associated with that institution.

MyUSE does not operate a shared student-response database in which participating institutions can view each other's MyUSE user data.

Administrators associated with one institution are not provided access through MyUSE to the user-response data belonging to another institution.

Technical administration of the platform may require authorised MyUSE technical personnel to maintain the infrastructure supporting participating tenants. Any such access is limited to what is necessary for the secure operation, maintenance and support of the service.

We are committed to ensuring that information processed through MyUSE is secure.

Appropriate physical, technical and organisational measures are used to protect information against unauthorised access, alteration, disclosure, loss or destruction.

MyUSE data is hosted using secure cloud infrastructure, including Amazon Web Services and Microsoft services used in connection with the operation and administration of the platform.

The multi-tenant design of MyUSE separates participating institutions so that application data associated with one tenant is not made available to another tenant through the platform.

Access to administrative functions is restricted to authorised personnel and protected through appropriate authentication and access controls.

Access to MyUSE data is restricted to authorised personnel who require access for the operation, administration, evaluation, research, development or technical maintenance of the service.

Within each participating institution, access is limited to designated MyUSE administrators or nominated personnel authorised for that institution's tenant.

Depending on their role, authorised personnel may include:

• the MyUSE Principal Investigator or programme lead;
• authorised technical personnel responsible for maintaining the platform, security and data-management processes;
• nominated MyUSE team members involved in research, evaluation and development; and
• authorised representatives of the participating institution where access is required for the administration of that institution's MyUSE tenant.

Access is role-based and limited to the data required for the relevant purpose.

A participating institution does not receive administrative access through MyUSE to another institution's tenant data.

Data will not be shared with unrelated third parties except where required by law or where a service provider is required to process information on behalf of MyUSE under appropriate data-protection arrangements.

MyUSE is designed to use services and infrastructure appropriate for the secure processing of application data.

Where a service provider processes personal data outside the European Economic Area, any such processing must be subject to an appropriate lawful transfer mechanism and safeguards as required by applicable data protection law.

Optional third-party services, such as Google Analytics, may have their own international processing arrangements. Analytics is not enabled unless you choose to opt in.

In accordance with data-protection principles, information will only be retained for as long as is necessary for the purposes for which it was collected.

Archiving of user-engagement data may take place periodically. This involves consolidating information over a defined period and retaining only information considered necessary for research, evaluation and the continued development of the MyUSE platform.

Anonymised research and engagement data may be retained for up to ten years.

If you opt in to Google Analytics, analytics data may be retained for up to 26 months.

Where supported by the application, analytics data associated with your MyUSE user identifier may be requested for deletion.

Once an analytics deletion request is submitted, data associated with the relevant user identifier will be removed from the Individual User Report within approximately 72 hours and will subsequently be removed from Analytics systems through the applicable deletion process.

MyUSE session information stored on your own device through the optional "Remember me" feature is configured for a period of up to 30 days. You may disable this feature or remove the stored session at any time.

You have rights under data protection law in relation to personal data that relates to you, subject to the conditions and exemptions provided by law.

These may include the right:

• to obtain confirmation as to whether personal data concerning you is being processed and, where applicable, to access that personal data;
• to have inaccurate personal data corrected and incomplete information completed;
• in certain circumstances, to request the erasure of personal data;
• in certain circumstances, to request restriction of processing;
• to object to certain processing;
• where applicable, to receive personal data in a portable format;
• where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before consent was withdrawn; and
• to have appropriate protections in relation to solely automated decision-making where the relevant provisions of data protection law apply.

Because MyUSE is intentionally designed not to require directly identifying information, there may be circumstances in which MyUSE cannot identify a particular user from the information held within the application. This can affect the ability to locate data for the purpose of exercising some data-protection rights.

If you wish to exercise a data-protection right in relation to MyUSE, you may contact the MyUSE team at admin@myuse.ie or contact the data-protection office of the participating institution through which you access MyUSE.

If you have a query about the operation of MyUSE, please contact the MyUSE administration team at admin@myuse.ie.

If your query concerns the processing of personal data, you may also contact the data-protection or information-compliance office of the higher education institution through which you access MyUSE.

For University College Cork users, data-protection queries may be directed to UCC's Information Compliance Manager at gdpr@ucc.ie.

You also have the right to raise a concern or lodge a complaint with the Data Protection Commission if you are unhappy with the way your personal data has been handled.

The Data Protection Commission recommends that, where appropriate, you first raise the matter with the organisation concerned. Complaints and concerns can then be submitted to the Data Protection Commission through its online contact service.

Current general contact details for the Data Protection Commission are:

Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland

Telephone: (01) 765 0100 or 1800 437 737.

Cookies are small files that are created and saved on your device when you visit a website or web application. They can be used to store information about your preferences and how the application operates on your device.

MyUSE uses cookies and browser storage for functions required to operate the application and, where you choose to enable them, for optional session persistence and analytics.

Some cookies and storage mechanisms are strictly necessary for the operation of the website and its security and preference-management functions. These are enabled as required for the application to work.

MyUSE provides an optional "Remember me" feature which allows your MyUSE session and progress to be recalled on the same device for up to 30 days.

This feature is not enabled by default unless you choose it through the "Remember me" control, the cookie preferences interface, or an equivalent consent option such as "Accept All".

When enabled, information required to recall your MyUSE session is stored on the device using browser-based storage and associated cookies.

When you later return to MyUSE, the application may recognise that a remembered session exists and ask whether you would like to resume it.

You may disable the "Remember me" feature at any time through the cookie preferences. Logging out explicitly will also end the remembered MyUSE session on that device.

MyUSE may also be installed as a Progressive Web App (PWA). PWA functionality may use local browser and application storage required for installation, caching and operation of the application.

MyUSE uses optional analytics technologies to help understand how the platform is used and whether it is operating effectively.

Analytics are opt-in only and are not required in order to use MyUSE.

If you choose to enable Analytics, MyUSE may use Google Analytics to collect information about interaction with the application. This information is used for service evaluation, performance measurement, research and improvement of the MyUSE platform.

You may withdraw analytics consent at any time through the cookie preferences section.

If Analytics is disabled, MyUSE will stop intentionally sending new analytics events associated with your use of the application and will remove analytics cookies where technically supported.