Consent Management

This page explains how VivaEdu handles consent collection, storage, and withdrawal. It is intended for students, instructors, and compliance officers who need to understand consent requirements and processes.

Overview

VivaEdu requires explicit consent before recording student responses during viva sessions. This consent is account-wide, versioned, and auditable.

Recording Consent

Recording consent is the primary consent type required for viva participation. When granted, it allows VivaEdu to capture and store audio (and video, when enabled) during viva sessions.

Current Consent Version

What Consent Covers

• Audio recording during viva sessions
• Video recording (when enabled by the instructor for a specific assignment)
• Storage of recordings for instructor review
• Handling of recordings per the retention policy (90 days for media, 180 days for transcripts)

When Consent is Requested

Students encounter consent in the following situations:

During Viva Setup

Before a student can begin recording, the system checks whether they have granted recording consent. If consent has not been granted, the student sees a prompt directing them to their settings.

In Settings (Pre-Grant)

Students can proactively grant consent in their Settings & Preferences page before starting any viva. This avoids interruption when beginning an assessment.

How Consent is Stored

Consent status is stored in the StudentPreference database table, linked to the student's user account.

• Consent is stored as a boolean field linked to the user account
• It persists across browser sessions and devices
• Students can change their consent status at any time
• Changes take effect immediately

Granting Consent

Students grant consent through their Settings & Preferences page:

1. Navigate to Settings & Preferences from the student dashboard
2. Locate the Recording consent section
3. Read the consent text and retention information
4. Toggle the switch to grant consent
5. Click Save to persist the change

Audit Logging

When consent is granted, the system creates an audit log entry to maintain a compliance record:

{
  "action": "STUDENT_RECORDING_CONSENT_GIVEN",
  "metadata": {
    "consentVersion": "2025-12-25-v1",
    "consentTextHash": "<sha256 hash>",
    "source": "student_preferences_put"
  }
}

The audit log captures the consent version, a SHA-256 hash of the consent text for verification, and the source of the consent action.

Withdrawing Consent

Students can withdraw consent at any time:

1. Navigate to Settings & Preferences
2. Locate the Recording consent section
3. Toggle the switch off to withdraw consent
4. Click Save to persist the change

Effects of Withdrawal

Other Consent Types

Gaze Monitoring Consent

VivaEdu includes an optional gaze monitoring feature (for academic integrity purposes). This feature has its own separate consent field:

• Stored in gazeConsent field
• Independent of recording consent
• Only relevant when gaze monitoring is enabled for an assignment
• Can be granted or withdrawn separately

Consent and Viva Flow

The following diagram illustrates how consent is checked during the viva startup process:

Consent Versioning

VivaEdu maintains versioned consent text to ensure auditability and compliance:

• Version identifier: Each consent text has a version string (e.g., 2025-12-25-v1)
• Audit logging: The version is recorded when consent is granted
• Hash verification: A SHA-256 hash of the consent text is stored in audit logs
• Version updates: If consent text changes, the version is updated

This versioning system allows institutions to verify exactly what text a student agreed to and when.

Student Settings Interface

Students manage consent through their Settings & Preferences page, which provides:

Recording Consent Section

• Toggle switch to grant or withdraw consent
• Consent explanation text
• Retention period information (90 days for media, 180 days for transcripts)
• Clear indication of current consent status

Privacy Actions Section

• Request Data Export: Request a copy of all personal data
• Request Account Deletion: Request removal of account and associated data

For detailed information on the settings interface, see Settings & Preferences.

Instructor Considerations

Instructors should be aware of the following regarding student consent:

• Consent is required: Students must grant recording consent before they can record any viva
• Cannot force consent: Instructors cannot grant consent on behalf of students
• Accommodations available: Students who cannot record audio have alternatives (text response mode)
• Video is optional: Video recording is configurable per assignment and requires the same consent

Consent and Data Subject Rights

Under UK GDPR, consent is one of several legal bases for processing personal data:

• Consent (Article 6(1)(a)): Used for recording capture during viva sessions
• Withdrawal right: Students can withdraw consent at any time as a data subject right
• Other legal bases: The institution may rely on other bases (contract, legitimate interests) for certain processing
• Institutional responsibility: The institution, as data controller, determines the appropriate legal basis for processing

For comprehensive information on GDPR compliance, see GDPR Compliance.