The lawful basis used depends on the exact circumstances. Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and whether your rights override them.

7.   Staffing, compliance and client disclosures

Our service requires us to match suitable, compliance-checked professionals with healthcare organisations. We may therefore share proportionate information with a prospective or existing client where necessary to assess suitability, arrange an assignment or satisfy legitimate compliance requirements.

• Identity and role
• Relevant experience and qualifications
• Training and professional registration status
• Right-to-work and compliance status
• DBS status where appropriate and lawful
• Availability and assignment information
• Other information reasonably required for a specific placement

We aim to disclose only information that is relevant to the staffing purpose and avoid unnecessary disclosure of sensitive material.

8.   Information about residents and service users

Our general website and ordinary business communication channels are not intended to be used as repositories for full patient, resident or service-user clinical records. Workers and clients should avoid sending identifiable care information through general website forms or informal channels unless genuinely necessary and an appropriate method has been agreed.

Where resident or service-user information is provided to us in connection with a safeguarding concern, complaint, incident or staffing issue, we will use it only for legitimate and necessary purposes and apply appropriate confidentiality controls.

9.   Marketing and operational communications

We may send operational communications necessary to manage registration, compliance, shifts, bookings, payroll, contracts, or service delivery. These are not the same as promotional marketing.

Where we send direct marketing by electronic means, we will comply with applicable privacy and electronic communications rules. Where consent is required, you may withdraw it at any time. You may also object to direct marketing at any time.

10.         Cookies and similar technologies

Our website may use strictly necessary technologies and, where enabled, functional, analytics or advertising technologies. We will use non-essential storage or access technologies only where permitted by law, including obtaining valid consent where required. Further information appears in our Cookie Policy and in any live cookie preference centre on the website.

11.         Who we may share information with

• healthcare clients and prospective clients where necessary for staffing
• professional regulators and registration bodies
• DBS, compliance, right-to-work, training and occupational-health providers
• payroll, pension, accounting and banking providers
• IT, hosting, cybersecurity, CRM, app and communications providers
• professional advisers, insurers and auditors
• HM Revenue & Customs, government departments, courts, law enforcement, safeguarding authorities and regulators where required
• a purchaser, investor or successor organisation in connection with a legitimate corporate transaction, subject to appropriate confidentiality and legal safeguards

We do not sell personal information.

12.         International transfers

Some technology or service providers may process information outside the United Kingdom. Where this happens, we will use an appropriate lawful transfer mechanism where required, such as UK adequacy regulations, approved contractual safeguards, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another mechanism permitted by law.

13.         Security

We use reasonable technical and organisational measures designed to protect personal information from accidental loss, unauthorised access, misuse, alteration or disclosure. Access is limited according to role and business need. Where a personal-data breach occurs, we will assess it and notify affected individuals and/or the ICO where legally required.

14.         Retention

We keep information only for as long as reasonably necessary for the purpose for which it was collected, taking into account contractual, tax, employment, safeguarding, regulatory, insurance and legal limitation requirements. Different categories may therefore have different retention periods.

• Candidate and worker records may be retained while you remain registered and for an appropriate period afterwards
• Financial and contractual records may need to be retained for around six years or another applicable statutory period
• Safeguarding, incident, DBS and professional-compliance records may be subject to different retention requirements
• Where information is no longer required, we will delete, anonymise or securely dispose of it as appropriate

15.         Your rights

• access your personal information
• ask us to correct inaccurate or incomplete information
• request erasure in circumstances where the law provides that right
• object to processing based on legitimate interests in appropriate circumstances
• object to direct marketing at any time
• request restriction of processing in certain situations
• request data portability where the legal requirements are met
• withdraw consent where processing is based on consent
• ask for appropriate safeguards in relation to significant solely automated decisions where applicable

These rights are not absolute and may be subject to exemptions. We may ask for information reasonably necessary to verify your identity. We usually aim to respond to valid requests within one month, subject to any lawful extension for complex requests.

16.   Accuracy and changes

Please tell us when relevant information changes, particularly contact details, right-to-work status, professional registration, training, compliance information, bank details or other information affecting assignments.

We may update this Privacy Policy to reflect changes in law, regulatory guidance, technology or our services. The latest version will be published on our website.

17.   Contact and complaints

For privacy questions or data-rights requests, contact Healthcare Revolution Staffing LTD using the contact details in section 1. You may also complain to the Information Commissioner’s Office at ico.org.uk.