Privacy Policy

NHS Professionals


Privacy Notice


Last Reviewed: 20th December 2021 


Who we are 

This notice applies to NHS Professionals Limited, which is registered with the Information Commissioner's office (registration number Z2165993) ("NHSP").  

NHSP acts as a data controller for the purposes of the Data Protection Act 2018 and the EU General Data Protection Regulations (together the “data protection legislation”). 

Our address is: 

Suites 1A & 1B,  

Breakspear Park,  

Breakspear Way,  

Hemel Hempstead,  

HP2 4TZ. 

Email: [email protected] 

When we mention "we", "us" or "our" in this privacy notice, we are referring to NHS Professionals. 


Purpose of this privacy notice 

This notice applies specifically to our management of your information as an applicant if you: 

  • express interest in a role within the NHS or with NHSP 

  • apply to be cleared to work in a specific role 

  • apply to be employed directly by an NHS trust  

  • apply to become a member of the NHSP flexible worker bank  

Within this notice we will tell you: 

  • what information we will obtain from you or about you 

  • how and why we will be collecting and processing your information 

  • our lawful bases for processing your information 

  • details of third parties that may process your information on our behalf 

  • how and where we store your information 

  • how long your information will be retained by us 

  • how we protect your data 

  • your rights as a data subject 

  • whether we make any automated decisions based on the information we collect about you 

If you have any queries about how or why we are processing your data, or you wish to exercise any of your rights related to your personal data, then please contact us using the details above (and at the end) of this notice. 


How do we collect your information? 

Most of the information we collect and process will be provided by you, either directly to us through the applicant portal or to a third party acting on our behalf. 

If you apply to be cleared for work within the NHS or with NHSP, we or our third-party processors will also obtain information about you from relevant databases, public websites, or from referees nominated by you, in order to validate your suitability. You will be notified, and where appropriate your informed consent will be sought, before any request is made to obtain information about you from third party sources. 


What information will we process and why? 

The table below identifies the categories of information that we will obtain from or about you and our reasons for processing this information (the “purpose”). 

Categories of information 


Your name and contact details, including: 

  • Full name 

  • Address 

  • Telephone number 

  • Email address 


This information may be used to: 

  • Establish a profile within the application portal 

  • Allow us to contact you regarding your interest in working within the NHS or with NHSP 

  • Notify you of any actions that have been taken or which we require you to take in respect of an application 


Information about: 

  • Your occupation or work history 

  • Your education 

  • Your qualifications 

  • Membership of any professional or regulatory body (including membership number and status) 

  • Details of professional and personal referees and information returned to us by those referees 


This information may be used to: 

  • Assess your suitability for specific roles 

  • Validate that you meet any minimum criteria stated for a specific application 


Documents and information to confirm your identify, which may include: 

  • A photograph 

  • Photographic identity documents 

  • Documents containing your current address 


This information may be used to: 

  • Validate your identity as part of the application process 

  • Confirm that we have obtained the information required to lawfully undertake further checks (e.g. a criminal records disclosure)  


Additional identity documents, including: 

  • Passport 

  • Birth certificate 

  • Marriage certificate (or certificate confirming any change of name) 

  • Evidence of a national insurance number 


This information may be used to: 

  • Confirm that you have the necessary documentation to evidence your right to work in the United Kingdom 




Background information, including: 

  • Criminal records information* (including self-declarations and checks returned from the Disclosure and Barring Service) 

  • Details from any public social media profiles 

  • Financial information returned from credit reference providers 


This information may be used to: 

  • Assess your suitability for work within the NHS or with NHSP 

  • Meet our legal obligations (and the obligations of NHS trusts) to safeguard vulnerable people 



Health information, including: 

  • Any pre-existing health conditions* 

  • Whether you are currently pregnant* 

  • Your current immunisation records* 

  • Any notified disabilities* 


This information may be used to: 

  • Provide you with occupational health services to allow employers (whether NHSP or another NHS trust) to adequately assess the risks to your personal health and safety in undertaking work within a clinical environment 

  • Ensure protective measures are in place 

  • Make reasonable workplace adjustments to allow you to carry out work  


Additional personal data such as: 

  • Preferred name 

  • Preferred pronoun 

  • Date of birth* 

  • Gender identity* 

  • Sex assigned at birth* 

  • Sexual orientation* 

  • Marital status/civil partnership* 

  • Religion/belief* 

  • Ethnicity* 


This information may be used to: 

  • Adequately monitor campaign processes in terms of equal opportunity – ensuring individual groups are not adversely impacted 

  • To provide a personalised service and communications where appropriate 

  • To undertake additional risk assessments specific to roles and the potential for exposure to the SARS-CoV-2 virus  


Please note, if you apply for work within the NHS or with NHSP, we will obtain further data from you to meet our obligations under the relevant contract of employment. Further information can be found in our standard privacy notice

Categories of data marked with a (*) represent ‘special category data’ for the purposes of the data protection legislation. NHSP has additional obligations to ensure the security and appropriate use of such data. 

We will: 

  • always notify you of the reason for obtaining such data at the point we collect it from you (whether directly or via an appointed data processor) 

  • obtain your explicit consent in order to process such data for the particular purpose unless we are bound to process the data by law 

  • ensure data is identified within our systems as being special category data 

  • when using this data for monitoring purposes – ensure it is separated from data identifying you as an individual 

You will have the right to object or withdraw your consent to the processing of special category data at any time. However, if the processing of special category data is required to meet a legal obligation (e.g. for safeguarding purposes) then we may be unable to proceed with any work application. 


What is our lawful basis for processing your personal information? 

Under the data protection legislation, the lawful bases that we rely upon to process this information are: 

  • Our legitimate interest for the purposes of recruiting and assisting in the screening and deployment of individuals to work for the NHS and with NHSP 

  • For Occupational Health (OH) we will use the following legal basis, along with our Legitimate Interest: Occupational Health data processing is necessary for the purposes of preventative/occupational health medicine as part of the assessment of your working capacity. Data processing for this purpose will either be carried out by, or under, the responsibility of a healthcare professional 

  • Where processing is required to meet a legal obligation either as a prospective employer or when acting on behalf of prospective Lead Employers 

  • Where we have your informed consent to process the information; including (for example) where you have allowed us to process special category data for monitoring purposes or where you may consent to being contacted about other opportunities to work within the NHS 


Who else will your data be shared with? 

Data Processors 

We will share your personal information with data processors acting on our behalf, who will process your information strictly for the purposes outlined above. 

This includes: 

  • Service providers undertaking background checks on our behalf in order to assess your suitability for the roles you are interested in 

  • Our service centre provider – who will have access to your information in order to be able to respond to any queries you may have relating to the campaign 

  • Our occupational health service provider – for the purposes of completing health assessments and advising you, NHSP or any employer of necessary precautions to ensure your ongoing health and safety within a clinical environment* 

*At the point you submit an application to be considered for a role, you will be informed of the identity of the relevant processor(s) depending on the role you are applying to be assessed for. These data processors will also request additional authorisation from you before they collect any further information. 

Skills for Health 

In the event that you authorise us to establish a learning profile on your behalf as part of your application, we will submit your details to Skills for Health to establish a profile for you within the Learnspace learner management system. 

Health Education England 

In the event that you authorise us to establish a learning profile on your behalf as part of your application, we will submit your details to Health Education England to establish a profile for you within the e-learning for Healthcare learning management system. 

NHS England 

We may share anonymised, aggregated data relating to your location, work preferences, and most recent occupation with NHS England. This data will be used solely for the purpose of reporting and allowing NHS England to assess the availability of a potential workforce in each NHS region. No identifiable data will be shared or transmitted for this purpose. 

NHS Trusts 

In the event that you apply to a vacant position to be employed directly by an NHS Trust, we will (subject to your express permission) transfer your information in a secure manner to that employing trust in order for them to be able to consider your interest and application. 


Where do we store your personal information? 

We will store your information securely in our data centres located within the United Kingdom. Depending on your status as an applicant, we may also transfer your data to a data processor who will process your information within the EEA but who will store your information in their data centre in Canada. As at the date of this privacy notice, the European Commission recognises Canada as a country outside of the EEA that offers an adequate level of data protection for the purposes of the data protection legislation. 

If we have cause to transfer your personal information to any other location outside of the EEA, we will inform you under a separate notice – which will include the steps taken to ensure that your information is adequately protected. 

How long will we store your personal information? 

We will only store your personal information for as long as is necessary for the purposes for which it was collected. This means that: 

  • If you have completed an application process but you do not subsequently proceed to be employed by either NHSP or an NHS Trust, we will store your information for one (1) year 

  • If you are employed by NHSP, we will retain your information for a period of up to seven (7) years from your employment but only where that information is relevant to NHSP’s obligations as an employer 

  • If you are employed by an NHS Trust, then any ongoing retention of your personal information will be subject to the privacy policy of that Trust as data controller – which may include a request that we continue to store information on their behalf 

Any information that we no longer have a lawful basis for retaining or processing will be securely erased from our platforms and our network. This will include any personal information held by our data processors. 


How do we protect your personal information? 

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed to any unauthorised parties. 

In addition, we limit access to your personal data to only those employees, agents, contractors and other third parties who have a need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality as well as regular training on how to adequately protect your data. 

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where there may be any concern about the impact on you as a data subject. 

If you have any concerns about your data, please contact us. 


What rights to you have in relation to your personal data? 

Under data protection law, you have rights including: 

Your right of access - You have the right to ask us for copies of your personal information, whether held directly by us or by any processor acting on our behalf.  

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.  

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances. 

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.  

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances. If our processing of data is based on your express consent, then you may withdraw that consent. 

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances. 

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. 

Please contact us at [email protected] if you wish to make a request. 


Automated decision making 

If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights. 

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless NHSP have a lawful basis for doing so and we have notified you. 

NHS Professionals are allowed to use automated decision-making in the following circumstances: 

  • Where we have notified you of the decision and given you 21 days to request reconsideration. 

  • Where it is necessary to perform a contract with you and appropriate measures are in place to safeguard your rights. 

  • In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights. 

We do not intend to apply automated decision making in respect of any application you make to work within the NHS or with NHSP. In the event that we use automated decision-making that could have a significant impact on you, we will let you know in advance and give you an opportunity to object. 


Further information and complaints 

NHSP has an appointed Data Protection Officer to oversee compliance with this notice and to deal with any questions or concerns about our handling of your personal information.   If you would like further information about the matters set out in this notice, or you would like to make a complaint about our handling of your personal information, please contact the Data Protection Officer.  

The contact details for your Data Protection Officer are set out below: 

Dean Field 

Data Protection Officer 

[email protected] 

You can also complain to the ICO if you are unhappy with how we have used your data. 


The ICO’s address:             

Information Commissioner’s Office 

Wycliffe House 

Water Lane 



SK9 5AF 


Helpline number: 0303 123 1113 


ICO website: