Privacy Policy

NHS Professionals

 

Privacy Notice – National Vaccination Programme

 

Last Reviewed: 26th November 2020

 

Who we are

This notice applies to NHS Professionals Limited, which is registered with the Information Commissioner's office (registration number Z2165993) ("NHSP"). 

 

NHSP acts as a data controller for the purposes of the Data Protection Act 2018 and the EU General Data Protection Regulations (together the “data protection legislation”).

 

Our address is:

Suites 1A & 1B, 

Breakspear Park, 

Breakspear Way, 

Hemel Hempstead, 

HP2 4TZ.

 

Email: [email protected]

 

When we mention "we", "us" or "our" in this privacy notice, we are referring to NHS Professionals.

 

Purpose of this privacy notice

This notice applies specifically to our management of your information as an applicant if you:

 

  • express interest in a role supporting the National Vaccination Programme (the “NVP”)
  • apply to be cleared to work in a specific role on the NVP
  • apply to be employed directly by an NHS trust (a “Lead Employer”) to be deployed as part of the NVP
  • apply to become a member of the NHSP flexible worker bank in order to undertake shifts supporting the NVP

 

Within this notice we will tell you:

 

  • what information we will obtain from you or about you
  • how and why we will be collecting and processing your information
  • our lawful bases for processing your information
  • details of third parties that may process your information on our behalf
  • how and where we store your information
  • how long your information will be retained by us
  • how we protect your data
  • your rights as a data subject
  • whether we make any automated decisions based on the information we collect about you

 

If you have any queries about how or why we are processing your data, or you wish to exercise any of your rights related to your personal data, then please contact us using the details above (and at the end) of this notice.

 

How do we collect your information?

Most of the information we collect and process will be provided by you, either directly to us through the applicant portal or to a third party acting on our behalf.

 

If you apply to be cleared for work on the NVP, we or our third-party processors will also obtain information about you from relevant databases, public websites, or from referees nominated by you, in order to validate your suitability. You will be notified, and where appropriate your informed consent will be sought, before any request is made to obtain information about you from third party sources.

 

What information will we process and why?

The table below identifies the categories of information that we will obtain from or about you and our reasons for processing this information (the “purpose”).

 

Categories of information

Purpose

Your name and contact details, including:

  • Full name
  • Address
  • Telephone number
  • Email address

 

This information may be used to:

·       Establish a profile within the application portal

·       Allow us to contact you regarding your interest in, or application to support, the NVP

·       Notify you of any actions that have been taken or which we require you to take in respect of an application

 

Information about:

·       Your occupation or work history

·       Your education

·       Your qualifications

·       Membership of any professional or regulatory body (including membership number and status)

·       Details of professional and personal referees and information returned to us by those referees

 

This information may be used to:

·       Assess your suitability for specific roles

·       Validate that you meet any minimum criteria stated for a specific application

 

Documents and information to confirm your identify, which may include:

·       A photograph

·       Photographic identity documents

·       Documents containing your current address

 

This information may be used to:

·       Validate your identity as part of the application process

·       Confirm that we have obtained the information required to lawfully undertake further checks (e.g. a criminal records disclosure) 

 

Additional identity documents, including:

  • Passport
  • Birth certificate
  • Marriage certificate (or certificate confirming any change of name)
  • Evidence of a national insurance number

 

This information may be used to:

·       Confirm that you have the necessary documentation to evidence your right to work in the United Kingdom

 

Note: your original documents will also need to be presented in person to your nominated Lead Employer if you are deployed on the NVP.

 

 

Background information, including:

·       Criminal records information* (including self-declarations and checks returned from the Disclosure and Barring Service)

·       Details from any public social media profiles

·       Financial information returned from credit reference providers

 

This information may be used to:

·       Assess your suitability to be deployed on the NVP

·       Meet our legal obligations (and the obligations of NHS trusts) to safeguard vulnerable people

 

 

Health information, including:

·       Any pre-existing health conditions*

·       Whether you are currently pregnant*

·       Your current immunisation records*

·       Any notified disabilities*

 

This information may be used to:

·       Provide you with occupational health services to allow employers (whether NHSP or another NHS trust) to adequately assess the risks to your personal health and safety in undertaking work within a clinical environment

·       Ensure protective measures are in place

·       Make reasonable workplace adjustments to allow you to carry out work on the programme

 

Additional personal data such as:

·       Preferred name

·       Preferred pronoun

·       Date of birth*

·       Gender identity*

·       Sex assigned at birth*

·       Sexual orientation*

·       Marital status/civil partnership*

·       Religion/belief*

·       Ethnicity*

 

This information may be used to:

·       Adequately monitor the NVP campaign processes in terms of equal opportunity – ensuring individual groups are not adversely impacted

·       To provide a personalised service and communications where appropriate

·       To undertake additional risk assessments specific to the NVP and the potential for exposure to the SARS-CoV-2 virus 

 

 

Please note, if you apply through the application portal to work on the NVP via the NHSP flexible worker bank, we will obtain further data from you to meet our obligations under the relevant contract of employment. Further information can be found in our standard privacy notice.

 

Categories of data marked with a (*) represent ‘special category data’ for the purposes of the data protection legislation. NHSP has additional obligations to ensure the security and appropriate use of such data.

 

We will:

 

  • always notify you of the reason for obtaining such data at the point we collect it from you (whether directly or via an appointed data processor)
  • obtain your explicit consent in order to process such data for the particular purpose unless we are bound to process the data by law
  • ensure data is identified within our systems as being special category data
  • when using this data for monitoring purposes – ensure it is separated from data identifying you as an individual

 

You will have the right to object or withdraw your consent to the processing of special category data at any time. However, if the processing of special category data is required to meet a legal obligation (e.g. for safeguarding purposes) then we may be unable to proceed with any application to join the NVP on that basis.

 

What is our lawful basis for processing your personal information?

Under the data protection legislation, the lawful bases that we rely upon to process this information are:

 

  • Our legitimate interest for the purposes of the campaign to recruit and assist in the screening and deployment of individuals to support the NVP
  • Where processing is required to meet a legal obligation either as a prospective employer or when acting on behalf of prospective Lead Employers
  • Where we have your informed consent to process the information; including (for example) where you have allowed us to process special category data for monitoring purposes or where you may consent to being contacted about other opportunities to work within the NHS

 

Who else will your data be shared with?

Data Processors

We will share your personal information with data processors acting on our behalf, who will process your information strictly for the purposes outlined above.

 

This includes:

 

  • Service providers undertaking background checks on our behalf in order to assess your suitability for the NVP*
  • Our service centre provider – who will have access to your information in order to be able to respond to any queries you may have relating to the campaign
  • Our occupational health service provider – for the purposes of completing health assessments and advising you, NHSP or any Lead Employer of necessary precautions to ensure your ongoing health and safety within a clinical environment*

 

*At the point you submit an application to be considered for the NVP, you will be informed of the identity of the relevant processor(s) depending on the role you are applying to be assessed for. These data processors will also request additional authorisation from you before they collect any further information.

 

Health Education England

In the event that you authorise us to establish a learning profile on your behalf as part of your application to support the NVP, we will submit your details to Health Education England to establish a profile for you within the e-Learning for Healthcare learning management system.

 

NHS England

We may share anonymised, aggregated data relating to your location, work preferences, and most recent occupation with NHS England, who are responsible for managing the NVP. This data will be used solely for the purpose of programme reporting and allowing NHS England to assess the availability of a potential NVP workforce in each NHS region. No identifiable data will be shared or transmitted for this purpose.

 

Lead Employers

In the event that you apply to a vacant position on the NVP to be employed directly by a Lead Employer, we will (subject to your express permission) transfer your information in a secure manner to that employing trust in order for them to be able to onboard you as a worker on the NVP.

 

Where do we store your personal information?

We will store your information securely in our data centres located within the United Kingdom. For the purposes of the NVP application process, depending on your status as an applicant, we may also transfer your data to a data processor who will process your information within the EEA but who will store your information in their data centre in Canada. As at the date of this privacy notice, the European Commission recognises Canada as a country outside of the EEA that offers an adequate level of data protection for the purposes of the data protection legislation.

 

If we have cause to transfer your personal information to any other location outside of the EEA, we will inform you under a separate notice – which will include the steps taken to ensure that your information is adequately protected.

 

How long will we store your personal information?

We will only store your personal information for as long as is necessary for the purposes for which it was collected. This means that:

 

  • If you have completed an application process but you do not subsequently proceed to be employed by either NHSP or a Lead Employer; we will store your information for the duration of the National Vaccination Programme; unless you ask us to erase your information sooner
  • If you are employed by NHSP, we will retain your information for a period of up to seven (7) years from your employment but only where that information is relevant to NHSP’s obligations as an employer
  • If you are employed by a Lead Employer, then any ongoing retention of your personal information will be subject to the privacy policy of that Lead Employer as data controller – which may include a request that we continue to store information on their behalf

 

Any information that we no longer have a lawful basis for retaining or processing will be securely erased from our platforms and our network. This will include any personal information held by our data processors.

 

How do we protect your personal information?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed to any unauthorised parties.

 

In addition, we limit access to your personal data to only those employees, agents, contractors and other third parties who have a need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality as well as regular training on how to adequately protect your data.

 

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where there may be any concern about the impact on you as a data subject.

 

If you have any concerns about your data, please contact us.

 

 

 

 

What rights to you have in relation to your personal data?

Under data protection law, you have rights including:

 

Your right of access - You have the right to ask us for copies of your personal information, whether held directly by us or by any processor acting on our behalf. 

 

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 

 

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

 

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

 

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances. If our processing of data is based on your express consent, then you may withdraw that consent.

 

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

 

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

 

Please contact us at [email protected] if you wish to make a request.

 

Automated decision making

If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.

 

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless NHSP have a lawful basis for doing so and we have notified you.

 

NHS Professionals are allowed to use automated decision-making in the following circumstances:

 

  • Where we have notified you of the decision and given you 21 days to request reconsideration.
  • Where it is necessary to perform a contract with you and appropriate measures are in place to safeguard your rights.
  • In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

 

We do not intend to apply automated decision making in respect of any application you make to support the NVP. In the event that we use automated decision-making that could have a significant impact on you, we will let you know in advance and give you an opportunity to object.

 

Further information and complaints

NHSP has an appointed Data Protection Officer to oversee compliance with this notice and to deal with any questions or concerns about our handling of your personal information.   If you would like further information about the matters set out in this notice, or you would like to make a complaint about our handling of your personal information, please contact the Data Protection Officer. 

 

The contact details for your Data Protection Officer are set out below:

 

Dean Field

Data Protection Officer

[email protected]

 

You can also complain to the ICO if you are unhappy with how we have used your data.

 

The ICO’s address:            

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

 

Helpline number: 0303 123 1113

 

ICO website: https://www.ico.org.uk