Privacy Notice - Bank Members and Applicants

This privacy notice will apply to personal data that we collect from you when you:

• apply to register with NHSP through any of our recruitment channels (applicants)
• are registered with us as a bank member
• contact NHSP

We are committed to ensuring that your privacy is protected. If you provide us with personal data, you can be assured that it will only be used in accordance with this privacy notice.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data for purposes below. These are commonly called the lawful basis for processing.

• Legitimate Interests - processing is necessary for the purpose of the legitimate interests pursued by NHSP or a third-party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.
• Consent - you have given your consent to the processing of your personal data for the processing detailed in this privacy notice. If our processing of data is based on your express consent, then you may withdraw that consent.

For Occupational Health (OH) we will use the following legal basis, along with our Legitimate Interests:

• Processing is necessary for the purposes of preventative/occupational medicine for the assessment of your working capacity. OH data processing will either be carried out by, or under the responsibility of a health professional.

For Criminal Offence data, COVID-19 Risk Assessment data, call recordings and/or other activities where special category data may be disclosed, along with our legitimate interests, we will use the following legal basis:

• Processing is necessary for the purposes of employment, social security and social protection

Our basis in law for Criminal Offence data is the Rehabilitation of Offenders Act (ROA) 1974 (Exceptions) Order 1975 and the Police Act 1977 (Criminal Records) Regulations 2002: For COVID-19 risk assessments it is the Health & Safety Act 1974: For call recordings and/or other activities it is the Equality Act 2010, the Health & Safety Act 1974 and the Employment Rights Act 1996.

Most of the personal information we process is provided to us directly by you. We also receive personal information indirectly, from NHS Trusts.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose in this privacy notice.

The table below sets out the personal data that we collect and use about you and the purpose for processing it.

Please note: The list set out below is not exhaustive, and there may be other personal data which NHSP collects, stores and uses in the context of your registration.

Categories of data marked with a (*) represent ‘special category data’ for the purposes of the data protection legislation. NHS Professionals has additional obligations to ensure the security and appropriate use of such data.

We will:

• always notify you of the reason for obtaining such data at the point we collect it from you
• obtain your explicit consent in order to process such data for the particular purpose, unless we are bound to process the data by law
• when using this data for monitoring purposes – ensure it is separated from data identifying you as an individual

You will have the right to object or withdraw your consent to the processing of special category data at any time. However, if the processing of special category data is required to meet a legal obligation (e.g. for safeguarding purposes) then we may be unable to proceed with any application to join NHS Professionals on that basis.

Monitoring equal opportunities information helps us to understand our bank members better.  It also allows us to continually review our policies, processes and services to ensure our commitment to equality and diversity results in practical improvements.

This information is collected from you at the time you express an interest or complete an application to join our bank. The relevant categories of information are stated within the section on ‘What information we process and why?’.

When using this data for monitoring purposes, we will ensure it is separated from data identifying you as an individual.

Please note:
Completion of Equal Opportunity information is voluntary and does not have to be provided. Your application is not dependent you giving consent and/or processing of equal opportunities information.

In order for us to process this information, we will ask for your consent.

Once you have provided this information, you may withdraw it at any time by updating your responses to each question to state ‘Prefer not to say’.

This information is not shared with third parties, except where required to do so by law.

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention.

If NHS Professionals make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest. We will also put in place appropriate measures to safeguard your rights, including the opportunity to obtain human intervention, to express your point of view, to obtain an explanation of the decision or to contest the decision.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision making unless we have a lawful basis for doing so and have notified you.

NHS Professionals are permitted to use automated decision-making in the following circumstances:

• Where we have notified you of the decision and given you 21 days to request reconsideration.
• Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
• In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

In the event that we use automated decision-making that could have a significant impact on you, we will let you know in advance and give you an opportunity to object.

NHS Trusts and NHSP Clients:

As already explained, NHSP may have to share your personal data with the Trust/ NHSP Client you have applied to work at and/or work shifts with. This is usually to ensure that you can work at the Trust, complete necessary training and for reporting purposes.

NHSP will only share your personal data when necessary and where there is a legitimate reason to do so. If there is another reason for sharing your data, we will contact you to inform you and obtain consent if required.

Trust Authorisers:

Where you have provided the name of a Trust authoriser as part of the application process, personal contact information (including your name, personal telephone number and personal e-mail address) and your Declaration A / B form will be shared with this individual.

Data Processors

Your personal data may be transferred to other third parties acting in their capacity as data processors. We use data processors who are third parties who provide elements of services for us.

We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. 

Surveys

Your personal details as noted, may also be provided to third parties for the purposes of carrying out surveys into NHSP company’s performance.

There is no requirement for you to complete the surveys and a facility to opt out will be provided upon receipt of the first communication

Auditors

NHSP may be required to share your data with external auditors.

NHSP have contracts in place with our Auditors and your data will only be shared with the auditors for the sole purpose of the audit.

NHSP may transfer your personal information to some of our third-party providers, who are not based in the UK.

We will only transfer to organisations in other countries on the basis that it is lawfully permitted and in compliance with applicable laws.

Whenever we transfer your personal data outside the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the Information Commissioner, which includes the EEA. For further details, see ICO: A guide to international transfers.
• Where we use third-parties outside of the UK, we may use specific contracts approved by the Information Commissioner, these are sometimes known as standard contractual clauses or the International Data Transfer Agreement which give personal data the same protection it has in the EEA. For further details, see ICO: International transfers.

Please contact us if you want further information on the methods used by us when transferring your personal data out of the UK.

We will only keep your personal data for as long as is necessary for the purposes for which it was collected. 

In order to determine the appropriate retention period for your personal data, we consider the amount, nature, and sensitivity of your personal data and the likelihood of a suitable job opportunity arising. 

Applicants - if your application is placed on hold; you provide an expression of interest that is not progressed; you have an inactive or incomplete application, we may retain your personal data for up to 12 months, unless you ask us to erase your information sooner

Please Note: If you have completed all or any of the following:

• Compliance/vetting checks
• Training
• Occupation Health checks

Any information that you have provided to NHSP whilst you remain an applicant will be retained for 12 months, as per our legal requirement under the Conduct Regulations (section 29)

For successful and unsuccessful applicant’s data retention, please see below:

• Successful applicants - If your application for registration is successful, full details of how NHSP processes your personal data will be provided in due course. Any information which you have provided during the recruitment process that is irrelevant to your ongoing role as a bank member will be destroyed within a period of no longer than 6 months following the satisfactory completion of the background vetting checks.
• Unsuccessful applicants - In the event that your application for registration is unsuccessful on this occasion, any information which you have provided during the registration process will be retained for a maximum period of no longer than 12 months, in order to deal with any queries or issues relating to your application, following which it will be destroyed. The HR Department may write to an unsuccessful applicant to state that their CV will be retained on file for the purposes of future recruitment – individuals will be given the opportunity to object to their CVs being retained for this purpose at the relevant time.

Information on Criminal Records:

Criminal record information will be deleted once the recruitment process has been completed, subject to any exceptional circumstances and/or to comply with particular laws or regulations.  Criminal record information will typically be retained for a maximum of [6] months, although the outcome of any check will remain on your record.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

In addition, we limit access to your personal data to only those employees, agents, contractors and other third-parties who have a business to need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

If you have any concerns about your data, please contact us.

NHSP will always seek to process your personal data in accordance with its obligations and your rights.

Under data protection law, you have rights including:

• Your right of access - You have the right to ask us for copies of your personal information.
• Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You also have the right to raise any concerns about how your personal data is being processed with the Information Commissioner's Office using the following contact details:

• Helpline number: 0303 123 1113
• https://ico.org.uk/concerns
• Information Commissioner’s Office
  Wycliffe House
  Water Lane
  Wilmslow
  Cheshire
  SK9 5AF

Please Note:

You are not required to pay any charge for exercising your rights, unless there are exceptional circumstances.

If you make a request, we have one month to respond to you. If we need to extend the time period for responding to your request, we will let you know within the one-month period.

If you have any questions about your rights and/or would like to exercise any of these rights, please contact us:

• Email bmhumanresources@nhsprofessionals.nhs.uk;
• Telephone: via our National Service Centre on 03332 407 552;
• or write to us (our address in the general overview section)

You may be asked to confirm your identity in response to a request to exercise these rights. For ‘your right of access’, you may be asked to assist NHSP to locate data you are seeking, as part of our response to your request.

NHSP has appointed a Data Protection Officer to oversee compliance with this Notice and to deal with any questions or concerns.   If you would like further information about the matters set out in this Notice, please contact the Data Protection Officer. 

The contact details for your Data Protection Officer are set out below:

Ian Birch
Data Protection Officer
dpo@NHSProfessionals.nhs.uk

We regularly review this privacy notice and will update it where necessary. We do recommend you regularly review this privacy notice to make sure you have the most up to date information.

Version 2.7 dated 16th April, 2025