Privacy Policy

1. Data We Collect

• Account data: name, email address, password (stored only as a secure hash), and account activity such as sign-in events.
• Application data: your CV and any documents you upload, plus the details needed to assess eligibility — specialty, grade, work history, qualifications, visa or right-to-work status, and GMC registration status.
• Order and payment data: quantity ordered, amount, order status, PayPal transaction identifiers and receipts. We never receive or store your full card number or PayPal password.
• Support data: messages you send us through the in-app message centre or by email.
• Technical data: limited technical information needed to operate and secure the site, such as timestamps and error logs.

2. Special Category And Sensitive Data

A CV for a healthcare role can include information such as immigration status or professional registration. Where any data you provide is treated as special category data under applicable data protection law, we process it only on the basis of your explicit consent, given when you upload it and place your order, and only for the purpose of preparing and submitting your applications. You may withdraw that consent at any time, although we cannot recall applications already submitted.

3. Why We Use Your Data And Our Legal Bases

We do not sell your data, and we do not use your CV for marketing, profiling, automated decision-making or any purpose other than delivering the service you ordered.

• Performance of a contract: creating your account, preparing tailored documents, submitting applications, and delivering your completed pack.
• Explicit consent: processing sensitive details contained in your CV and application forms.
• Legal obligation: keeping payment, invoicing and tax records.
• Legitimate interests: securing the service, preventing fraud and abuse, and responding to your enquiries.

4. Who We Share Data With

• Employers, NHS trusts and the recruitment platforms they use — only the information required by the application form for a vacancy you have asked us to apply to.
• PayPal, for payment processing, under its own terms and privacy policy.
• Our hosting, database, storage and email providers, acting as processors on our written instructions.
• Authorities or advisers where disclosure is required by law or needed to establish or defend legal claims.

5. International Transfers

Our providers may process data outside your country of residence. Where personal data is transferred from the UK or EEA, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses offered by those providers.

6. Retention

We keep your account and application data for as long as your account is active and for up to 24 months after your last completed order, so that we can evidence what was submitted on your behalf and handle any query or dispute. Payment and invoicing records are kept for the period required by law. You can ask us to delete your data earlier and we will do so unless we must retain specific records for legal reasons.

7. Security

No online service can be guaranteed to be completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected clients as required by law.

• Accounts are protected by email-verified sign-in and passwords are stored only as hashes.
• Uploaded CVs are held in private storage that is not publicly listable, and access is restricted to your own account and to the service operator.
• Database access is governed by row-level security rules so that clients can access only their own records.
• Traffic to the website and dashboard is encrypted in transit (HTTPS).

8. Your Rights

To exercise any right, email info@jobapplynhs.app. We aim to respond within one month. If you are in the UK you may also complain to the Information Commissioner's Office (ico.org.uk); if you are in the EEA you may complain to your local data protection authority.

• Access a copy of the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data where there is no overriding legal reason to retain it.
• Restrict or object to certain processing.
• Data portability, where technically feasible.
• Withdraw consent at any time, without affecting processing already carried out.

9. Cookies And Local Storage

We use only the cookies and browser storage that are strictly necessary to keep you signed in, maintain your session and remember your preferences. We do not use advertising or third-party tracking cookies. Clearing your browser storage will sign you out.

10. Children

The service is not intended for anyone under 18 and we do not knowingly collect data from children.

11. Changes And Contact

We will update this policy when our practices change and will post the revised date at the top of the page. Data protection enquiries: info@jobapplynhs.app.