Job Applicant Privacy Notice

Introduction

Innovate ADHD Ltd is committed to protecting the privacy and security of your personal data. This privacy notice describes how we collect and use personal data about you during and after the recruitment process, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This notice applies to all individuals who apply for a role with us, whether through NHS Jobs, our website, recruitment agencies, or any other channel.

Data Controller

Innovate ADHD Ltd is the data controller for the personal data you provide during the recruitment process. This means we are responsible for deciding how we hold and use your personal data.

What Data We Collect

In connection with your application, we may collect, store, and use the following categories of personal data:

• Personal identifiers: Your name, title, date of birth, gender, home address, personal email address, and phone number.
• Recruitment information: Your CV or application form, cover letter, employment history, qualifications, references, and any other information you provide as part of the application process.
• Right to work documentation: Proof of your right to work in the UK, such as passport or visa details.
• Professional registration details: Information about your registration with relevant professional bodies (e.g., GMC, NMC, HCPC) where applicable.
• DBS checks: Information relating to Disclosure and Barring Service checks, where required for the role.
• Equal opportunities monitoring data: Information about your race or ethnicity, religious beliefs, sexual orientation, and disability status (provided voluntarily for monitoring purposes only).
• Health information: Information about your health, including any medical condition or disability, where relevant to your ability to perform the role or where reasonable adjustments may be needed.

How We Collect Your Data

We collect personal data from the following sources:

• Directly from you: Through application forms, CVs, correspondence, and interviews.
• NHS Jobs: Through the NHS Jobs recruitment platform.
• Recruitment agencies: Where applicable, from agencies acting on your behalf.
• Referees: From the references you have provided.
• Professional bodies: From professional registration bodies to verify your qualifications and registration status.
• DBS: From the Disclosure and Barring Service for criminal record checks where required.

Why We Process Your Data

We process your personal data for the following purposes:

• To assess your suitability for the role you have applied for
• To communicate with you about the recruitment process
• To carry out pre-employment checks, including verifying your identity, right to work, qualifications, professional registration, and references
• To carry out DBS checks where required for the role
• To comply with legal and regulatory obligations (e.g., right to work checks, CQC requirements)
• To make reasonable adjustments for candidates with disabilities
• To monitor equal opportunities
• To respond to and defend against legal claims

Lawful Basis for Processing

We rely on the following lawful bases under the UK GDPR to process your personal data:

• Legitimate interests (Article 6(1)(f)): Processing is necessary for our legitimate interest in assessing candidates and recruiting staff. We have carried out a balancing test to ensure our interests do not override your rights.
• Contract (Article 6(1)(b)): Processing is necessary to take steps at your request prior to entering into a contract of employment.
• Legal obligation (Article 6(1)(c)): Processing is necessary to comply with legal requirements, such as right to work checks and regulatory obligations.
• Consent (Article 6(1)(a)): Where we ask for your explicit consent, for example for equal opportunities monitoring data. You may withdraw your consent at any time.

For special category data (e.g., health information, equal opportunities data), we rely on:

• Article 9(2)(b): Processing is necessary for carrying out obligations in the field of employment law (e.g., making reasonable adjustments for disabled applicants).
• Article 9(2)(a): Your explicit consent, where applicable (e.g., equal opportunities monitoring).
• Article 9(2)(g): Processing is necessary for reasons of substantial public interest, under Schedule 1 of the Data Protection Act 2018.

Who Has Access to Your Data

Your personal data may be shared internally with:

• Members of the recruitment panel and hiring managers
• HR and administrative staff involved in the recruitment process
• IT staff where access to data is necessary for the performance of their roles

We may also share your data externally with:

• NHS Jobs (as a recruitment platform)
• The Disclosure and Barring Service (for DBS checks)
• Professional registration bodies (to verify your registration)
• Your referees
• Regulatory bodies such as the Care Quality Commission (CQC), where required

We will not share your data with any other third parties unless required by law. We do not sell or share your personal data for marketing purposes.

Data Security

We take the security of your personal data seriously. We have appropriate technical and organisational measures in place to protect your data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These include:

• Secure, encrypted systems for storing recruitment data
• Role-based access controls to limit who can view your data
• Confidentiality agreements for all staff involved in recruitment
• Regular data protection training for staff

How Long We Keep Your Data

If your application is unsuccessful, we will retain your personal data for 6 months after the end of the recruitment process. This is to allow us to respond to any queries or complaints about the recruitment process, and to defend against any legal claims. After this period, your data will be securely deleted or destroyed.

If your application is successful, your personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided in our employee privacy notice.

With your consent, we may retain your details for a longer period in order to contact you about future suitable vacancies. You can withdraw this consent at any time.

Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right to be informed: To know how your data is being used (this notice fulfils that right).
• Right of access: To request a copy of the personal data we hold about you.
• Right to rectification: To have inaccurate or incomplete data corrected.
• Right to erasure: To request the deletion of your data in certain circumstances.
• Right to restrict processing: To limit how we use your data in certain circumstances.
• Right to data portability: To receive your data in a structured, commonly used, and machine-readable format.
• Right to object: To object to the processing of your data in certain circumstances.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our Data Protection Officer at jiaao.yu@innovateadhd.com. We will respond to your request within one month.

Automated Decision-Making

We do not use automated decision-making (including profiling) in the recruitment process that would have a significant effect on you.

Complaints

If you have any concerns about how we handle your personal data, we encourage you to contact our Data Protection Officer in the first instance. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office:

Changes to This Notice

We may update this privacy notice from time to time. Any significant changes will be communicated to applicants where appropriate. We recommend reviewing this notice periodically.