Privacy Policy

1. Introduction and Who We Are

2. Our Multi Sector Capability

Although FHcare originated within, and remains deeply rooted in, healthcare and social care recruitment, the platform has been engineered as a configurable, multi tenant compliance and workforce technology system rather than as a single purpose healthcare tool. Its underlying architecture, including document verification workflows, right to work checking, DBS and background screening integrations, shift and rota management, credential expiry tracking and communication tooling, is sector agnostic by design and can be, and in some cases already is being, tailored and licensed for deployment into adjacent regulated and unregulated sectors.

These sectors may include, without limitation, education and childcare staffing, hospitality and events staffing, transport, logistics and driving services, construction and skilled trades, retail and facilities services, and other fields in which organisations must manage a distributed or agency based workforce and demonstrate ongoing compliance with sector specific credentialing, right to work, safeguarding or licensing requirements. Because our client base and the categories of personal data we process can therefore expand beyond healthcare specific data such as clinical training records or professional registration numbers, this Policy has been written broadly enough to cover data practices across all sectors in which the FHcare platform is or may in future be deployed, while retaining the enhanced protections appropriate to health related and other special category data where that data continues to be processed.

We will update our sector specific annexes as new verticals are onboarded, and we encourage client agencies operating outside healthcare to confirm with us which categories of this Policy apply most directly to their configuration of the platform.

3. Definitions and Interpretation

In this Policy, personal data means any information relating to an identified or identifiable natural person. Special category data or sensitive personal data means personal data revealing racial or ethnic origin, health data, biometric data used for identification, or other categories afforded enhanced protection under applicable law. Processing means any operation performed on personal data, including collection, storage, use, disclosure and deletion. Data controller means the entity that determines the purposes and means of processing personal data. Data processor means an entity that processes personal data on behalf of and under the instructions of a controller. Client agency means an organisation that has licensed the FHcare platform to manage its own workforce, candidates or clients. Candidate or workermeans an individual whose data is processed through a client agency's use of the platform. Sub processor means a third party engaged by FHcare to assist in providing the Services and who processes personal data as a result.

References in this Policy to applicable law include, as relevant to the location of the individual concerned or the location of processing, the UK General Data Protection Regulation and the Data Protection Act 2018, the EU General Data Protection Regulation, the California Consumer Privacy Act as amended by the California Privacy Rights Act, the South African Protection of Personal Information Act, the Irish Data Protection Act 2018, and any other data protection or privacy law that applies to a given instance of processing carried out through the platform.

4. Scope and Application of This Policy

This Policy applies to all users of the FHcare platform, our corporate website, our mobile applications and any other digital property operated by FHcare, regardless of the sector in which the client agency operates. It applies whether you are an administrator configuring the platform on behalf of an agency, a recruiter using the platform day to day, a candidate or worker whose compliance and shift data is held within it, or a visitor to our marketing website.

This Policy does not apply to the separate privacy practices of client agencies themselves, which are addressed in their own privacy notices, nor does it apply to third party websites or services that may be linked from our platform but which we do not control. Where a client agency has requested a bespoke or sector specific configuration of the platform, we may issue a supplementary annex to this Policy describing any additional categories of data collected or any sector specific legal basis relied upon, and that annex should be read together with this Policy.

5. Information We Collect

6. How We Use Your Information

We use personal data to provide and operate the platform, including processing recruitment and onboarding applications, managing compliance workflows and credential expiry alerts, enabling shift booking and rota management, and delivering the sector specific features that a client agency has licensed.

We use personal data for account management, including creating and maintaining user accounts, authenticating logins, enforcing role based access controls and sending account related notifications. We use it for customer support, to respond to queries and resolve technical issues raised by administrators, recruiters or candidates. We use it for security and fraud prevention, including monitoring for suspicious login activity, detecting attempted credential compromise and protecting the platform and its users from misuse.

We use personal data, in aggregated or pseudonymised form wherever practicable, for analytics and product improvement, so that we can understand how features are used across our client base and prioritise development accordingly. We use personal data as necessary to comply with applicable law, including responding to lawful requests from courts, regulators or law enforcement authorities. Where you have given consent, we use contact details for marketing communications such as product updates, case studies and platform news, and you may withdraw that consent at any time without affecting any other use of your data.

We do not use candidate or worker compliance data for marketing purposes, and we do not permit client agencies to repurpose data collected for compliance verification into unrelated marketing activity without an independent lawful basis of their own.

7. Legal Basis for Processing

8. Automated Decision Making and Artificial Intelligence

Certain features of the platform use automated logic to support compliance and workforce management, including automated flagging of expiring credentials, automated matching of candidate availability against open shifts, and automated document verification checks that compare uploaded credentials against expected formats and expiry rules. These features are designed to assist human decision makers within a client agency rather than to make final decisions about an individual's employment, engagement or access to work without human involvement.

Where a feature does involve a decision that produces legal or similarly significant effects on an individual, we ensure that a human reviewer within the relevant client agency retains the ability to review, challenge and override the automated output before it is acted upon, consistent with the requirements of applicable law concerning automated decision making and profiling. We do not use candidate or worker data to train general purpose machine learning models outside the context of the specific platform features described to client agencies, and where any model training does occur on platform usage data, we apply pseudonymisation and minimisation techniques and maintain a record of the lawful basis, source jurisdiction and purpose of that training data.

If you believe an automated feature within the platform has produced an inaccurate or unfair outcome affecting you, you should raise this in the first instance with the client agency responsible for your record, who as data controller is best placed to review and correct the outcome, and you may also contact us directly using the details in Section 24.

9. Data Sharing and Disclosure

We do not sell personal data, and we do not share personal data for cross context behavioural advertising. We disclose personal data only in the circumstances described below.

10. Sub Processors and Third Party Vendors

We maintain a current list of sub processors engaged in the operation of the platform, which is available on request and, where feasible, published within the platform's administrative settings for client agency review. Our principal sub processors include Amazon Web Services for cloud infrastructure hosting, Firebase for push notification delivery, and reputable SMTP providers for transactional email delivery. Where a client agency has integrated a third party background screening, identity verification or payroll provider into their instance of the platform, that provider acts as a further sub processor or, in some cases, as an independent controller in its own right, and its own privacy terms will apply to the specific checks it performs.

Before engaging any new sub processor that will have access to personal data, we conduct a due diligence review of its security posture, data protection commitments and, where the sub processor is located outside the United Kingdom or European Economic Area, the transfer mechanism that will govern the export of data to it. We require all sub processors to enter into data processing terms consistent with applicable law, including obligations of confidentiality, security, breach notification and cooperation with data subject rights requests, and we notify client agencies of any material change to our sub processor list with a reasonable opportunity to object.

11. Data Retention

We retain personal data for as long as the relevant account remains active or as needed to provide the Services. When an account is closed or a subscription ends, we retain associated data for ninety days to allow for account recovery and to meet short term legal and operational obligations, after which it is securely deleted or irreversibly anonymised unless a longer period is required by law or by the client agency's own retention instructions.

Compliance documents and candidate records processed on behalf of client agencies are retained in accordance with that agency's instructions and applicable employment, immigration and healthcare regulation, which in the United Kingdom and Ireland typically requires retention of certain right to work and training records for a period of up to seven years following the end of the working relationship. Where a sector configuration outside healthcare imposes a different statutory retention period, for example driver licensing records or safeguarding checks in education settings, we apply the retention schedule appropriate to that sector as instructed by the client agency.

You may request deletion of your personal data at any time, subject to our legal retention obligations and those of the relevant client agency, by contacting us using the details in Section 24 or by contacting the client agency directly where they hold controller responsibility for your record.

12. Your Rights

13. Cookies and Tracking Technologies

14. Data Security Measures

We implement technical and organisational measures appropriate to the sensitivity of the data we hold, calibrated to reflect that some client agencies process health, criminal record and safeguarding data requiring the highest level of protection, while others process less sensitive workforce data. Measures include encryption of data in transit using TLS 1.2 or higher and encryption of sensitive data at rest, per client agency data isolation achieved through separate database partitioning or dedicated clusters depending on the client tier, role based access controls that restrict data access to authorised personnel on a need to know basis, mandatory multi factor authentication for administrative accounts, regular automated backups stored in encrypted storage, and continuous monitoring and alerting for suspicious or anomalous activity.

We conduct periodic security reviews and, where appropriate to the scale of a deployment, independent penetration testing, and we maintain an incident response plan that is tested and updated at least annually. Access to special category data within the platform is further restricted through granular permission settings that allow a client agency to limit visibility of health, criminal record or safeguarding information to specifically authorised roles within their own organisation.

No system can guarantee absolute security, and we cannot warrant that unauthorised access, hardware failure or other harm will never occur. We commit to acting promptly and transparently in the event of any incident, as described in Section 17.

15. International Data Transfers, Data Localisation and Cross Border Processing

Our primary infrastructure is hosted on Amazon Web Services in the European Union, in the eu west 1 Ireland region, and in the United Kingdom, in the eu west 2 London region. As our client base and sector footprint expand, personal data may in some configurations be processed, stored or accessed from additional locations, including where a client agency operates internationally, where a sub processor maintains infrastructure outside the United Kingdom or European Economic Area, or where support and development functions are carried out from a jurisdiction other than the location of the data subject.

Where personal data is transferred outside the United Kingdom or European Economic Area, we ensure that an appropriate safeguard is in place before the transfer occurs. This may include reliance on an adequacy decision made by the UK government or European Commission in respect of the receiving jurisdiction, the use of Standard Contractual Clauses approved by the European Commission together with the UK International Data Transfer Addendum where relevant, the use of the South African Protection of Personal Information Act's own cross border transfer conditions where data moves to or from South Africa, or other lawful transfer mechanisms recognised under applicable law from time to time. We conduct a transfer impact assessment before relying on Standard Contractual Clauses to confirm that the receiving jurisdiction offers a level of protection that is not undermined by local law or practice, and we implement supplementary technical measures such as encryption and pseudonymisation where warranted by that assessment.

Because the FHcare platform is built as a multi tenant system that may in future serve client agencies located in, or with candidates or workers located in, multiple jurisdictions simultaneously, personal data belonging to individuals in different countries may in some cases be logically aggregated within shared infrastructure for the purposes of system administration, analytics conducted on anonymised or pseudonymised data, and platform wide security monitoring, even where that data is not accessible to client agencies outside their own tenant environment. We refer to this operational reality, and the protections we apply to it, in Section 16.

16. Limitation of Liability and Indemnification for Cross Border and Multi Jurisdictional Processing

This section addresses the specific operational reality that FHcare operates a single, centrally administered technology platform that is licensed to client agencies across multiple jurisdictions, and that infrastructure level administration, security monitoring, backup and disaster recovery functions may necessarily involve the collocation or logical aggregation of data originating from different countries within shared, tenant isolated infrastructure, even though client data remains logically segregated and is not commingled between client agencies at the application layer.

FHcare processes personal data strictly on the documented instructions of the relevant client agency acting as data controller, or, in respect of our own website and account administration data, as an independent controller subject to the terms of this Policy. Where a client agency instructs us to collect, process or store personal data in a manner that does not comply with the data protection law applicable to that client agency's own jurisdiction or to the jurisdiction of the individuals whose data is concerned, responsibility for that instruction and its compliance with local law rests with the instructing client agency, and FHcare's role is limited to executing that instruction through the technical means made available on the platform, together with flagging any instruction that appears on its face to be unlawful.

To the fullest extent permitted by applicable law, FHcare shall not be liable for any loss, damage, regulatory penalty or third party claim arising from the collocation, aggregation or cross border transfer of personal data within our shared infrastructure where that collocation, aggregation or transfer occurs as a necessary consequence of operating a centrally administered, multi tenant platform in accordance with the security architecture described in Section 14 and the transfer safeguards described in Section 15, and where FHcare has not acted outside the documented instructions of the relevant controller or in breach of its own obligations as processor under applicable data processing terms. Each client agency using the platform agrees, as a condition of its licence to use the Services, to indemnify FHcare against claims, penalties or losses arising from that client agency's own instructions, its own determination of the lawful basis for processing, its own compliance with sector specific or jurisdiction specific law, or its own failure to notify FHcare of a jurisdiction specific requirement that would materially affect how data belonging to its candidates or workers should be collected, stored or transferred.

This limitation of liability does not exclude or limit liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited under applicable law. It is intended to reflect a fair allocation of responsibility between a technology platform provider operating shared multi jurisdictional infrastructure and the client agencies who determine the purposes and legal basis for processing personal data through that platform, consistent with the recognised division of responsibility between data controllers and data processors under the UK GDPR, EU GDPR, POPIA and comparable frameworks.

17. Data Breach Notification

We maintain an incident response process designed to detect, contain and assess any suspected personal data breach without undue delay. In the event of a personal data breach that poses a risk to the rights and freedoms of affected individuals, we will notify the relevant supervisory authority within seventy two hours of becoming aware of the breach where required by applicable law, and we will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Where a breach affects data processed on behalf of a client agency acting as controller, we will notify that client agency promptly and provide the information reasonably necessary for them to meet their own regulatory notification obligations, recognising that in most jurisdictions the primary notification duty to affected individuals rests with the controller rather than with FHcare as processor. We will cooperate fully with any investigation carried out by a supervisory authority or by an affected client agency in connection with a breach.

18. Children's Privacy

The FHcare platform is intended for professional use by adults aged eighteen and over, including in sector configurations outside healthcare such as education staffing, where the platform is used by adult staff members rather than by the children or young people who are ultimately supported or taught by those staff members. We do not knowingly collect personal data directly from children under eighteen through the platform.

Where a client agency operating in a sector involving work with children, such as education or childcare staffing, uses the platform to record safeguarding related information that references a child or young person incidentally, for example within a placement note, that information is treated with the same enhanced protections described in Section 14 for special category data, and access is restricted to specifically authorised roles. If we become aware that we have collected personal data directly from a child without appropriate authorisation, we will delete that data promptly. If you believe we may hold such data, please contact us using the details in Section 24.

19. Third Party Links, Integrations and Client Agency Instances

Our website and platform may contain links to third party websites, or may integrate with third party services selected by a client agency, such as payroll providers, accounting software, background screening providers or communication tools. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy notices before providing personal data to them.

Each client agency operates its own branded instance of the FHcare platform, configured according to its own sector, size and compliance requirements. While the underlying infrastructure and security architecture is common across instances, the specific data fields collected, the workflows applied and the retention periods observed may differ between client agencies. This Policy describes our practices as the platform operator across all instances, while acknowledging that a given client agency's own privacy notice may contain additional or, in narrow respects, differing detail relevant to their specific use of the platform.

20. Accessibility Statement

We are committed to making our website and platform accessible to the widest possible audience, including individuals with disabilities, consistent with recognised accessibility standards such as the Web Content Accessibility Guidelines. If you experience difficulty accessing any part of our website or platform, or if you require this Policy in an alternative format, please contact us using the details in Section 24 and we will take reasonable steps to assist you.

21. Complaints and Dispute Resolution

If you have a concern about how we have handled your personal data, we encourage you to contact us in the first instance using the details in Section 24 so that we can investigate and, wherever possible, resolve the matter directly. We aim to acknowledge complaints promptly and to provide a substantive response within thirty days.

If you remain dissatisfied following our response, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction, including the Information Commissioner's Office in the United Kingdom, the Data Protection Commission in Ireland, the Information Regulator in South Africa, or the equivalent authority in your own country of residence. Where a dispute cannot be resolved informally, and subject to any mandatory rights you hold under applicable consumer or data protection law, the parties may agree to resolve the dispute through mediation before resorting to court proceedings.

22. Governing Law and Jurisdiction

This Policy, and any dispute arising out of or in connection with it, is governed by the laws of England and Wales, without prejudice to any mandatory rights you hold under the data protection law of your own country of residence, which continue to apply and are not displaced by this clause. The courts of England and Wales have non exclusive jurisdiction over any dispute arising from this Policy, meaning that you remain free to bring proceedings in the courts of your own jurisdiction where applicable law entitles you to do so.

23. Changes to This Policy

We may update this Policy from time to time to reflect changes in our data practices, our sector footprint, applicable law or the way our business operates. Where a change is material, we will notify affected users by email or by posting a prominent notice within the platform at least thirty days before the change takes effect. The updated Policy will display a revised effective date at the top of the document. Your continued use of the Services after the effective date of an updated Policy constitutes your acceptance of that update, save that we will always seek fresh consent where applicable law requires it, for example in relation to a materially different use of special category data.

24. Contact Us