Privacy Policy

Who we are

Staffly operates this service to match doctors with temporary (locum) shifts at NHS trusts. For questions about your data, contact privacy@stafflymedical.co.uk.

[Needs confirming: is this a real, monitored inbox, and who is the named contact for data protection queries?]

What we collect, and why

If you sign up as a doctor, we collect:

• Your name, email address and password (stored as a one-way hash, never in plain text)
• Your GMC reference number
• Identity documents you upload: photo ID, a DBS (criminal record) check, right-to-work evidence, and qualification certificates
• Your shift preferences (grade, specialty, travel distance, availability)
• Records of shifts you apply for, are confirmed for, or complete, and the timesheets and pay associated with them

We collect your account details and GMC number because we need them to match you with suitable shifts and to operate your account - this is necessary to provide the service you've signed up for. We collect identity, DBS and right-to-work documents because NHS trusts are legally required to verify them before booking a doctor onto a shift. We keep timesheet and pay records because we're legally required to for tax purposes.

DBS and criminal record check data

A DBS certificate is a special category of data under UK data protection law, and we handle it accordingly. It's reviewed by our compliance team as part of verifying your account, and its status (not its full content) is visible to a trust considering booking you for a shift. We keep a record that a check was made and passed - so you're not asked to repeat it unnecessarily - but the certificate itself is deleted six months after upload. Files are stored in an access-controlled cloud storage bucket, limited to the compliance team reviewing your account.

[Needs confirming: the exact list of who downstream sees DBS/right-to-work status - which trusts, and whether an umbrella body or third-party verification service is involved - so this section names them accurately.]

How long we keep your data

• DBS certificates: deleted six months after upload
• Right-to-work evidence and photo ID: deleted two years after upload
• Timesheets and pay records: kept for six years, as HMRC requires for financial records
• Everything else, if you close your account: deleted, other than what the above legal obligations require us to keep

Your rights

You can download a complete copy of your data at any time from Profile → Your Data. You can ask us to correct anything that's wrong, or to delete your account, by contacting the coordinator shown on any of your shifts, or privacy@stafflymedical.co.uk. Deleting your account removes your personal details; it does not remove timesheet and pay records we're legally required to keep, or shift history that other people's records depend on. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've handled your data incorrectly.

Cookies

We use one cookie to keep you signed in. It's required for the service to work and isn't used for tracking or advertising. We don't currently use any analytics or advertising cookies.

Changes to this policy

If this policy changes in a way that affects how we use your data, we'll update the date at the top of this page and, where the change is significant, email you about it.