This Privacy Notice explains how Virtual Pharmacist Ltd collects, uses, stores and shares personal data relating to individuals who work with us or apply to work with us, including:
- Job applicants applying via NHS Jobs, our website, recruitment platforms or directly
- Employees (permanent or fixed term)
- Sole traders providing services to us
- Limited company contractors providing pharmacy or consultancy services
- Locum workers and temporary staff
- Individuals joining our talent pool or expressing interest in future roles
This notice sits alongside our Website Privacy Policy, which explains how we process website visitor data. Both notices together describe the full range of data processing carried out by Virtual Pharmacist Ltd.
1. Purpose of this Privacy Notice
This notice ensures you understand:
- What personal information we collect
- Why we collect it
- How we use it
- Our lawful bases under UK GDPR
- How long we keep it
- Who we share it with
- Your rights regarding your information
2. Personal data we collect
We may collect, store and process the following categories of data depending on the nature of your relationship with us:
2.1 Personal data provided by you
- Name, title and contact details
- CV, employment history and qualifications
- Professional registration details (GPhC, HCPC, NMC, GMC etc)
- Right-to-work documentation
- References and referee contact details
- Professional indemnity insurance certificates
- Banking information (employees and eligible contractors)
- Company registration details (limited company contractors)
- DBS documentation and safeguarding information
- Mandatory training certifications and CPD evidence
- Communications between you and Virtual Pharmacist Ltd
- Information contained in onboarding, contract or HR forms
2.2 Information we obtain from third parties
- References from previous employers
- Professional registration verification
- Mandatory employment checks
- Criminal records information from the Disclosure and Barring Service
- Identity verification providers
- Occupational health assessments where applicable
2.3 Information we generate internally
- Interview notes, scoring and selection outcomes
- Contract documentation
- Workflow and performance records (if working with us)
- Training and compliance records
- Incident logs or conduct information where relevant
2.4 Special category data (only when strictly required)
- Health or disability information (e.g. occupational health or reasonable adjustments)
- DBS-related criminal convictions information
- Optional equal-opportunities monitoring data (processed only with consent)
We apply enhanced safeguards to special category and criminal conviction data.
3. How and why we use your information
We use your data for the following purposes:
Recruitment and selection
- Assessing suitability for a role
- Shortlisting and interviewing
- Contacting you about your application
- Maintaining talent pools (only with your consent)
Employment or contract management
- Issuing employment contracts or contractor agreements
- Ensuring regulatory compliance and clinical safety
- Managing performance, quality assurance and workflow allocation
- Providing access to our systems, training and documentation
- Processing payroll or contractor payments
- Monitoring service delivery for NHS and GP practice clients
- Managing safety, safeguarding and professional standards
Legal, regulatory and organisational obligations
- Right-to-work checks
- DBS and safeguarding compliance
- Demonstrating regulatory compliance for NHS clients
- Responding to legal claims or requests from regulators
4. Lawful bases for processing
We process your information under the following UK GDPR bases:
4.1 Article 6 of UK GDPR
- 6(1)(b) Contract – processing necessary to enter into or perform a contract
- 6(1)(c) Legal obligation – right-to-work, professional registration verification, payroll, tax obligations
- 6(1)(f) Legitimate interests – recruitment administration, workforce management, ensuring service quality
4.2 Special category data – Article 9 UK GDPR
- 9(2)(b) – employment, social security and regulatory obligations
- 9(2)(h) – occupational health
- 9(2)(g) – safeguarding and public interest
- 9(2)(a) – explicit consent (for optional equal-opportunity data only)
4.3 Criminal convictions – Data Protection Act 2018
Processed under Schedule 1 for safeguarding and regulatory compliance.
5. Who we share your information with
Where necessary and proportionate, we may share your information with:
- NHS Jobs (as part of the recruitment process)
- DBS (for criminal record checks)
- Professional regulators (GPhC, GMC, NMC etc)
- Occupational health providers
- Referees you have identified
- External training providers
- Secure cloud service and email providers
- GP practices, PCNs, ICBs and other NHS organisations you may work with
- Accountants and payroll providers (employees and sole traders)
- Insurance providers (if required for clinical governance)
We never sell your data and never share it for marketing.
Transfers outside the UK are safeguarded using lawful mechanisms such as adequacy regulations and ICO-approved International Data Transfer Agreements.
6. How we store and protect your information
We use secure systems with:
- Encryption
- Role-based access controls
- Secure cloud infrastructure
- Regular auditing
- Data minimisation principles
Only authorised HR, compliance and leadership staff can access your information.
7. How long we keep your information
- Unsuccessful applicants: 12 months after recruitment ends
- Successful applicants: Data becomes part of your personnel file
- Employees: Retained up to 6 years after employment ends, depending on category
- Sole traders and limited-company contractors: 6 years from end of engagement (financial recordkeeping requirement)
- DBS certificates: Not retained beyond verification
- Talent Pool: 24 months with consent
Retention periods align with legal, regulatory and NHS-contractual requirements.
8. Your rights
You have the right to:
- Access your data
- Correct inaccuracies
- Request erasure (where applicable)
- Restrict or object to processing
- Withdraw consent (where consent applies)
- Data portability (where applicable)
- Raise a concern with the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/
9. Automated decision making
We do not use automated decision-making or profiling as part of our recruitment or employment processes.
10. Contact us
For any queries about this Privacy Notice or how we process your information, please contact:
Data Protection Lead: Virtual Pharmacist Ltd
Email: support@virtualpharmacist.co.uk
Registered Office: Queen Street Chambers, 68 Queen Street, Sheffield, S1 1WR
Our main website privacy policy can be found at: https://virtualpharmacist.co.uk/privacy-policy/