Privacy Policy

Last updated: 24 September 2026

Open Hearts Healthcare Ltd is committed to protecting your privacy and handling your personal information fairly, lawfully and securely.

This Privacy Policy explains how we collect, use, store and share personal information when you visit our website, contact us, apply to work with us, work through our agency or use our staffing services.

Open Hearts Healthcare Ltd is the data controller responsible for the personal information covered by this policy.

Website: www.openheartshealthcare.co.uk
Email: info@openheartshealthcare.co.uk

Information we may collect

The personal information we collect will depend on your relationship with us.

We may collect:

your name, address, telephone number and email address;
date of birth and identification information;
employment history and CV information;
qualifications, training and professional registration details;
NMC registration details where applicable;
right-to-work and immigration information;
references and referee contact details;
DBS and other criminal record checking information where appropriate to the role;
information about your skills, experience and suitability for assignments;
availability and preferred working arrangements;
details relating to shifts, placements and timesheets;
payroll, banking and tax information where required;
health information where necessary for employment, occupational health, reasonable adjustments or safe working;
information provided through application, booking, contact and enquiry forms;
correspondence between you and Open Hearts Healthcare Ltd; and
technical information relating to your use of our website, such as your IP address, browser, device and cookie information where applicable.

We only collect personal information that is reasonably necessary for the purpose for which it is required.

How we collect your information

We may collect information directly from you when you:

complete an online application;
submit your CV;
provide recruitment or compliance documents;
contact us by telephone or email;
complete a form on our website;
request healthcare staff;
work on an assignment arranged by us;
submit a timesheet; or
communicate with members of our team.

We may also receive information from third parties, including referees, previous employers, healthcare providers, professional regulatory bodies, the Disclosure and Barring Service, the Home Office and other organisations involved in recruitment and compliance checks.

How we use your personal information

We may use personal information to:

respond to enquiries;
process applications for work;
assess your suitability for healthcare roles;
verify your identity, employment history and qualifications;
obtain and verify references;
carry out right-to-work checks;
verify professional registrations;
undertake DBS and other appropriate pre-employment checks;
match workers with suitable assignments;
arrange and manage shifts and placements;
communicate with workers and healthcare providers;
administer timesheets, payroll and payments;
manage our relationship with clients;
maintain recruitment and compliance records;
meet safeguarding requirements;
comply with legal and regulatory obligations;
establish, exercise or defend legal claims;
maintain the security and operation of our website and systems; and
improve our services and website.

Our lawful bases for processing

Under UK data protection law, we must have a lawful reason for using your personal information.

Depending on the circumstances, we may rely on:

Contract – where processing is necessary to take steps at your request before entering into a contract or to perform a contract with you.

Legal obligation – where we need to process information to comply with a legal or regulatory requirement.

Legitimate interests – where processing is necessary for our legitimate business interests or those of another organisation, provided your rights and interests do not override those interests.

Consent – where we have specifically asked for and obtained your consent. Where we rely on consent, you may withdraw it at any time.

We will identify and document the appropriate lawful basis for the way in which we use personal information.

Special category information

Some information requires additional protection under data protection law. This may include information about your health, disability, racial or ethnic origin, religious or philosophical beliefs, trade union membership or other special category information.

Where we process special category information, we will only do so where an appropriate lawful basis and an additional condition under UK data protection law apply.

This may include processing that is necessary for employment, social security or social protection purposes, compliance with employment law, occupational health requirements or other circumstances permitted by law.

DBS and criminal offence information

Because we recruit and supply healthcare professionals, certain roles may require appropriate DBS or other criminal record checks.

Criminal offence information receives additional protection under data protection law. We will only collect and process this information where we have an appropriate lawful basis and a condition permitted under the Data Protection Act 2018.

Access to this information will be restricted to those who genuinely need it.

The ICO confirms that even a clear DBS result constitutes criminal offence data and that organisations processing such information require an Article 6 lawful basis and, where they do not have official authority, an appropriate Schedule 1 condition.

Right-to-work information

Open Hearts Healthcare Ltd is required to ensure that individuals working for us have the legal right to work in the UK.

We may therefore collect and verify passports, immigration information, share codes, visa information or other evidence of your right to work and may use the relevant Home Office checking services where applicable.

References

Where you provide details of a referee, we may contact that person or organisation to verify information relevant to your application.

You should ensure that you have informed your referees that you are providing their contact details to us.

Healthcare providers and clients

If you contact us on behalf of a care home, nursing home, hospital, private clinic, rehabilitation centre or another organisation, we may collect your name, job title, contact details and information relating to your staffing requirements.

We use this information to respond to enquiries, arrange staffing services, manage bookings and administer our business relationship with your organisation.

Who we may share your information with

Where necessary and lawful, we may share information with:

healthcare organisations considering or using our workers;
previous employers and referees;
the Disclosure and Barring Service;
the Home Office;
professional regulatory bodies such as the Nursing and Midwifery Council;
payroll, accounting and payment service providers;
occupational health providers where applicable;
IT, website, hosting and cloud service providers;
professional advisers;
insurers;
regulators and inspection bodies;
government departments;
law enforcement agencies; and
other organisations where disclosure is required or permitted by law.

We will only share information that is necessary for the relevant purpose.

International transfers

Some technology or service providers may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate legal mechanism and safeguards are in place where required by UK data protection law.

How long we keep information

We do not keep personal information for longer than is necessary.

Retention periods vary according to the type of information, the reason it was collected and any legal, contractual, regulatory, safeguarding, tax, employment or insurance requirements that apply.

When information is no longer required, it will be securely deleted, destroyed or anonymised in accordance with our retention procedures.

How we protect your information

We take appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access.

Access to personal information is restricted to individuals who need it for legitimate business purposes.

Your data protection rights

Depending on the circumstances, you may have the right to:

request access to personal information we hold about you;
request correction of inaccurate or incomplete information;
request deletion of your information;
ask us to restrict how we use your information;
object to certain types of processing;
request the transfer of information in certain circumstances; and
withdraw consent where we rely on consent.

These rights are not absolute and may depend on the circumstances and lawful basis on which we process your information.

To exercise your rights, contact:

info@openheartshealthcare.co.uk

Complaints

If you have concerns about how Open Hearts Healthcare Ltd handles your personal information, please contact us in the first instance at: