NMP Digital Application Portal Privacy Notice

This notice explains how and why we use your personal information when you apply to a university using the NMP Digital Application Portal, which is owned and managed by us.

Who are we?

We are The Health and Education Co-operative Ltd ("we", "us", "our"), also known as The Health & Education Co-op.

We are registered with the United Kingdom's data protection authority, the Information Commissioner's Office. Our registration reference number is Z3634914.

Contact us

If you have any questions about how we use your information, you can contact us using your preferred method below:

Your rights

You have the right to:

• Request a copy of the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete your personal data (we may need to keep some information where we have a legal or regulatory reason to do so)
• Object to how we use your data (this may mean we can't continue with your application)
• Restrict how your data is used in certain circumstances
• Request transfer of your data to another University (data portability, where applicable)
• Withdraw your consent at any time where we rely on consent
• Raise a complaint with the Information Commissioner's Office

To make a request, please contact us using the details at the top of this notice. We may need to verify your identity before responding.

Making a complaint

If you have concerns about how we use your information, please contact us first and we'll do our best to resolve it. If you're not satisfied, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint

How long we keep your data

We only keep your data for as long as necessary:

We retain this information to support workforce governance activities, including confirming course completion, verifying prescribing qualifications, and meeting audit and regulatory requirements. At the end of these periods, your data will be securely deleted.

Where your data is stored

The NMP Digital Application Portal and all the details you put in your application form are stored securely on Amazon Web Services (AWS) servers here in the United Kingdom. We keep all your personal application data within the United Kingdom.

We also use Google Analytics 4 to help us improve the portal. Because Google LLC is a global company, some basic usage data may be transferred to servers in the United States (USA). When this happens, we ensure appropriate safeguards are in place to protect your data, such as the UK extension to the EU-US Data Privacy Framework (UK-US Data Bridge).

Who we share your data with

We share your application data (including information you provide and information added by others) with the university you are applying to so they can assess your suitability for the programme.

Some parts of the application need input or approval from authorised individuals, such as your employer, supervisor, funder, or programme lead. These individuals can only see and complete the sections relevant to them. They cannot view your full application.

We also share limited status updates with your employer, supervisor, funder, and programme lead where this is necessary for programme oversight and funding. This includes:

• the status of your application (for example, whether it is in progress or complete)
• the outcome of your course (for example, whether you have completed it, deferred, or left the programme)

We do not share your full application or detailed responses with these parties.

By applying to the programme, you should expect that these status updates will be shared as part of how the programme is managed.

Collecting data from external sources

We primarily collect your personal data directly from you. However, to complete your application, some sections must be completed or verified by relevant individuals you provide.

These may include your:

• Employer
• Funder
• Supervisor or programme lead

Technical controls are in place to ensure these individuals can only access the sections they need to review and complete.

The information we collect and how we use it

We only collect information that is necessary and proportionate to assess your suitability for the programme, meet regulatory and safeguarding requirements, and enable the university to make an informed decision about your application.

• Your full name
• Contact details (home address, telephone number, personal email)
• Date of birth
• National Insurance number
• Professional registration details (e.g. NMC, HCPC, GPhC, PSNI)
• Employment details and history
• Employer contact details
• References (professional and employment)
• Education and qualification history
• Training and experience (e.g. postgraduate and CPD courses)
• Right to work information
• Criminal record check information (e.g. DBS, AccessNI, Disclosure Scotland)
• Security clearance information (where applicable)
• Information you provide through emails or feedback
• Technical information about how you use the portal (such as IP address, login activity, and records of changes made to applications, responses, and approvals) for security purposes

Special category data

We process certain sensitive personal data, including information about your health (for example, confirmation that you are fit to undertake the programme and practise safely).

We use this information to assess your suitability for a regulated healthcare programme. This includes confirming that you are able to safely undertake training and, where relevant, practise as a prescriber. This may involve input from your employer or supervisor to confirm that you are of good health and able to practise safely and effectively in a clinical environment.

We process this information because it is necessary for reasons of substantial public interest, including:

• ensuring patient safety and safeguarding the public
• confirming fitness to practise in a regulated healthcare role
• meeting professional and regulatory requirements for healthcare education and training

This processing is carried out in accordance with Article 9(2)(g) of the UK GDPR and Schedule 1 of the Data Protection Act 2018, including conditions relating to safeguarding individuals at risk and compliance with professional and regulatory requirements in healthcare education and training.

Criminal offence data

We may process information relating to criminal convictions or checks (e.g. DBS, AccessNI, Disclosure Scotland).

We process this data to:

• Meet safeguarding requirements
• Assess suitability for a healthcare training programme
• Comply with regulatory and placement provider requirements

This processing is carried out in line with Article 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018, including conditions relating to safeguarding and regulatory requirements in healthcare settings. This data is retained for the same duration as the general application data. It will be deleted within the retention periods of the 'how long we keep your data' section.

Analytics and usage data

We use Google Analytics 4 to understand how people move through the application form and how the Digital Application Portal is used.

This tool looks at general usage information, such as which pages are visited and how you move through the form. It does not collect the personal details you enter into the form. Although this information does not directly identify you, it may still be treated as personal data under UK data protection law, so we handle it carefully.

We do not use this data for advertising or to try to identify you. We will always be transparent about how we use this data and, where required, give you clear options to control or opt out of analytics.

Our lawful bases

We use different lawful bases depending on how your data is used during the application process. For example:

• Legitimate interests — to operate the NMP Digital Application Portal, and to support the university in assessing and managing applications
• Legal obligation — to meet regulatory and compliance requirements, including those relating to healthcare education, safeguarding, and fitness to practise
• Contract — where processing is necessary to provide the application service you are using
• Consent — where you choose to receive optional communications, such as updates about future opportunities and professional development

Who is responsible for your data

The Health and Education Co-operative Ltd is the data controller for the NMP Digital Application Portal. This means we are responsible for how your personal data is collected, used, and protected within the portal.

When you apply to a university using the portal, the university you are applying to will also act as a separate data controller for the information you provide to them. They will use your data to assess your application and to meet their legal and regulatory responsibilities in relation to healthcare education and training.

Other individuals involved in your application, such as your employer, supervisor, funder, or programme lead, may also act as independent data controllers in relation to the information they provide or review, where they are doing so as part of their own professional or regulatory responsibilities. These organisations are responsible for how they use your data in their own capacity as data controllers. You should refer to their own privacy notices for further information.

Keeping your data secure

The NMP Digital Application Portal is hosted on secure servers in the United Kingdom.

We take the security of your information seriously. We use a combination of technical and organisational measures to protect your data, including controlling who can access it and ensuring people only see the information they need. We also use encryption and secure systems to help keep your information protected.

Changes to this notice

We may update this Privacy Notice from time to time. If we make significant changes, we will notify you using the contact details you have provided.