Privacy Notice for Job Applicants

This Privacy Notice sets out important details about information that BMI Healthcare may collect and hold about you, how that information may be used and your legal rights.  Please take time to read this Privacy Notice carefully and contact us if you have any questions about its content.

We will review this Privacy Notice on a periodic basis and we advise you to check back on our website for the latest version.

Who has information about me?

Our hospitals are run by BMI Healthcare Limited.  Some of our hospitals (BMI Southend Private Hospital, BMI Three Shires Hospital and BMI Syon Clinic) and some of the services in some of our hospitals (the oncology service at BMI Beardwood Hospital and the imaging services at BMI Mount Alvernia Hospital and BMI Three Shires Hospital) are owned by partner companies, each of which has a management contract with BMI Healthcare and forms part of the BMI Healthcare group. A partner company also owns the CT and MRI scanners at BMI The Meriden Hospital; this service is managed by UME. Our decontamination business is run by a sister company to BMI Healthcare and forms part of the BMI Healthcare group. 

All these companies are registered at BMI Healthcare House, 3 Paris Garden, Southwark, London SE1 8ND and their full names and registered company numbers are as follows:

  • BMI Healthcare Limited – 02164270
  • BMI Hospital Decontamination Limited - 06003075
  • Three Shires Hospital LLP – OC398963
  • BMI Southend Private Hospital Limited – 05155289
  • BMI Syon Clinic Limited – 05706302
  • North West Cancer Clinic Limited (05706220) - BMI Beardwood Hospital oncology service
  • BMI Imaging Clinic Limited (05706274) - imaging service at BMI Mount Alvernia Hospital
  • The Pavilion Clinic Limited (06061941) – imaging service at BMI Three Shires Hospital
  • Meriden Hospital Advanced Imaging Centre Limited (05607465) – MRI and CT service at BMI The Meriden Hospital

Each of these companies may, to the extent relevant, collect, retain and use information about you and we refer to these collectively as ‘BMI Healthcare’ in this document.

External websites

We may from time to time include on our websites links to and from the websites of other organisations.  If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.  Please check these policies and notices before you submit any personal data to these websites.

Where did you get this information from and what information does BMI Healthcare hold about me?

We have information about you which you have supplied to us as part of the recruitment process, either through uploading of this information to our website, by sending information to us by post or by email, or by providing this information to us over the telephone.  On occasion, we may have been provided this information via a recruitment agency.  This includes your name and contact details (postal and email addresses and phone numbers) as well as details of your current salary, confirmation of your right to work in the UK without sponsorship, an explanation of any gaps in your CV of more than one month and details of your experience.  We ask you also to provide us with a copy of your CV and supporting information (such as professional qualifications), to confirm if you have any criminal convictions and if so, to provide details of these.  We will also hold information about you and your suitability for the role which you have provided us during an interview.

To the extent you provide such information to us, we may also hold more sensitive information about you, such as your current or previous physical or mental health, your sex life and/or sexual orientation, your religion, nationality, race and/or ethnicity and genetic or biometric data relating to you.  We refer to this as ‘more sensitive information’ in this Privacy Notice. 

Should your application be successful (conditional on checks and other conditions, such as references, being satisfactory), we carry out checks such as confirming your previous employment, qualifications and professional registrations, your right to work in the UK and where appropriate, credit checks.  This means we may obtain information about you from professional bodies such as the Nursing & Midwifery Council (NMC), the Health and Care Professions Council (HCPC) and on occasion, also from government agencies such as HMRC or the Home Office as well as from any educational establishments you advise you have a qualification from and previous employers you advise us about and credit checking agencies.  We will ask you to complete an application with either the Disclosure & Barring Service (which covers England and Wales) or Disclosure Scotland (which covers Scotland) to confirm whether or not you have any criminal convictions and the results of that application will be sent to us and to you.  We will also obtain references from individuals whose details you provide to us.

Successful applicants (conditional on checks and satisfactory references) will also be asked to complete an occupational health assessment.  Members of the recruitment team at BMI Healthcare start the process and can view the date the assessment has completed, but will not have access to any of the information within the assessment.  That information will be visible only to members of our occupational health service involved in providing occupational health assessments within BMI Healthcare.  Our occupational health service will make an assessment of the information provided (in terms of confirming your fitness to work and whether there are any reasonable adjustments required to be made to enable you to perform the role) and will make this available to the relevant manager and the employee compliance coordinator at the hospital or corporate site where the role is based.

In order for us to process your application, we ask that you provide as much information to us as you can.  You are of course free not to disclose information to us and you should only provide such information as you feel comfortable doing so.  Please bear in mind, however, that if you are only willing to share limited information, we may not be able to take forward your application.

How will BMI Healthcare use the information it holds about me?

We use information about you in connection with your application for a role with BMI Healthcare; including:

  • Assessing your skills, qualifications and suitability for the role
  • Carrying out background and reference checks
  • Communicating with you about the recruitment process
  • Keeping records related to our recruitment processes
  • Complying with legal or regulatory requirements

It is necessary for us to use information about you as described above in order to pursue our legitimate interest of considering whether or not you are suitable to be appointed to the role for which you have applied.

We may use more sensitive information to advise if any reasonable adjustments need to be made so you can attend an interview and, should you be successful (conditional on checks and satisfactory references), to confirm your fitness to work and any reasonable adjustments that may need to be made to enable you to carry out the role.  Where the role for which you are applying entitles us or requires us to do so, we carry out a criminal records check in order to satisfy ourselves that there is nothing in your criminal convictions history that makes you unsuitable for the role.  The level of check will depend on the particular role and we have in place appropriate safeguards which we are required by law to maintain when processing such information.

We may also use more sensitive information to ensure meaningful equal opportunity monitoring and reporting.

We may use your phone number and email address to contact you in relation to your application.

We may also use information about you for maintaining our business records and developing and improving our recruitment processes and monitoring outcomes where we believe there is a business need to do so and our use of information about you does not cause harm to you.

We may also use information about you where there is a legal or regulatory obligation on us to do so (such as the prevention of fraud) or in connection with legal proceedings.  In particular cases, it may be necessary for us to use more sensitive information about you in order for us to establish, exercise or defend our legal rights. 

We may also use information about you where you have provided your consent to us doing so.

We do not carry out automated decision making or profiling.

Please see also the more detailed information in the sections below.

Will BMI Healthcare share information about me with others?

Yes; we set out these reasons below and assure you that in each case, we share only such information as is appropriate. 

Sharing information with our staff who are involved in the recruitment process, including administrative staff, and if you are successful, also with our occupational health team

We will share information relating to you with those of our staff involved in the recruitment process, including administrative staff.   Should you be successful (conditional on checks and satisfactory references), information about you will also be shared with our occupational health team (some of whom are not employed by BMI Healthcare but work with us under contracts which contain strict confidentiality provisions).

Sharing information with previous employers, educational establishments and professional bodies and, where relevant, credit agencies

We may share information relating to you with previous employers, educational establishments and/or professional bodies (and where relevant also credit agencies) to verify information you tell us about your previous experience, qualifications and professional registrations. 

Sharing information with third parties whose details you provide as referees

We may share information relating to you with previous employers and individuals whose details you provide to us to request a reference on your suitability for the role you have applied for. 

Sharing information with the Disclosure & Barring Service and Disclosure Scotland

Where we are required or entitled (in each case relevant to the role in question), we may share information relating to you with the Disclosure & Barring Service or Disclosure Scotland to confirm whether you have (and the details of) any criminal convictions. 

Sharing information with third parties who are not involved in the recruitment process or any of our checks

We may share information about you with external organisations such as our lawyers, auditors, financial, tax and public relations advisors and NHS organisations.  We may also share information about you with third party suppliers, which provide us with document scanning and storage facilities.  We may also share information about you with those providing us with information technology systems, this includes a recruitment administration management system as well as other non-clinical software applications (and related services) and website hosting.  In each case, we would share only such information as was relevant. 

Sharing with regulators or because of a legal obligation

We may share information about you with our regulators, including the Care Quality Commission, Healthcare Improvement Scotland and Healthcare Inspectorate Wales (which inspect our hospitals in England, Scotland and Wales respectively).  Other regulators with whom we may share information about you include the Human Fertilisation and Embryology Authority (which regulates and inspects all our clinics providing fertility services or which store eggs, sperm or embryos), NHS England (which leads the NHS in England) and the Department of Health (the government department responsible for health and adult social care policy). 

Sometimes, we are required to disclose information about you because we are legally required to do so.  This may be because of a court order or because a regulatory body has statutory powers to access applicants’ records as part of their duties to investigate complaints, accidents or health professionals’ fitness to practise.  Before any disclosure will be made, we will satisfy ourselves that any disclosure sought is required by law or can be justified in the public interest.   Information about you may also be shared with the police and other third parties where reasonably necessary for the prevention or detection of crime.  On occasion, this may include the Home Office and HMRC.

Audits, surveys and initiatives

In common with other employers, we also look at the quality of our recruitment processes and, separately, at the numbers of historical and current vacancies and applicants for these for trend purposes.  We also provide NHS organisations with information to fulfil our obligations under the NHS Workforce Race Equality Standard, which helps ensure employees from black and minority ethnic backgrounds have equal access to career opportunities and receive fair treatment in the workplace.  We can assure you that your personal information remains under our control at all times and we ensure any information we provide outside of BMI Healthcare will not contain any information in which any applicant can be identified, unless it is required by law.  Any publishing of this data will be in anonymised statistical form. 

Change of hospital ownership

If we were to sell or transfer a hospital or part of our business to another organisation, your records would also transfer to the new owner.  Limited information may also be shared, where required, with legal and other professional advisors involved in that transaction. 

The reason we would transfer your records is to minimise the disruption to any recruitment process and to ensure we and a new owner were able to comply with our legal obligations regarding the retention of such records.

Where and for how long does BMI Healthcare store information about me?

The information about you that we hold and use is held securely in the United Kingdom and stored in paper format and on our secure servers (or those of our third party information technology provider).  However, where a referee, previous employer, educational establishment or professional body is based overseas, we may transfer information about you to these, for the reasons described above.  In addition, our third party information technology provider uses some third parties based overseas to support its web hosting service and related software.  We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice.

We retain your records for certain periods (depending on the particular type of record) under our retention of records policy.  For both successful and unsuccessful applications, we retain these records in our recruitment system for one year, with the information for successful candidates subsequently then transferred to our employment records (staff should see our Staff Privacy Notice accessible through our intranet system for further information) and the information relating to unsuccessful candidates then being securely destroyed.  These timeframes may be extended in the event of a complaint, legal proceedings or where we are required to do so by a regulatory body.  These timeframes are to ensure that information is properly managed and is available whenever and wherever there is a justified need for that information, including to support our legitimate interests, and to meet legal requirements.

If you ask us to retain your information in case of a future suitable vacancy, we will do so for a further period of one year.

If you would like more detailed information on this, please contact our Information Governance & Data Protection Officer (contact details below).

What rights do I have?

The law provides you and other candidates with certain rights in relation to the information about you that we hold.  You may exercise these at any time by contacting our Information Governance & Data Protection Officer (contact details below) or as otherwise noted below.

There will not usually be a charge for handling a request to exercise your rights and if we cannot comply with your request, we will usually tell you why.  If you make a large number of requests or it is clear it is not reasonable for us to comply with a request, then we do not need to respond or we can charge for doing so.

Right of access

You have the right to access information held about you.  This includes details of what information we hold about you and a copy of that information.  The information will be provided free of charge and, unless there are grounds for extending the statutory deadline, the information will be provided to you within one month of receipt of your request.  Please note we will generally also ask for confirmation of your identity and may need further information from you in order to locate the information, in which case the time period starts from the date we have that detail.  Please note that in some cases we may not be able to comply fully with your request, such as where your request also involves information about someone else and it would not be fair to that other person to provide the information to you.

Please contact the Information Governance & Data Protection Officer (contact details below) should you wish to exercise this right.

Right to rectification

We take reasonable steps to ensure the information we hold about you is both accurate and complete.  However, you are entitled to have the information rectified if that is not the case.  Unless there are grounds for extending the statutory deadline, we will respond within one month of receipt of a rectification request.

Please contact the Information Governance & Data Protection Officer (contact details below) should you wish to exercise this right.

Right to erasure (sometimes referred to as the right to be ‘forgotten’)

In some circumstances, you have a right to have information about you ‘erased’ and to prevent us using or holding information about you.  Please note that we do not have to comply with such a request where it is necessary to keep your information in order for us to perform tasks which are in the public interest (including public health) or for the purposes of establishing, making or defending legal claims.  If you make such a request and we comply with it, please be aware that we will retain a note of your name, the request made and the date we complied with it.

Please contact the Information Governance & Data Protection Officer (contact details below) should you wish to exercise this right.

Right to restrict processing

In some situations, you have a right to ‘block’ or suppress our holding or using information about you.  As with the right to erasure, please note that we do not have to comply with such a request where it is necessary to keep your information in order for us to perform tasks which are in the public interest (including public health) or for the purposes of establishing, making or defending legal claims. 

Please contact the Information Governance & Data Protection Officer (contact details below) should you wish to exercise this right.

Right to data portability

You have the right to obtain and re-use your personal data for your own purposes across different services, allowing you to move, copy or transfer personal data from one IT environment to another.  This right, however, only applies to personal data you have provided to us, where the processing is based on your consent or for the performance of a contract; and when the processing is carried out by automated means.

Please contact the Information Governance & Data Protection Officer (contact details below) should you wish to exercise this right.

Rights relating to automated decision making

You have the right not to be subject to a decision when it is based on automated processing (i.e. by a computer alone); and it produces a legal effect or a similarly significant effect on you.  As noted above, BMI Healthcare does not carry out automated decision-making in relation to job applicants.

Please contact the Information Governance & Data Protection Officer (contact details below) should you wish to exercise this right.

Right to withdraw consent

You have the right to withdraw consent to us holding or using information about you, but only if ‘consent’ is the basis for us holding or using your information.  You may choose for us to hold your details in case a suitable vacancy arises in the future.  Should you change your mind at any time please contact our recruitment team at recruitmentteam@bmihealthcare.co.uk to let them know; you do not need to give a reason and any future application will not be affected. 

Please contact the Information Governance & Data Protection Officer (contact details below) should you wish to exercise this right.

Apart from this limited instance, we do not hold or share information about you based on (or at least solely on) consent.

Right to object

You have the right to object to BMI Healthcare holding or using information about you in certain situations – where this is based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling); direct marketing (including profiling); and processing for purposes of scientific/historical research and statistics. 

Please contact the Information Governance & Data Protection Officer (contact details below) should you wish to exercise this right.

Right to complain to the Information Commissioner’s Office

You can complain to the Information Commissioner’s Office (ICO) if you are unhappy with the way we have dealt with a request from you to exercise any of your rights or if you think we have not complied with our legal obligations.  Whilst you do not have to do so, we would appreciate you making the Information Governance & Data Protection Officer aware of the issue and giving us an opportunity to respond and to address it before contacting the ICO. 

Making a complaint will not affect any other legal rights or remedies that you have.  More information can be found on the ICO website: https://ico.org.uk/ and the Information Commissioner's Office can be contacted by post, phone, fax or email as follows:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

  • Tel: 0303 123 1113 (local rate) or 01625 545 745 9 (if you prefer to use a national rate number)
  • Fax: 01625 524 510
  • Email: casework@ico.org.uk

Contacting BMI Healthcare and the Information Governance & Data Protection Officer

For further questions or to exercise any rights set out in this Privacy Notice, please contact BMI Healthcare's Information Governance & Data Protection Officer:

Information Governance & Data Protection Officer
BMI Healthcare Limited
BMI Healthcare House
3 Paris Garden
London
SE1 8ND

Email: dataprotectionofficer@bmihealthcare.co.uk.

*Privacy Notice for Recruitment v2.1 May 2018