Applicant Privacy Notice

Clarus Healthcare LTD.

This Privacy Notice explains how Clarus Healthcare LTD. collects, uses, stores, and protects your personal information when you apply for a role with us. We are committed to safeguarding your privacy, treating you with respect, and complying fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal information is: Clarus Healthcare LTD.

Whittington Hall, Whittington Road, Worcester WR5 2ZX
ICO Registration: ZC038962
Email: dpo@clarushealthcare.co.uk

2. What Personal Data We Collect

During the recruitment process, we collect and process the following categories of information:

Personal details: Name, address, phone number, email address.
Professional background: Employment history (including full history with explanations for gaps as required by CQC), qualifications, and training records.
Right to work: Documentation proving your eligibility to work in the UK, and National Insurance number.
Assessment data: Information provided in your CV, application form, and notes from interviews or assessments.
References: Contact details for your referees and the references they provide.

Special Category and Criminal Offence Data
Because our roles involve regulated activity with vulnerable adults, we are legally required to collect more sensitive information, including:

Criminal records: Results of enhanced Disclosure and Barring Service (DBS) checks, including the adults' barred list.
Health information: Information regarding your physical and mental fitness to perform intrinsic tasks of the role, and any reasonable adjustments you may require during the recruitment process or in employment.
Equal opportunities data: Information relating to protected characteristics (e.g., race, ethnicity, religion, disability) collected solely for anonymised diversity monitoring.

3. Lawful Basis for Processing

Under UK GDPR, we must have a valid lawful basis to process your data. We do not rely on consent for recruitment processing. Our lawful bases are:

Legitimate Interests (Article 6(1)(f)): To assess your suitability for the role, manage the recruitment process, and make informed hiring decisions.
Legal Obligation (Article 6(1)(c)): To comply with employment law (e.g., right-to-work checks) and health and social care regulations (e.g., CQC Regulation 19 Fit and Proper Persons requirements).
Contract (Article 6(1)(b)): To take steps at your request prior to entering into an employment contract.

For Special Category Data (health, diversity) and Criminal Offence Data (DBS), we rely on:

Employment, social security and social protection (Article 9(2)(b) & Schedule 1, Part 1 DPA 2018): To meet our legal obligations regarding fitness to work and safeguarding.
Substantial public interest (Article 9(2)(g) & Schedule 1, Part 2 DPA 2018): Specifically, statutory and government purposes relating to the provision of safe health and social care.

4. Sharing Your Information

We treat your data confidentially. Your information will only be shared with:

Internal hiring managers and authorised HR staff involved in the recruitment process.
External screening providers (e.g., DBS umbrella bodies) to conduct mandatory background checks.
Referees, to obtain employment references.
Regulatory bodies (such as the Care Quality Commission or the ICO) where we are legally required to do so.
IT system providers who host our IT platforms securely.

We will never sell your personal data to third parties.

5. How Long We Keep Your Data

We retain recruitment data only for as long as necessary:

Unsuccessful applicants: We retain your application data for 6 months following the end of the recruitment process, in case of legal claims or to notify you of future suitable vacancies (if you have agreed to this). After 6 months, it is securely destroyed.
Successful applicants: Your recruitment data will be transferred to your secure employee file and retained in accordance with our Employee Privacy Policy and CQC record-keeping requirements.

6. Your Rights Under UK GDPR

You have the right to:

Access: Request a copy of the personal data we hold about you (Subject Access Request).
Rectification: Request correction of inaccurate or incomplete information.
Erasure: Request deletion of your data (though this may be limited where we have a legal obligation to retain it).
Restriction: Request we limit the processing of your data.
Objection: Object to processing based on legitimate interests.

To exercise any of these rights, please contact us using the details in Section 1.

7. Security of Your Data

We use appropriate technical and organisational measures to protect your information from unauthorised access, loss, or misuse. This includes secure digital storage, restricted access controls, and regular data protection training for our staff.

8. International Transfers

We store your data on secure servers located within the UK. We do not routinely transfer your data outside the UK. If this becomes necessary, we will ensure appropriate legal safeguards are in place.

9. Automated Decision-Making

We believe in a human-led, compassionate approach to recruitment. We do not use automated decision-making or profiling to make hiring decisions.

10. Contact & Complaints

If you have concerns about how your data is handled, please contact our Data Protection Lead at dpo@clarushealthcare.co.uk.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.