01Who we are
Ava Medical Limited (“Ava Medical”, “we”, “us”, “our”) is a specialist medical recruitment business that places doctors into permanent and fixed-term roles across the NHS and the health systems of Australia and New Zealand. For the personal information described in this policy, we are the “data controller”.
- Company: Ava Medical Limited, registered in England & Wales, company number 16599888.
- Registered office: Hawke House, Old Station Road, Loughton, Essex IG10 4PL.
- Data protection contact: jack@avamedical.co.uk.
We are not required to appoint a statutory Data Protection Officer, but the contact above is responsible for overseeing questions about this policy and how we handle personal data.
02The information we collect
The information we collect depends on your relationship with us.
If you are a doctor / candidate
- Identity & contact details — name, title, date of birth, email, phone, address, nationality.
- Career information — your CV, employment and training history, specialty and grade, qualifications, publications and interview details.
- Professional registration & eligibility — GMC, AHPRA or MCNZ registration, right-to-work and immigration/visa status, references, and where relevant DBS/criminal-record and fitness-to-practise information.
- Preferences — the roles, locations, salary and relocation options you are interested in.
- Correspondence — records of our communications with you.
If you are a client or employer contact
- Your name, job title, employer, and business contact details, and records of our dealings with you (including vacancies and terms of business).
If you are a referee or emergency contact
- Your name, contact details, and the reference or information a candidate has asked you to provide.
If you visit our website
- Any details you submit through our forms, and limited technical data (such as IP address and pages viewed) collected through cookies — see section 11.
03Where we get your information
We collect information:
- Directly from you — when you upload a CV, register with us, apply for a role, or contact us.
- From third parties — job boards and CV databases, professional networking sites (such as LinkedIn), referrals, your referees, and background-check or right-to-work providers.
- From public sources — publicly available professional registers, such as the GMC register.
04How and why we use your information
We only use your personal information where the law allows us to. The table below sets out what we do and our “lawful basis” for it under the UK GDPR.
| What we do | Our lawful basis |
|---|
| Register you as a candidate and assess your suitability for roles | Our legitimate interests in running a recruitment business; and, where we have an agreement with you, performance of a contract |
| Contact you about relevant vacancies and career opportunities | Our legitimate interests; or your consent where required |
| Submit your details and CV to prospective employers, with your agreement | Our legitimate interests in providing recruitment services |
| Verify your identity, qualifications, professional registration and right to work; obtain references | Compliance with a legal obligation; and our legitimate interests |
| Manage our relationship with clients and fulfil our terms of business | Performance of a contract; our legitimate interests |
| Comply with legal, tax, regulatory and safeguarding obligations | Compliance with a legal obligation |
| Send marketing updates about our services | Your consent, or our legitimate interests where permitted |
| Run and improve our website | Your consent (for non-essential cookies); our legitimate interests |
Where we rely on legitimate interests, we have considered the impact on you and do not use your information in ways that override your rights. Where we rely on your consent, you can withdraw it at any time (see section 10). We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
05Health, diversity and criminal-records information
Some information we handle is treated as “special category” data (for example, information about health or diversity) or relates to criminal convictions and offences (for example, DBS checks or fitness-to-practise history). We only process this where we have both a lawful basis under Article 6 and an additional condition under Article 9 or Article 10 of the UK GDPR — most commonly:
- where processing is necessary for employment purposes and carrying out our obligations in the recruitment process;
- for reasons of substantial public interest, such as safeguarding and confirming that healthcare professionals are fit to practise; or
- with your explicit consent, where that is the appropriate basis.
We keep this information to the minimum necessary and apply extra safeguards to it.
06Who we share your information with
We share your information only where necessary, and never sell it. We may share it with:
- Prospective employers — NHS trusts, health boards, hospitals and health services in the UK, Australia and New Zealand, where you have asked us to put you forward or agreed that we can.
- Referees you have nominated.
- Verification and compliance providers — for right-to-work, DBS/criminal-record, qualification and registration checks.
- Professional and regulatory bodies where required (for example, the GMC).
- Our service providers — such as IT, CRM, email and hosting suppliers who process data on our behalf under contract.
- Authorities and advisers — where we must do so to comply with the law, or to establish, exercise or defend legal claims.
07Sending your information overseas
Because we help doctors move between the UK and Australia and New Zealand, we may transfer your personal information outside the UK — for example, to a hospital or health service where you have asked us to help you find a role.
- New Zealand is covered by UK “adequacy” regulations, which means it is treated as offering equivalent data protection.
- For countries not covered by adequacy (such as Australia), we put in place an appropriate safeguard — such as the ICO’s International Data Transfer Agreement (IDTA) — or, where relevant, rely on the transfer being necessary to perform our contract with you or to take steps at your request.
You can ask us for a copy of the safeguards we use by contacting us (see section 13).
08How long we keep your information
We keep your information only for as long as we need it:
- while we are providing services to you, and for up to two years after our last meaningful contact, so we can consider you for suitable future roles;
- longer only where we must to meet a legal, tax or regulatory obligation — for example, records relating to a completed placement may be kept for up to six years to satisfy tax and contractual requirements.
When we no longer need your information, we securely delete or anonymise it. You can ask us to delete your information sooner (see section 10).
09How we protect your information
We use appropriate technical and organisational measures to keep your information secure and to protect it against unauthorised access, loss, misuse or alteration. We limit access to those who need it, and require our service providers to do the same. No transmission over the internet can be guaranteed as completely secure, but we take reasonable steps to protect your information and to notify you and the regulator of any serious breach where the law requires.
10Your rights
Under data protection law you have the right to:
- Be informed about how we use your information (this policy).
- Access a copy of the information we hold about you.
- Rectify information that is inaccurate or incomplete.
- Erase your information (the “right to be forgotten”) in certain circumstances.
- Restrict or object to our processing in certain circumstances, including objecting to direct marketing at any time.
- Data portability — to receive certain information in a reusable format.
- Withdraw consent at any time, where we rely on your consent.
To exercise any of these rights, contact us using the details in section 13. Exercising your rights is free and we will respond within one month. We may need to verify your identity first.
11Cookies and our website
Our website uses two kinds of cookies. Strictly necessary cookies are needed for the site to function and to keep it secure; these are always active and do not require your consent. We also use Google Analytics 4, a web-analytics service provided by Google, to understand how visitors find and use the site so that we can improve it.
Google Analytics is a non-essential (analytics) cookie, so it only runs if you agree. When you first visit, we show a cookie banner and analytics stays switched off until you choose Accept. We use Google Consent Mode, which means no analytics cookies are stored and no personal identifiers are shared until you consent. If you choose Reject, or simply ignore the banner, Google Analytics is not activated.
If you accept, Google Analytics sets cookies (typically named _ga and _ga_<id>) to recognise your browser on repeat visits and to measure things such as pages viewed, links clicked, CV uploads and job applications. Your IP address is anonymised, the information is used only for our own analytics, and it is not used for advertising or sold to anyone. Google processes this data on our behalf as our data processor, and these cookies typically expire within 13 months.
You can withdraw your consent at any time by clearing this site’s cookies in your browser (the banner will then reappear on your next visit), or you can install Google’s Analytics Opt-out Browser Add-on to opt out of Google Analytics across all websites. The analytics data we hold is automatically deleted after 14 months.
12Changes to this policy
We may update this policy from time to time. When we do, we will change the “last updated” date at the top, and where the changes are significant we will take reasonable steps to bring them to your attention.
