This privacy notice tells you what to expect when Conexus Healthcare CIC collects, uses and protects your personal information. It applies to all employees, casual workers, ex-employees, agency staff, self-employed contractors, secondees, apprentices, trainees, directors and non-executive board members, and other partners. The information we process about you will vary depending on your specific role and personal circumstances.
This notice should be read alongside our wider UK General Data Protection Regulation (UK GDPR) and information governance policies and procedures. It is updated periodically and we will inform you of any significant changes.
The legal frameworks governing how we use your personal data include:
As your employer or provider of other commissioned services, Conexus Healthcare needs to keep and process information about you for normal employment and contracting purposes. The information we hold and process will be used for our management and administrative purposes only. We will keep and use your data to enable us to run the business and manage our relationship with you effectively, lawfully and appropriately:
This includes using information to enable us to comply with employment or other contracts; to meet legal requirements; to pursue the legitimate interests of the organisation; and to protect our legal position in the event of legal proceedings. If you do not provide required data, we may in some circumstances be unable to comply with our obligations, and we will inform you of the implications of that decision.
The information we hold may include, but is not limited to:
Much of the information we hold will have been provided by you directly. For employment purposes, some may come from other sources, including:
Under Article 6(1) of the UK GDPR, the lawful bases we rely on for processing personal information about you are:
Where we process special categories of personal data (such as health information, racial or ethnic origin, religious beliefs, sexual orientation, trade union membership, or biometric data), we do so only where a condition under Article 9 of the UK GDPR applies, most commonly:
In limited cases we may ask for your explicit consent. Where we do, you have the right to withdraw that consent at any time; this will not affect the lawfulness of any processing that took place prior to withdrawal.
Some of our HR systems and tools may use automated processing to assist in decision-making, for example in areas such as rostering or recruitment screening. Where any such processing produces decisions that have a significant effect on you, we will ensure appropriate safeguards are in place in accordance with applicable data protection legislation, including the Data (Use and Access) Act 2025. You have the right to request human review of any such decision, to express your point of view, and to contest decisions made about you.
Other than as set out below, we will only disclose information about you to third parties if we are legally obliged to do so, or where we need to comply with our contractual duties to you. We may transfer information about you to other organisations for purposes connected with your employment or the management of the organisation’s business. These may include:
We will also share work-related information about staff in a public-facing or senior role in response to Freedom of Information or similar requests, and may have to disclose information about staff numbers and types of work undertaken. Personal details will not be shared in these circumstances.
Information relating to prospective applicants will be held on the NHS Jobs portal or via the relevant recruitment agency. Conexus Healthcare will only hold personal information on candidates who have been shortlisted and invited to interview (as well as that of the successful candidate). Any information used for monitoring purposes will be anonymised where possible.
In limited and necessary circumstances, your information may be transferred outside of the UK, or to an international organisation, to comply with our legal or contractual requirements. Where this happens, we ensure a similar degree of protection is afforded by using transfer mechanisms approved under UK data protection law, such as:
We will always inform you if your data is transferred outside of the UK, and the safeguards in place.
We are committed to protecting your privacy and will only use your information collected lawfully in accordance with the UK GDPR, the Data Protection Act 2018, and all applicable NHS guidance. Specifically, we:
Every member of staff who works for an NHS organisation, or in an NHS-commissioned organisation, has a legal obligation to keep information about patients and colleagues confidential.
We employ surveillance cameras (CCTV) on and around our sites in order to:
You have the right to make a Subject Access Request of surveillance information recorded of yourself. Requests should be directed to the IG Lead using the contact details in this notice, and you will need to provide sufficient information to identify you and help us locate the relevant images. We reserve the right to withhold information where permissible under the UK GDPR, and will only retain surveillance data for a reasonable period, or as long as is required by law.
Any records we hold will be kept in line with the NHS Records Management Code of Practice for Health and Social Care, which sets out how long different types of records are retained. Details of the specific retention periods that apply to your records are available on request using the contact details below.
Further information on records retention can be found at the NHS Records Management Code of Practice.
Under the UK GDPR and Data Protection Act 2018, you have the following rights in relation to your personal data. We will seek to deal with any request without undue delay, and in any event within one calendar month (although we may extend this period in certain complex cases, in which case we will notify you).
| Right | What this means |
|---|---|
| Right of access | You have the right to request a copy of the personal data we hold about you (a Subject Access Request). There is no charge for this. |
| Right to rectification | You have the right to request that we correct inaccurate or incomplete data we hold about you. |
| Right to erasure | In certain circumstances, you have the right to request that we delete your personal data. Note that this is not an absolute right in employment contexts. |
| Right to object | You have the right to object to processing based on legitimate interests. We will review each objection carefully. |
| Right to restrict processing | You may request that we limit the processing of your data in certain circumstances, for example while we investigate an objection. |
| Right to data portability | You have the right to receive a copy of your data in a structured, commonly used and machine-readable format. |
| Right to withdraw consent | Where processing is based on consent, you may withdraw that consent at any time. This will not affect the lawfulness of prior processing. |
| Right to human review | You have the right to request human review of any automated decision that has a significant effect on you, and to contest such decisions. |
To submit a Subject Access Request (SAR), or to exercise any of the rights set out above, please contact us in one of the following ways:
To help us locate your records efficiently, please include your full name, date of birth, home address, and a description of your request. There is no charge for accessing the information we hold about you.
Conexus Healthcare CIC is the data controller of your personal data for the purposes of the UK GDPR and the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025).
If you have any initial enquiries regarding this notice or your data, or if you require further information on the data held by Conexus, please contact the IG Lead:
For questions relating to how we process your data, or UK GDPR rules in general, please contact our Managing Director or our Data Protection Officer:
| Contact | Details |
|---|---|
| Managing Director | Steve Knight. Email: steve.knight1@nhs.net |
| Data Protection Officer | Helen Holt. Email: Helen.Holt@this.nhs.uk. Post: The Health Informatics Service, Unit 13 Ainley Industrial Estate, Ainley Bottom, Elland, HX5 9JP |
If you are unhappy with the way we have handled your personal data, you have the right to make a complaint to us. We take all data protection complaints seriously and have a clear process in place to deal with them. You can make a complaint by:
To help us deal with your complaint efficiently, please include your name and contact details, a description of your concern, and any relevant dates or reference numbers.
When we receive your complaint, we will acknowledge it within 30 days. We will then investigate your concerns, take appropriate steps to address them, and inform you of the outcome without undue delay. Raising a data protection complaint will not disadvantage you in any way in your employment or engagement with us.
If you are still unhappy following our response, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), although we would encourage you to contact us first so we have the opportunity to put things right:
We may amend this privacy notice from time to time to reflect changes in our practices or applicable law. Any updates will be published on our website and shared with staff. If you are dissatisfied with any aspect of this notice, please contact the IG Lead.
Updated June 2026
