1. Who is responsible for your data?
IntoPractice.uk is operated by Adam Wright, who is the data controller responsible for personal information processed to run IntoPractice.
For privacy questions or to exercise your rights, email privacy@intopractice.uk.
2. What we collect and why
Practice accounts
We collect the work email address, practice name, address, postcode, NHS or practice registry identifiers, contact details and account status you provide. Our authentication provider also processes credentials and session information. We use this information to create and administer accounts, check practice eligibility, review listings and communicate about your account. Lawful basis: contractual necessity where applicable, and legitimate interests in operating and protecting the platform and checking who may post jobs.
Job listings and enquiries
We collect vacancy details, including any named recruitment contact, job contact email and other information a practice chooses to publish. Approved listing information is visible publicly and may be indexed by search engines. We use it to display and manage vacancies. Lawful basis: contractual necessity for account holders where applicable, and legitimate interests in providing a useful job board and helping practices recruit.
Job seekers
You can browse listings without creating an account. When you select Apply, the site opens your email application to contact the practice directly. IntoPractice does not currently receive or store CVs or application emails. The practice receiving an application is responsible for how it handles that application. We may count job views, appearances in search results and Apply clicks.
Job alert waiting list
If you sign up to be told when job alerts launch, we store your email address to contact you about that launch. The current waiting list is not a live job-matching email service. Lawful basis: consent when you request this notification. You can withdraw it by emailing us.
Security and site operation
We may process IP addresses, browser information, account activity, sign-in events and administrative audit records to secure the site, prevent abuse, investigate incidents and maintain the service. Lawful basis: legitimate interests in protecting the platform and its users, and legal obligations where applicable.
Messages you send us
If you contact us, we process your email address and the contents of your enquiry so that we can respond and keep an appropriate record. Lawful basis: legitimate interests in responding to enquiries, or contractual necessity where applicable.
3. Information that becomes public
Approved job adverts may show practice details, location, vacancy information and a recruitment contact chosen by the practice. Please avoid including personal contact information you do not have permission to publish, and never include patient information in listings.
4. Sensitive information
IntoPractice is not intended to collect patient records, health information or other special category personal data. Please do not submit these in free-text fields or support messages. If you believe such information has been submitted, contact us so we can review and remove it where appropriate.
5. Services we use
We use third-party providers to operate the site. These include:
- Supabase for the database and account authentication.
- Vercel for hosting and website analytics.
- Cloudflare for security and Turnstile bot checks.
- Resend for transactional emails.
- Upstash for rate limiting and abuse prevention.
- Postcodes.io for postcode lookup and OpenStreetMap tile services for maps. Loading a map can involve a request from your browser to the tile provider.
Approved vacancies are public. We may also disclose information where legally required or to protect the security of the service. We do not sell personal information or use third-party advertising pixels.
6. Transfers outside the UK
Some service providers may process information outside the UK. Transfers must comply with applicable UK data protection requirements, including any required adequacy arrangements or contractual safeguards. For more information about our providers and the safeguards relevant to your data, please contact us.
7. How long we keep information
We keep personal information only for as long as reasonably needed for the purpose collected, including operating accounts, displaying or administering vacancies, responding to enquiries, meeting legal obligations and resolving security issues.
- Accounts: while in use and for a reasonable period afterwards where records are needed for security, disputes or legal purposes.
- Listings: public visibility ends when a listing expires or is closed; records may remain in the practice dashboard or administrative systems until removed under our retention procedures.
- Alert waiting list: until you withdraw consent, the list is no longer needed, or we contact you about the launch.
- Security and audit records: retained as needed for investigating incidents and maintaining accountability.
You can request deletion of your personal information at any time. We will consider the request and explain any lawful reason for keeping particular records.
8. Your rights
Depending on the circumstances, you can ask to access, correct or erase your information, restrict its use, object to processing, receive certain data in a portable format, or withdraw consent where we rely on it. These rights are subject to legal conditions and exceptions.
Email privacy@intopractice.uk. We normally respond within one calendar month, subject to the applicable rules.
9. Cookies and analytics
We use sign-in and security storage, some browser preferences, and Vercel website analytics. Our Cookie Policy explains these in more detail.
10. Security
We use access controls, authentication, encrypted connections, rate limiting and other technical and organisational measures designed to protect information. No internet service can guarantee absolute security.
11. Children
The service is intended for people involved in UK general practice recruitment, not children. We do not knowingly seek personal information from children.
12. Complaints and changes
Please contact us if you have a concern about how your information is used. You can also complain to the Information Commissioner’s Office.
We may update this policy as the platform develops. We will update the date at the top when we make changes.