Privacy Policy

NHS Job Application Support (“we”, “us”) provides AI tools and expert human review. We are an independent service that helps candidates apply for NHS and public-sector roles. We are not affiliated with, endorsed by, or part of the National Health Service.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the data controller for the personal data described in this policy. Our contact details are at the end.

[Registered legal entity name] (company number [Company number]). Registered address: [Registered address].

We collect and process the following categories of personal data:

• Account data: your name, email address and, if you sign in with Google, your Google profile identifier and profile image.
• Application content: the documents, CVs, application text and role details you upload or enter so we can generate and review your materials. These may contain personal data about you and, where you include it, third parties.
• Billing data: your subscription status and history. Card payments are handled by Stripe; we do not store your full card details.
• Usage and technical data: log data, device and browser information, and cookies strictly necessary for authentication and security.

• To provide the service, meaning generating drafts, repositioning applications and delivering expert review (lawful basis: performance of our contract with you).
• To take payment and manage your subscription (contract).
• To secure the service, prevent misuse and keep records (legitimate interests).
• To respond to enquiries and provide support (legitimate interests / contract).
• To send service and, where you have opted in, marketing messages (consent, which you can withdraw at any time).

To generate and structure your drafts, the text of your application content is sent to and processed by third-party AI providers acting as our processors. Depending on the tool and configuration, these may include Anthropic, OpenAI and Alibaba Cloud (Qwen/DashScope).

We instruct these providers to process your content only to return results to us. We do not use your content to train our own models. You should avoid including data you would not want processed in this way, and you can ask us about the current provider used for any tool.

We share personal data with the service providers (processors) that make the service work:

• AI providers (as above): to generate your drafts.
• Stripe: payment processing and subscription management.
• Cloudflare R2: secure storage of uploaded files.
• Our database and hosting providers: to run the application.
• Resend: to send transactional emails.
• Google: where you choose to sign in with Google.

We do not sell your personal data.

Some of our providers process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. [Confirm the specific mechanisms with each provider.]

We keep your account and application content for as long as your account is active and as needed to provide the service. You can ask us to delete your account and associated documents at any time; we will do so unless we are required to retain certain records (for example, billing records for tax purposes). [Confirm your specific retention periods.]

Under UK data protection law you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. Where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, contact us using the details below. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls and reputable infrastructure providers. No system is perfectly secure, but we work to protect your data and to notify you and the regulator of any breach where required.

The service is intended for adults (18+) applying for work and is not directed at children.

We may update this policy from time to time. Material changes will be notified through the service or by email, and the “last updated” date above will change.

Questions or requests about your data: hello@yourdomain.co.uk. Postal address: [Postal address]. Data protection contact: [Data protection contact name, if applicable].