Privacy policy

1. Data we collect

For professionals: name, email, profession, registration/licence number, specialisation, skills, experience, availability and expected locum rate. For employers: company details and vacancy information. For all users: authentication data (hashed passwords, session records) and platform activity (registrations, attendance, completions, applications) with an immutable audit log of administrative actions.

2. How data is used

• Computing and evidencing your APC progress from verified completions
• Matching locum vacancies to professionals of the same profession and skill category
• Course administration — registrations, QR passes, attendance and completion
• Council verification of professionals, employers, trainers and courses

3. Who can see what

Your APC record and completion history are visible to you and to council administrators. When you apply for a locum vacancy, the employer sees your name, verified profession, specialisation, skills, availability and quoted rate — after you apply. Course attendance data is visible to course organisers for the events you registered for.

4. Data protection

Passwords are stored only as bcrypt hashes. Sessions use HttpOnly, SameSite cookies. All database access uses prepared statements, state-changing forms are CSRF-protected, and administrative redirects are whitelist-validated. The platform runs over HTTPS in production.

5. Retention & your rights

Verified completion records are permanent professional records. You may request correction of inaccurate profile data via the council desk; corrections to completions are made only by admin override and are always audit-logged.