Privacy Policy

1. Introduction

Welcome to TSOR Med ("TSOR Med", "we", "our", or "us").

TSOR Med operates an online healthcare workforce marketplace that connects verified healthcare professionals with healthcare organisations across the United Kingdom.

We are committed to protecting your privacy and processing your personal data fairly, lawfully, and transparently in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR), where applicable
• Other applicable UK data protection laws

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use our website, mobile applications, and related services (collectively, the "Platform").

By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller Details

For the purposes of UK data protection legislation, the Data Controller is:

Aidstar Limited trading as TSOR Med

Registered Office: Ground Floor, 108-112 Main Road, Sundridge, Sevenoaks, England, TN14 6ES

Company Registration Number: 16026627

Email: support@tsormed.co.uk

Website: www.tsormed.co.uk

If we appoint a Data Protection Officer (DPO), their contact details will be published on our website.

3. UK GDPR Compliance

TSOR Med processes personal data in accordance with the UK GDPR and the Data Protection Act 2018.

We follow the principles of:

• Lawfulness, fairness and transparency;
• Purpose limitation;
• Data minimisation;
• Accuracy;
• Storage limitation;
• Integrity and confidentiality; and
• Accountability.

Where we process special category data, we ensure an appropriate lawful basis and additional condition under Article 9 UK GDPR.

4. Information We Collect

The information we collect depends on how you use the Platform.

Identity Information

We may collect:

• Full name;
• Previous names where relevant;
• Date of birth;
• Gender (where required);
• Photograph;
• Nationality;
• Residential address;
• Email address;
• Telephone number.

Professional Information

For healthcare professionals we may collect:

• Profession;
• Speciality;
• Qualifications;
• Employment history;
• Continuing professional development records (where provided);
• Professional memberships;
• Registration status;
• References;
• Insurance details;
• Mandatory training certificates.

Employer Information

For organisations we may collect:

• Organisation name;
• Registered address;
• Companies House number (where applicable);
• CQC registration details (where applicable);
• Authorised contact details;
• Billing information.

5. Sensitive Health and Professional Information

To verify eligibility for healthcare work, we may process special category personal data where necessary, including:

• Occupational health declarations;
• Immunisation status (where required by a Client);
• Fitness-to-work information;
• Professional conduct information;
• Disciplinary restrictions published by regulators;
• Equality monitoring information (where voluntarily provided).

We process this information only where necessary and supported by an appropriate legal basis.

6. Professional Registration Information

We may collect and verify professional registration details including, where applicable:

• GMC registration numbers;
• GPhC registration numbers;
• NMC PINs;
• HCPC registration numbers;
• GDC registration numbers;
• PSNI registration numbers;
• GOC registration numbers; and
• Other relevant regulatory identifiers.

We may periodically verify registration status directly with public registers or authorised verification providers.

7. DBS Information

Where required, we may collect information relating to:

• Basic DBS checks;
• Standard DBS checks;
• Enhanced DBS checks;
• Enhanced DBS with Barred Lists.

We process DBS information only where permitted by law and only for purposes related to healthcare compliance.

8. Right-to-Work Documentation

To comply with UK immigration legislation, we may collect:

• Passport details;
• Visa information;
• Biometric residence permits;
• Home Office share codes;
• Right-to-work verification results;
• Immigration status documentation.

This information is used solely for eligibility verification and legal compliance.

9. Payment Information

When processing payments, we may collect:

• Bank account details;
• Account holder name;
• Sort code;
• Account number;
• VAT information;
• Tax status;
• Invoice details;
• Transaction history.

Payment card details are processed by authorised payment providers and are not stored by TSOR Med unless necessary for a lawful business purpose.

10. Identity Verification

To reduce fraud and protect patient safety, we may verify your identity using:

• Government-issued identification;
• Proof of address;
• Biometric verification;
• Facial matching technology (where applicable);
• Electronic identity verification services;
• Sanctions and fraud screening.

11. Device and Usage Data

When you use the Platform, we may automatically collect technical information including:

• IP address;
• Browser type;
• Operating system;
• Device identifiers;
• Login dates and times;
• Pages visited;
• Search activity;
• Clicks and interactions;
• Error logs;
• Approximate location derived from IP address.

This information helps us maintain platform security, improve performance, and detect misuse.

12. Cookies

We use cookies and similar technologies to:

• Keep you signed in;
• Remember your preferences;
• Maintain platform security;
• Analyse website performance;
• Measure usage;
• Improve our services.

Where required by law, we will ask for your consent before placing non-essential cookies on your device.

Further information is available in our Cookie Policy.

13. Legal Basis for Processing

We process personal data under one or more of the following legal bases:

• Performance of a contract;
• Compliance with legal obligations;
• Legitimate interests, such as operating and improving the Platform, preventing fraud, and maintaining security, where those interests are not overridden by your rights;
• Consent, where required (for example, certain marketing communications or optional cookies);
• Protection of vital interests, where necessary to protect life or health.

Where we process special category data, we rely on an appropriate additional condition under Article 9 UK GDPR and, where applicable, Schedule 1 of the Data Protection Act 2018.

14. Data Sharing

We only share personal information where necessary and lawful.

Your information may be shared with:

NHS Organisations

Where relevant to a Booking, we may share professional, compliance and contact information with NHS Trusts, GP practices and other NHS bodies.

Employers and Healthcare Providers

We may share information necessary to facilitate recruitment, compliance and workforce management with verified healthcare organisations using the Platform.

Payment Providers

We may share payment-related information with regulated payment processors to facilitate transactions and detect fraud.

Verification Providers

We may share information with providers that carry out identity verification, right-to-work checks, DBS processing, fraud screening and professional registration verification.

Professional Regulators and Public Authorities

Where required by law or regulatory obligation, we may disclose information to regulators, law enforcement agencies, courts or government bodies.

We do not sell your personal information.

15. Data Retention

We retain personal data only for as long as necessary to:

• Provide the Platform;
• Comply with legal and regulatory obligations;
• Resolve disputes;
• Establish, exercise or defend legal claims;
• Meet tax and accounting requirements.

Retention periods vary depending on the type of information and applicable legal requirements. When data is no longer needed, it is securely deleted or anonymised.

16. International Transfers

Where personal data is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place, such as:

• An adequacy decision by the UK Government;
• The UK International Data Transfer Agreement (IDTA);
• The UK Addendum to the EU Standard Contractual Clauses; or
• Another lawful transfer mechanism recognised under UK data protection law.

17. Security Measures

We use appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit using TLS;
• Encryption of sensitive data at rest where appropriate;
• Role-based access controls;
• Multi-factor authentication for administrative accounts;
• Audit logging and monitoring;
• Regular vulnerability assessments and security updates;
• Staff training on information security and data protection;
• Incident response and breach management procedures.

While we take reasonable steps to protect your information, no method of transmission or storage is completely secure.

18. Your Rights

Subject to applicable law, you may have the right to:

• Access your personal data;
• Request correction of inaccurate information;
• Request deletion of personal data in certain circumstances;
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Withdraw consent where processing is based on consent;
• Request data portability where applicable;
• Object to direct marketing.

You can exercise your rights by contacting us using the details in section 20. We may ask for proof of identity before responding to a request.

19. Children's Privacy

The Platform is intended for use by adults involved in healthcare recruitment and service delivery.

We do not knowingly collect personal information directly from children under the age of 18.

If we become aware that we have collected such information without appropriate authority, we will take reasonable steps to delete it.

20. Contact and Complaints

If you have questions about this Privacy Policy or our handling of your personal data, please contact:

Privacy Team

TSOR Med

Email: privacy@tsormed.co.uk

Address: Ground Floor, 108-112 Main Road, Sundridge, Sevenoaks, England, TN14 6ES

We will aim to respond to privacy enquiries within the timeframes required by applicable law.

21. Information Commissioner's Office (ICO)

If you believe we have not handled your personal information appropriately, you have the right to lodge a complaint with the UK's supervisory authority for data protection:

Information Commissioner's Office (ICO)

Website: ico.org.uk

Telephone: 0303 123 1113

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

We encourage you to contact us first so that we have the opportunity to address your concerns before you approach the ICO.