Privacy Policy

Flame Health Associates LLP – Privacy & Data Protection (GDPR) Notice

Effective Date: [29/09/2026]

Version: 2.1

Document Reference: DP5A

1. Introduction

Flame Health Associates LLP (“Flame Health”, “we”, “us”, or “our”) is a specialist healthcare recruitment business providing recruitment and career consultancy services to candidates and clients across the UK and Ireland.

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and the Privacy and Electronic Communications Regulations. For candidates in Ireland, we also comply with the EU General Data Protection Regulation and the Irish Data Protection Acts 1988–2018.

This notice explains what personal data we collect, why we use it, who we share it with, and your rights.

2. Company Details

Company Name: Flame Health Associates LLP

Address: Bridgford Business Centre, 29 Bridgford Road, West Bridgford, Nottingham, NG2 6AU

Telephone: 0115 811 4370

Data Controller: Flame Health Associates LLP

ICO Registration Number: [Z2863914]

Data Protection Contact: [[email protected]]

3. What Personal Data We Collect

We may collect and process the following personal information about you:

• Identification details: name, address, contact information, date of birth, and right-to-work documentation.
• Employment information: CV, work history, education, professional qualifications, salary expectations, and references.
• Communications: records of emails, messages, calls and meetings with our consultants.
• Special category and criminal offence data: health data, professional registrations (e.g. GOC, HCPC, GPhC, GDC), or criminal record checks, only where relevant to specific roles.
• Digital data: information submitted via our website, job portals, or social media platforms.

4. How We Obtain Your Data

• Directly from you, via our website, registration forms, job applications, or during phone, email or message communication.
• From publicly available professional sources such as LinkedIn, CV databases, or job boards.
• From third parties such as referees, clients, or background screening providers.

Where we obtain your data from a source other than you, we will provide you with this notice within one month.

5. Purpose and Legal Basis for Processing

Legitimate interests: as a recruitment business, it is in the legitimate interests of Flame Health, our candidates and our clients to process personal data to identify suitable job opportunities, verify credentials, and ensure compliance with employment regulations. We balance these interests against your rights, and you can object at any time (see Section 9).

Special category and criminal offence data: we process this only where it is relevant to a specific role and permitted by law, for example to meet obligations connected with employment and professional regulation, or with your explicit consent.

6. Use of Technology and AI

We use an AI-enabled recruitment platform to organise records, summarise information, and suggest matches between candidates and roles. These tools support our consultants; they do not make decisions about you. A member of our team reviews every shortlisting and submission decision. Our recruitment platform provider does not use your data to train AI models.

7. Data Sharing

We may share your data with:

• Our clients, only where you have agreed to be put forward or have expressed interest in a specific opportunity.
• Background check and verification providers.
• Professional regulatory bodies, where legally required.
• Service providers acting on our behalf under data processing agreements, including Spott (recruitment platform and CRM), Dropbox Sign (electronic signatures), and our website hosting, email and IT support providers.

We do not sell or rent your data to third parties.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this notice, or as required by law.

• Under the Conduct of Employment Agencies and Employment Businesses Regulations 2003, we keep work-seeker records for at least one year from the date of last contact or service provision.
• We retain candidate data for up to three years from our last meaningful contact with you, based on our legitimate interests, so we can tell you about relevant roles.
• Before that period ends, we will contact you to check you still wish to hear from us. If you do not, we will securely delete or anonymise your data.

9. Your Data Protection Rights

You have the following rights under data protection law:

• Right to be informed about how your data is used.
• Right of access to request a copy of your data.
• Right to rectification to correct inaccurate or incomplete data.
• Right to erasure to request deletion in certain circumstances.
• Right to restrict processing where accuracy or legality is contested.
• Right to data portability to obtain and reuse your data.
• Right to object to processing based on legitimate interests, and an absolute right to object to direct marketing.
• Right to withdraw consent at any time, where processing is based on consent.
• Rights relating to automated decision-making: we do not make decisions about you based solely on automated processing (see Section 6).

To exercise any of these rights, contact us at [[email protected]] or call 0115 811 4370. We will respond within one month.

10. International Data Transfers

Your personal data is stored and processed within the UK and the European Economic Area (EEA). Our recruitment platform is hosted in the EU, which the UK recognises as providing an adequate level of protection.

Where a provider processes data outside the UK or EEA, we ensure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

11. Data Security

We implement appropriate technical and organisational measures to safeguard personal data, including encrypted systems, access controls, and secure disposal processes, to prevent unauthorised access, alteration, or loss.

12. Complaints and Queries

If you have any questions or concerns about this notice or how we handle your data, please contact us first at [[email protected]] or on 0115 811 4370. We will acknowledge your complaint within 30 days and respond without undue delay.

If you remain dissatisfied, you can contact:

• UK: Information Commissioner’s Office (ICO), ico.org.uk/concerns, 0303 123 1113.
• Ireland: Data Protection Commission (DPC), dataprotection.ie.

13. Updates to This Notice

We may update this notice to reflect legal, technical, or operational changes. The latest version will always be available on our website.

Last Updated: [29/09/2026] (Version 2.1)