Privacy policy

1. Important information and who we are

Purpose of this privacy notice

This privacy notice explains how Skillstream Limited ("Skillstream", "we", "us", "our"), operator of the Bluelights platform, collects and processes personal data relating to individuals who provide services to NHS Ambulance Trusts via private ambulance providers.

Our platform is not intended for children and we do not knowingly collect data relating to children.

Controller

Skillstream Limited is the controller and responsible for your personal data in respect of the processing described in this notice, save where this notice states that another organisation acts as controller.

Contact details

Full name of legal entity: Skillstream Limited

Name or title of data privacy manager: George Lewis

Email address: [email protected]

Postal address: Data Privacy Manager, Skillstream Limited, Unit 3 La Gare, 51 Surrey Row, London, SE1 0BZ

Telephone number: 0204 522 9290

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes.

2. The data we collect about you

Personal data means any information about an individual from which that person can be identified. We collect, use, store and transfer the following categories of personal data about you:

• Identity Data — your first name and last name.
• Grade and Provider Data — your skill grade (for example Paramedic or ECA) and your employing private ambulance provider.
• Compliance Data — compliance and vetting records relevant to your grade, and their expiry dates (for example training or certification records, and, where required by the relevant NHS Ambulance Trust, criminal record check status such as a DBS check). This is used solely to determine your eligibility for allocation to shifts requiring that check.
• Shift and Allocation Data — shift records you are allocated to, including date, time, seat and location. Location here is a property of the shift itself (i.e. where it is based or operates) and is not a record of your personal location or movements.
• Timesheet Data — shift start and end times as recorded through our platform and as derived from the relevant Trust's Computer Aided Dispatch (CAD) data, and the comparison between the two, used to generate accurate timesheets.
• Technical Data — session and login data collected via cookies, used to keep you logged in during a valid session and allow you to navigate the platform without repeated logins.
• Usage Data — information about how you use our platform, which we use to produce aggregate, non-identifying reporting for Trusts and providers (for example on shift fulfilment or compliance trends). This is not used to build any profile of you as an individual.

We do not collect Financial Data about you, and we do not use your personal data for marketing, advertising, profiling or analytics directed at you as an individual.

We do not collect Special Categories of Personal Data about you (such as data concerning race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, or genetic or biometric data), and we do not otherwise process health data about you. Where relevant to your grade, we process information relating to criminal record checks as described under Compliance Data above; this is subject to the specific safeguards that apply to that category of data under UK data protection law, and is used only for the purpose described.

If you fail to provide personal data

Where we need certain personal data to perform our contract with you or your provider, or as required by the Trust, and you do not provide it, we may not be able to allocate you to shifts. We will notify you if this is the case.

3. How is your personal data collected?

We collect data from and about you through:

Direct interactions

You may give us your Identity, Grade and Provider, and Compliance Data by filling in forms, uploading compliance documents, or corresponding with us, including when you:

• apply to provide services via a private ambulance provider;
• create an account on our platform;
• provide compliance or vetting documentation required for shift eligibility.

Automated technologies or interactions

As you interact with our platform, we automatically collect Technical Data using cookies and similar technologies to ensure that, once logged in, you remain logged in for a valid session and can navigate the platform without re-logging in for each page.

Third parties

We may receive personal data about you from:

• Analytics providers such as Google, in relation to Technical Data, based outside the UK/EEA;
• The relevant NHS Ambulance Trust, who provide shift and Computer Aided Dispatch (CAD) data used to create shifts for allocation and to calculate accurate timesheets;
• Totalmobile Limited (provider of the GRS workforce management platform used by NHS Ambulance Trusts), based in the United Kingdom, with whom we exchange Identity, Grade and Provider, and Shift and Allocation Data as part of our shift allocation interface with the Trusts. Compliance Data is not shared with Totalmobile.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, this will be:

• Where necessary to perform our contract with you or your provider;
• Where necessary to comply with a legal or regulatory obligation;
• Where necessary for our legitimate interests (limited to system security, platform administration, and aggregate, non-identifying reporting), and your interests and fundamental rights do not override those interests.

We do not use consent as a legal basis for processing your personal data, and we do not use your personal data for marketing, advertising or profiling purposes.

Purposes for which we use your personal data

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another, compatible reason. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

5. Disclosures of your personal data

We may share your personal data with the parties set out below, for the purposes set out in Section 4:

• The relevant NHS Ambulance Trust, who receive Identity, Grade and Provider, Compliance, and Shift and Allocation Data necessary to confirm shift coverage and verify compliance.
• Totalmobile Limited, who provide the GRS platform used by NHS Ambulance Trusts and process data as a processor on the Trust's instructions (Totalmobile is named as a sub-processor in the relevant Framework Agreement between Totalmobile and the Trust), as part of the interface between our systems that supports shift allocation. Compliance Data is not shared with Totalmobile.
• External Third Parties, as set out in the Glossary (service providers, professional advisers, and regulators, where required).
• Any third party to whom we may sell, transfer or merge parts of our business or assets. If this happens, the new owners may use your personal data in the same way as set out in this notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not permit our third-party service providers to use your personal data for their own purposes, and only permit them to process it for specified purposes in accordance with our instructions (or, where applicable, the Trust's instructions).

6. International transfers

We do not transfer your personal data outside the United Kingdom or European Economic Area (UK/EEA), except in the case of Technical Data processed by analytics providers such as Google, as set out in Section 3.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed, altered or disclosed in an unauthorised way. We limit access to your personal data to those employees, agents, contractors and third parties who have a business need to know, and they are subject to a duty of confidentiality and process your data only on our instructions.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.

8. Data retention

We retain your Compliance, Shift and Allocation, and Timesheet Data for as long as necessary to fulfil the purposes described in this notice, including verifying your compliance and calculating accurate timesheets, and in accordance with the retention periods agreed with the relevant NHS Ambulance Trust. In some circumstances you can ask us to delete your data: see "Request erasure" in Section 9.

9. Your legal rights

Under data protection law, you have the right to:

• Request access to your personal data (a "data subject access request").
• Request correction of personal data we hold about you.
• Request erasure of your personal data, in certain circumstances.
• Object to processing of your personal data where we rely on legitimate interests, if there is something about your situation that makes you want to object.
• Request restriction of processing of your personal data, in certain circumstances.
• Request the transfer of your personal data to you or a third party, where technically feasible.

You will not usually have to pay a fee to exercise these rights, though we may charge a reasonable fee, or refuse the request, if it is clearly unfounded, repetitive or excessive. We may need to request specific information from you to confirm your identity. We aim to respond to all legitimate requests within one month.

10. Glossary

Lawful basis

• Performance of Contract means processing your data where necessary for the performance of a contract to which you (or your provider) are party.
• Legal or regulatory obligation means processing your personal data where necessary for compliance with a legal or regulatory obligation we are subject to.
• Legitimate Interest means the interest of our business in operating the platform securely and effectively. We only rely on this basis for system security, platform administration, and aggregate, non-identifying reporting — never for marketing or for building a profile of you as an individual. You can obtain further information about how we assess our legitimate interests by contacting us.

External Third Parties

• Service providers acting as processors, based in the United Kingdom, who provide IT and system administration services.
• Professional advisers acting as processors or joint controllers (lawyers, auditors, insurers), based in the United Kingdom.
• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers, based in the United Kingdom, where required by law.
• The relevant NHS Ambulance Trust, acting as data controller, with whom we share Compliance and Shift and Allocation Data necessary to confirm shift coverage and verify compliance.
• Totalmobile Limited, provider of the GRS workforce management platform, acting as a processor based in the United Kingdom on the instruction of NHS Ambulance Trusts under a Framework Agreement, with whom we exchange data (excluding Compliance Data) to support shift allocation.