This policy explains how MedicSupport Network ("we", "the group") handles personal data. It applies to this website and to the personal data we process as an employer and as an operator of healthcare facilities.
Who we are
The data controller is [REGISTERED COMPANY NAME — TO BE SUPPLIED], trading as MedicSupport Network. Registered in [COMPANY REGISTRATION NUMBER AND JURISDICTION — TO BE SUPPLIED], with our registered office at [REGISTERED OFFICE ADDRESS — TO BE SUPPLIED].
We are a hospital and clinic group. We employ our own clinicians and operate our own licensed facilities. We are not a recruitment agency and we do not sell or trade personal data.
What we collect, and why
Clinicians and staff
To employ someone and to place them in a clinical role we must hold their identity, qualification, registration and health-related records. This includes application and recruitment records, identity documents, professional registration numbers, verified references, qualifications, mandatory health screening, immunisation status, and the employment and placement history of our own staff.
Special category data. Health screening and occupational health records are special category data. We process them because clinical roles require fitness practitioner determinations and statutory health screening, and because patient safety depends on knowing who is fit to practise.
Secondments. Where we second one of our own clinicians to a hospital in Europe or America, the receiving employer processes their data under its own responsibility. We share only what that placement requires, and the transfer is covered by appropriate safeguards — see below.
Patients
Where we operate a facility we process patient records as the provider of the care. That is governed primarily by the healthcare law and regulator of the country the facility is in, and this policy does not override it. Patient data is governed by clinical confidentiality rules, not merely by this website policy.
Clients, partners and website visitors
We hold business contact details for employers and partners who approach us about secondment, and enquiry details for people who contact us. For website visitors we hold server logs (IP address, browser type, requested page, timestamp) for security and diagnostics.
Lawful bases
- Contract — for staff and for clients we are under contract with.
- Legal obligation — statutory record keeping, professional registration, health and safety duties, and tax and employment law in each country we operate in.
- Public interest — for the parts of health data necessary to deliver care safely and to operate a licensed facility.
- Legitimate interests — security logging and fraud prevention.
- Consent — for optional marketing, where you have asked for it.
International transfers
We operate across Africa and Asia and second staff to Europe and America. Personal data therefore moves between countries with different data protection laws. Each transfer is made under an appropriate safeguard — adequacy regulations where they apply, otherwise standard contractual clauses — supported by a transfer risk assessment and technical and organisational controls. Access is granted per placement, not by default.
How long we keep data
Employment and clinical records are retained for the period required by the employment, health and regulatory record-keeping rules of the country concerned, which is typically substantially longer than an ordinary business record. Enquiry data that does not lead to an engagement is deleted within 24 months. Server logs are retained for up to 90 days.
Your rights
Where the law that applies to you provides them, you may have the right to:
- access your personal data and receive a copy;
- correct data that is inaccurate or incomplete;
- request erasure where there is no overriding legal reason to keep it;
- restrict or object to certain processing;
- receive data you gave us in a portable format;
- complain to your local data protection authority.
We do not delete clinical or registration records on request where we are legally required to retain them, and we will explain why if that applies to your request.
Security
Access to personnel and clinical records is restricted to those who need it for their role, is individually attributable, and is logged. Credentials that appear on this site are published only where the individual has been verified for that purpose.
Contact
Data protection queries: [DATA PROTECTION CONTACT — TO BE SUPPLIED]. General enquiries: enquiries@medicsupport.network.
Changes
We will update the date at the top of this page when this policy changes. Material changes affecting how we use your data will be notified directly where we have your contact details.