Patchwork Privacy Policy

In order to provide our services to you, Patchwork needs to process your personal data. This notice explains what personal data we process, our purposes for processing, and how to contact us in order to exercise your rights relating to data use and protection.

Statement

This notice is issued by LocumTap Ltd, trading as Patchwork Health, and applies to the Patchwork Group of Companies ("Patchwork", "we", "us", "our"). The relevant Group Company acts as a data controller for personal data processed through our services. This privacy notice explains how and why we use the personal information we collect about you, whether that is when you use this website, join an online event or engage with us on behalf of a customer organisation or as a clinician in order to use our products or services. It contains information about who we are, our role as data controller, and how and why we collect, store, use, and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.

Our website and other services are not intended for use by children, and we do not knowingly collect or use personal data relating to children.

What information do we process about you?

The personal data we process about you depends on how and why you engage with us.

Website User (including attendance at online events such as webinars)

We may collect and use the following data about you:

• Identity Data – full name, title, date of birth.
• Contact Data – address, email address, and telephone number(s).
• Technical Data – IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform.
• Profile Data – your username and password, your interests and preferences.
• Usage Data – data about how you use our website, products and services, including feedback and survey responses.
• Marketing and Communications Data – your preferences in receiving marketing from us and your communication preferences.

We need this personal data to provide you with products and services. If you do not provide the personal data we ask for, it may delay or prevent us from providing products and services to you. Our lawful basis for processing your personal data via our website will be either that you have provided your consent, the processing is necessary for the performance of a contract, or the processing is necessary for the purpose of a legitimate interest pursued by ourselves or a third party.

We do not routinely collect and process special categories of personal data (race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, genetic and biometric data), nor do we collect any information about criminal convictions and offences through our website. Where we do need to process special category data, we make sure we have a lawful basis for doing so, for example your explicit consent, or where necessary to protect vital interests or to establish, exercise or defend legal claims.

We may also collect, use, and share Aggregated Data, for example to analyse website usage. Aggregated Data may be derived from your personal data but is not considered to be personal data because it does not include information that can directly or indirectly identify you.

No automated decision-making, including profiling, takes place when you use our website.

Application & Product Services User

We may collect and use the following data about you:

• Identity Data – full name, title, date of birth, gender, curriculum vitae, training certifications and documents, National Insurance number.
• Employment Data – right to work information and confirmation, job title, department name, manager's name, shift start and end times, shift grade, date of shifts completed.
• Contact Data – address, personal and work email address, personal and work telephone number.
• Financial Data – shift rate.
• Transaction Data – details about shifts worked, time booked, application usage.
• Technical Data – IP address, login data, browser type and version, time zone setting and location, operating system and platform technologies.
• Profile Data – username and password, interests and preferences, department cost centre.
• Usage Data – data about how you use our applications, products and services, including feedback and survey responses.
• Marketing and Communications Data – your preferences in receiving marketing from us and your communication preferences.

We need this personal data to provide you with products and services, including to register you on a service. Where we need to process special category data, we make sure we have a lawful basis, for example your explicit consent, where necessary for carrying out obligations in the field of employment, to protect vital interests, or to establish, exercise or defend legal claims.

We may use automated systems to match users with suitable shift opportunities based on their profile, qualifications, and preferences. This automated matching is necessary for us to provide our workforce management services.

How do we collect information about you?

We collect information about you directly, such as when you access our website, register on services, use our services, or contact us. This may include asking you to provide training certificates, identity confirmation, right to work etc., so that we can register you to your selected organisation.

We also collect information when you voluntarily complete customer surveys, submit enquiries, or provide feedback, and we collect website and services usage information automatically using cookies and other similar technologies where you have consented to their use.

We may also receive personal data about you from various third parties and public sources.

How will we use the information about you?

We process your information to provide a product or service to you. Our purposes for processing your data include:

• To register you on a service, and to provide our services to our customers;
• To process work bookings and shifts;
• To manage your account, including to notify you about changes to our products and services;
• When you leave a review or participate in a survey, and for trouble shooting;
• Data analytics to improve our website, customer relationships, and experiences, and make recommendations about products and services which may be of interest; and
• To send you marketing materials, and to measure and understand the effectiveness of the marketing and information we send to you.

Who do we share your personal data with?

We routinely share personal data with third parties we use to help provide our products and services, for example:

• Our partner organisations (e.g., various NHS Trusts);
• Our partners for customer support requests and communications (e.g., Intercom and Vonage);
• Our partners for data visualisation (e.g., Amazon QuickSight);
• Other appointed external parties, including third party technical service providers, hosting providers, IT companies, and communications agencies, as necessary, as data processors (an up-to-date list of suppliers and third parties may be requested from Patchwork); and
• Group Companies – we share personal data with other companies in the Patchwork Group for internal administration, shared services, and business operations, on the basis of legitimate interests and appropriate safeguards through our intra-group data-sharing arrangements.

We may occasionally share your data with other third parties, but only where you have consented, or where we have another lawful basis. We will also put your privacy first and only share the minimal amount of data necessary and ensure we have appropriate agreements and measures in place to protect your data. We may disclose your personal data to law enforcement agencies and regulatory bodies where we need to do so according to the law or regulations.

We may also need to share some personal data with other parties, such as potential buyers of some or all of our business and services or during a restructuring. Usually, data will be anonymised, but this may not always be possible; the recipient of the data will be bound by confidentiality obligations.

International Data Transfers

Some of our third-party service providers are located outside of the United Kingdom. Patchwork will neither transfer, process, or permit personal data to be transferred or processed outside the United Kingdom without the conditions provided by all relevant data protection legislation being met — for example where the destination territory has an adequacy decision issued by the UK's Information Commissioner, or where the transfer is made under the International Data Transfer Agreement, approved binding corporate rules, or one of the exceptions set out in relevant data protection legislation.

How long will your data be kept?

We will not keep your personal data for longer than we need to for the purposes set out in this notice. Different retention periods apply for different types of personal data, which Patchwork determines independently based on our legal obligations and business needs, whilst always considering how to minimise our use of personal data. We will either delete or anonymise your data once it is no longer necessary for the purposes for which it was collected.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and the applicable legal requirements. You can request further details of our retention periods by contacting us.

Your rights

You have the following rights, which you can exercise without prejudice at any time, and free of charge:

For further information about any of the rights set out above please contact us, or see the guidance provided by the UK Information Commissioner's Office (ICO) on individuals' rights. If you would like to exercise any of your rights, please email, call, or write to us, provide us with enough information to identify you (e.g. your full name, address, organisation name, GMC number), let us have proof of your identity if requested, and let us know which data your request relates to.

You will not have to pay a fee to exercise your rights, though we may charge a reasonable fee — or refuse to comply — if your request is clearly unfounded, repetitive, or excessive. We have a statutory obligation to respond to all legitimate individual rights requests within one month of receipt; occasionally it could take up to three months for particularly complex or numerous requests, in which case we will notify and keep you updated.

Security

We are committed to ensuring that your information is secure and have suitable physical, organisational, and technical measures to protect your data against accidental loss or unlawful usage or access. We also have procedures in place to deal with any suspected data security breach, and will notify you and any applicable regulator where we are legally required to do so.

Marketing

We would like to send you information about services of ours which may be of interest to you. We will only send you marketing communications if you have consented to receive them, or where we have a legitimate interest for marketing in the healthcare sector — for communications to healthcare professionals and NHS organisations, we rely on our legitimate interests to send relevant marketing material. You always have the right to opt out of receiving further promotional communications, and may opt out at a later date by contacting us at help@patchwork.health or using the unsubscribe function within the footer of any marketing or sales email.

You may revoke your consent for processing under the lawful basis of consent at any time, though we may have certain legal obligations to retain your data after you withdraw consent. Communications relating to your purchase of products and services, or responding to queries you have raised, are service communications and are not considered marketing.

Cookies

Cookies are text files placed on your device when you use our website, applications or other services, to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity, as well as for targeted advertising purposes.

Among the types of personal data that Patchwork's applications collect, by themselves or through third parties, are: cookies, usage data, first name, last name, phone number, company name, profession, country, email address, field of activity, device information, and data communicated while using the service.

Unless otherwise specified, all data requested by Patchwork applications is mandatory, and failure to provide this data may make it impossible for us to provide our services. Where it is specifically stated that some data is not mandatory, users are free not to communicate this data without consequence for the availability or functioning of the service.

If you click on a hyperlink from within any of Patchwork's applications to any third-party websites, you may be sent cookies from those third-party websites. Third-party websites have their own privacy and cookie policies which Patchwork cannot control — please check them directly for more information.

Our websites or applications may contain links to other websites. We do not control these third-party websites and are not responsible for their privacy statements. This privacy notice only applies to Patchwork's website and Patchwork applications.

Changes to our Privacy Notice

We keep our privacy notice under regular review, and we will place any updates on this web page. This was last updated on 25 November 2025.

How to complain

Please contact us if you have any queries or concerns about our use of your data — we hope we will be able to resolve any issues you may have. You also have the right to lodge a complaint with the Information Commissioner or any relevant data protection supervisory authority, via their website (ico.org.uk/make-a-complaint) or by telephone on 0303 123 1113.