NHS Jobs Terms and Conditions
By proceeding to access this Service you agree to be bound by these Terms and Conditions.
You must abide by this policy at all times. Failure to adhere to this policy will be deemed a breach of service and may lead to your NHS Jobs access being suspended or permanently withdrawn.
This Terms and Conditions document, and any disputes or claims arising out of or in connection with it, are governed by and construed in accordance with the laws of England and Wales.
1 Introduction
1.1 The NHS Jobs Team manages NHS Jobs on behalf of NHS Business Services Authority (NHSBSA).
1.2 This policy outlines the principles that govern use of the NHS Jobs Service.
2 Definitions
"Applicant"
An individual jobseeker searching or applying for a vacancy.
"British Overseas Territories"
The inhabited British Overseas Territories which have constitutional and historic links with the United Kingdom. Each territory has its own Constitution, its own Government and its own local laws. The territories are: Anguilla; Bermuda; British Virgin Islands; Cayman Islands; Falkland Islands; Gibraltar; Montserrat; Pitcairn, Henderson, Ducie and Oeno Islands; St Helena, Ascension and Tristan da Cunha; Turks and Caicos Islands.
"Crown Dependencies"
The three island territories within the British Isles (Isle of Man and Bailiwicks of Jersey and Guernsey). Crown Dependencies are not part of the United Kingdom, but are self-governing possessions of the British Crown.
"Data Controller"
Has the meaning given in Data Protection Legislation and has the meaning given in Article 26 UK GDPR.
"Data Processor"
Has the meaning given in Data Protection Legislation and "Processed", and "Processing" shall be construed accordingly.
"Devolved Authority"
Territories with delegated powers from central government enabling own legislation relevant to their territory (Wales, Scotland and Northern Ireland).
"Offline"
Activity that is completed outside of either the NHS Jobs system, your own applicant tracking system or a third-party applicant tracking system i.e. candidate progress being tracked by a spreadsheet or another manual process.
"Online"
Activity recorded in an online solution such as internal applicant tracking system or third-party applicant tracking system.
"Organisation"
An organised group of people with a particular purpose, such as a business or government department.
"Recruiting Organisation"
The employing organisation requiring a vacancy to be filled.
"Service"
The NHS Jobs recruitment platform and helpdesk services.
"Super User"
A user with administration rights for the recruiting organisation and the responsibility for first line query resolution.
"Third Party"
A person, or group, involved in the process besides the two predominant parties. Third party often refers to suppliers.
"You and Your"
Refers to your Organisations as a user of the NHS Jobs service.
3 Use of NHS Jobs
3.1 Organisations based in England, which meet the criteria set out in section 3.4, are permitted to use the NHS Jobs service without charge, as the service is centrally funded.
3.2 Crown dependencies, devolved authorities and British Overseas Territories are permitted to use the NHS Jobs service, subject to a relevant commercial agreement, providing they meet the criteria in clauses 3.4.
3.3 If you are not a Crown Dependency, you are permitted to use the NHS Jobs service if you are providing or supporting the provision of a health care service within the United Kingdom which is commissioned or funded by NHS England, Department of Health and Social Care, Welsh Assembly Government, Local Authority or any other body forming part of the NHS in the United Kingdom.
3.4 The following organisations are examples of those that are permitted to use the NHS Jobs service (please note, the following list is not exhaustive):
3.4.1 GP practice
3.4.2 NHS Trust
3.4.3 Integrated Care Board (ICB)
3.4.4 Commissioning Support Unit (CSU)
3.4.5 Department of Health and Social Care
3.4.6 Executive agency of the Department of Health and Social Care (i.e. an Arm's Length Body)
3.4.7 Health Boards in Wales
3.4.8 Integrated Care Systems (ICS)
3.4.9 Primary Care Networks (PCNs)
3.4.10 The following organisations may only use the NHS Jobs service for roles commissioned for support or provision of health or social care services in the United Kingdom (in line with 3.3):
3.4.10.1 Local Council
3.4.10.2 Social care provider
3.4.10.3 Charity or social enterprise
3.4.10.4 Private company
3.4.10.5 Dental Practice
3.4.10.6 Hospice
3.4.10.7 Law Enforcement & Military
3.4.10.8 Pharmacy
3.4.10.9 Cancer services
3.4.10.10 Higher education Institute
3.4.10.11 An organisation subcontracted by a local council
3.5 Additional requests to use the NHS Jobs service will be considered, by the NHS Jobs Team, and access will be granted, where appropriate. The following will be taken into account when considering requests (please note, the list is not exhaustive):
3.5.1 Impact to NHS health and social care services
3.5.2 Applicant and recruiting organisation experience
3.5.3 Cost to the public
3.5.4 Eliminating potential for financial gain
3.5.5 Potential loss of data or reporting capability
3.6 You are responsible for ensuring that you comply with all relevant legislation and must not publish any material that is in violation of any law or regulation that is enforceable in the United Kingdom.
3.7 You must not place illegal, inappropriate, or offensive material on NHS Jobs. This includes material for internal use as well as material intended for external publication.
3.8 You must not use NHS Jobs in any way that is unlawful, illegal, or detrimental to the NHS Jobs service, organisations using NHS Jobs, NHSBSA, Job seekers or the Department of Health and Social Care.
3.9 You are responsible for the accuracy of any information you present through NHS Jobs.
3.10 You may use a third-party applicant tracking system that integrates with NHS Jobs (listed here) to publish to and receive applications from the service.
3.10.1 If you wish to integrate with a third-party applicant tracking system, you need to provide NHS Jobs details of the third-party organisation to enable integration procedures.
3.10.2 If you use a third-party tracking applicant tracking system, it is your responsibility to manage recruitment activity across both systems.
3.10.3 If you cease to use third party tracking system services, you must notify NHS Jobs of this.
3.10.4 NHS Jobs retain the right to refuse or revoke integration with a third-party system if no longer in use or deemed unsuitable.
3.11 You must not publish material that infringes or breaches any third party's intellectual property rights (which shall include, but not be limited to copyright, trademarks, design rights, trade secrets, patents, moral rights, paternity rights and performance rights) - this includes the use, distribution and/or copying of any material without the express consent of the owner.
3.12 You must not place any material on NHS Jobs containing viruses or other malicious software or any tools designed to compromise the security of users, websites, and/or systems.
3.13 Any advertisements on the Service must relate to live roles which are based in the United Kingdom, Crown Dependencies, or British Overseas Territories, and have not been filled prior to advertisement.
3.14 You may not place adverts on NHS Jobs which discourage candidates to apply via an application route directed by NHS Jobs. For example, it is not permissible to include text within the advertisement which instructs job seekers to apply via another website. It is permissible to make paper applications available for candidates that are unable to submit an online application.
3.14.1 Requests to deter from an application method, directed by the NHS Jobs service may be granted, where appropriate. The following will be taken into account when considering requests (please note, the list is not exhaustive):
3.14.1.1 Impact to NHS health and social care services
3.14.1.2 Applicant and recruiting organisation experience
3.14.1.3 Cost to the public
3.14.1.4 Eliminating potential for financial gain
3.14.1.5 Potential loss of data or reporting capability
3.15 You must ensure that your use of the service promotes fair and open competition and that equal opportunities for all job seekers is practiced at all times.
3.16 You must not sell access to NHS Jobs to any other organisation or user.
3.17 The NHS Jobs Team do not check or approve advertisements placed on NHS Jobs but reserve the right to remove, without notice, any identified advertisement which breaches legislative requirements, generates complaints from job seekers, appears misleading or inappropriate or in breach of the terms of this policy.
4 Management of user access
4.1 You must designate a minimum of one Super User for your organisation and recommend additional super users for back up and mitigate single point of failure.
4.2 The number of Super Users is limited to 7 per organisation.
4.3 Your Super Users are responsible for:
4.3.1 Managing and maintaining user access within your organisation, including setting up user accounts and access rights;
4.3.2 ensuring that user accounts are employees of your organisation or of a shared service that are managing recruitment on your behalf;
4.3.3 ensuring that user accounts are set up using your organisation's email domain address or the domain address of a shared service, managing recruitment on your behalf. For security reasons personal email addresses are not permitted;
4.3.4 ensuring that the user accounts are reviewed and, where necessary, deactivated on an annual basis;
4.3.5 ensuring that users within your organisations are adequately trained;
4.3.6 providing first line support to your organisation's users.
4.3.7 organising and co-ordinating Super User and housekeeping activities within your organisation.
4.3.8 cascade any messages sent by the NHS Jobs Service.
4.4 You must ensure that users are aware of how to contact the Super Users for first line support.
5 Enforcement of the policy
5.1 The NHS Jobs Team reserve the right to investigate any suspected violation of this policy, and you are obliged to assist in any investigation undertaken.
5.2 If the NHS Jobs Team determines, at its sole discretion, that you or any third-party organisation have failed to adhere to these terms and conditions, the action taken by the NHS Jobs Team include, but are not restricted to:
5.2.1 Contacting you to request compliance with this these terms and conditions;
5.2.2 Removal of any material, including but not limited to open job adverts, which breach this policy (with or without notice);
5.2.3 Restriction or suspension of your access to parts of the service (with or without notice);
5.2.4 Suspension or termination of your account (with or without notice);
5.3 If you gain access to the service by providing false data during the sign-up process your account will immediately be suspended.
6 Restricted Access Vacancies
6.1 Candidates who are provided with accounts allowing them to view restricted vacancies must have been officially informed of the reasons for this prior to being granted such access.
7 Data Retention
7.1 Data is retained, on NHS Jobs, for a maximum of 460 days from the closing date of the recruitment. This will allow you to revisit vacancy and application data should the vacancy need re-advertising, or applications require reviewing e.g. successful applicant declines offer or pre-employment checks.
7.2 It is your responsibility to ensure that any data required after 460 days is held locally, off the Service, and that applicants are aware of your data retention policies.
7.3 An up-to-date privacy policy for your organisation must be in place and a link (URL) provided to NHS Jobs at the point of service onboarding. NHS Jobs will ensure this is displayed on each job advert for your organisation. It is the responsibility of the organisation to keep privacy notices up to date and make NHS Jobs aware of any changes required.
7.4 The NHSBSA may share anonymised application information, content, and outcomes with DHSC, its agencies and partner organisations and NHS Confederation organisations where it is needed to carry out official duties, such as, but not limited to: workforce planning; NHS policy development; and production of official statistics.
8 Data Protection
8.1 ("Data Protection Legislation") is defined as the Data Protection Act 2018 (DPA), the UK General Data Protection Regulation (UK GDPR), the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and all applicable laws and regulations relating to processing of personal data and privacy, including where applicable the guidance and codes of practice issued by the Information Commissioner.
8.2 DHSC is the overall data controller for the NHS Jobs service. The roles and responsibilities of DHSC, NHSBSA and your organisation are listed in Appendix 1.
8.3 Under Directions from DHSC, NHSBSA is the Controller of any information, entered into NHS Jobs, prior to an application being submitted to the recruiting organisation i.e. candidate profile and saved searches etc. As the recruiting organisation, you are the Controller of the applicant data once you start to process it whether in NHS Jobs or another system of your choosing. The roles and responsibilities of DHSC, NHSBSA and your organisation are listed in Appendix 1.
8.4 You are responsible for informing applicants of how you are processing their data in line with the roles and responsibilities set out in Appendix 1.
9 Freedom of Information (FOI)
9.1 NHSBSA is responsible for answering FOI Requests about vacancy information and aggregated recruitment outcomes that do not identify a specific organisation unless a commercial agreement states otherwise.
9.2 You are responsible for all requests related to your recruitment process, application progression and outcomes for your organisation. Where this information is held on NHS Jobs, it is held by NHSBSA, on your behalf, for the purposes of freedom of information legislation.
10 Intellectual Property and Permitted Use
10.1 NHSBSA is the owner or licensee of all intellectual property rights in NHS Jobs and the material published on it. Those works are protected by copyright laws and treaties worldwide. All such rights are reserved.
10.2 Most of the content on the NHS Jobs website is published under the Open Government Licence (OGL) for public sector information. This means you may use and re-use the information featured on this website free of charge, in any format or medium, as long as you follow the licence's conditions.
10.2.1 If you do use our content; you must reference where you copied it from by using links to this website.
10.3 External recruitment platforms may take a feed of live vacancies, displayed on NHS Jobs, and advertise them on their own platforms.
11 Liability
11.1 Subject to 11.3, the NHSBSA shall not be liable to you for any loss (including but not limited to direct loss, indirect loss, consequential loss, loss of use, loss of profits, loss of business, loss of contracts, loss of revenues or loss of anticipated savings), arising from your use of the Service and/or the actions or omissions of NHSBSA in relation to the provision of the Service.
11.2 You shall indemnify NHSBSA against any claims, liability, costs, loss, expenses, or proceedings whatsoever arising out of or in connection with advertisements published or other acts or omissions of yourselves, including but not limited to any breach of these terms and conditions by you or on your behalf.
11.3 Neither party seeks to exclude or limit its liability to the other party in respect of:
11.3.1 Death or personal injury resulting from negligence;
11.3.2 Fraud or fraudulent misrepresentation; or
11.3.3 Any other circumstances where liability may not be excluded or limited under any applicable law.
12 Notification of Changes
12.1 The NHSBSA may change this policy to include changes in the law or in the acceptable use of NHS Jobs and reserves the right to make such changes without notice and whenever required.
Appendix 1 - Roles and responsibilities
The Parties agree that they have the following roles, as defined by Data Protection legislation, in providing and receiving the Services: -
| Party | Role(s) |
|---|---|
| Department of Health and Social Care (DHSC) | Controller (See Paragraph 8.2 of NHS Job terms & Conditions) |
| NHSBSA NHS Jobs | Controller (See Paragraph 8.3 and 8.4 of NHS Job terms & Conditions) |
| Your Organisation | Controller (See Paragraph 8.3 and 8.4 of NHS Job terms & Conditions) |
The parties have the responsibilities detailed in the table below to comply with the UK GDPR Article 26 transparency requirement: -
| Responsibility | Details |
|---|---|
| Determine the legal basis of processing (UK GDPR Article 6) |
NHSBSA NHS Jobs: UK GDPR Article 6(1)(c) necessary for compliance with legal obligations and Data Protection Act (DPA) 2018 section 10 and the Applied UK GDPR Article 9(2)(g) as inserted by DPA 2018 Schedule 6 paragraph 12(c) "processing is necessary for reasons of substantial public interest and is authorised by domestic law." NHSBSA is acting under instructions from the Department of Health and Social Care to process aggregate NHS Jobs management information. Recruiting Organisation: The NHSBSA understands that the recruiting organisation has the following legal basis: UK GDPR Article 6(1)(a) consent 6(1)(e) public interest, and 9(2) occupational health purposes. UK GDPR Article 6(1)(b) necessary in order to take steps at the request of the data subject prior to entering into a contract. UK GDPR Article 9(2)(b) and DPA 2018 Section 10(1)(a) necessary for UK employment and social security and social protection law. |
| Document the subject matter of the Processing (UK GDPR Article 30 (b)) |
NHSBSA will manage the contract and service delivery of NHS Jobs. The recruiting organisations will maintain recruitment records relating to their own recruitment drives and successful applicants. |
| Document the duration of the Processing (UK GDPR Article 30 (f)) |
NHSBSA will process aggregate data as detailed in the NHS Jobs Privacy Policy The recruiting organisation will determine their own duration and retention in line with their own policies and procedures. |
| Document the nature and purpose of the Processing (UK GDPR Article 30 (b)) | The parties will administer and maintain vacancy and applicant records for managing recruitment, reporting, workforce insight and workforce planning purposes. |
| Document the type of Personal Data (UK GDPR Article 30 (c)) |
|
| Document the categories of Data Subjects (UK GDPR Article 30 (c)) |
|
|
Responding to Data Subject Rights Requests: Right of Access (UK GDPR Article 15) Right to Rectification (UK GDPR Article 16) Right to Erasure (UK GDPR Article 17) |
NHSBSA will action these rights for the requests it receives based on the personal data it holds for NHS recruiting organisations that:
The recruiting organisation will action these rights for the requests it receives as Controller of the personal data within NHS Jobs or their systems. |
| Providing Privacy Notices to Data Subjects (UK GDPR Articles 13 - 14) |
NHSBSA has provided a privacy notice which is also accessible through the NHS Jobs website. The recruiting organisation will provide NHSBSA an up-to-date privacy policy URL to be displayed in service by NHS Jobs which will make their applicants aware of the processing they undertake. |
| Handling Personal Data Breaches (UK GDPR Articles 33 - 34) |
If the NHSBSA becomes aware of a breach in NHS Jobs, then NHSBSA will advise the recruiting organisation. The recruiting organisation will handle personal data breaches relating to the relevant applicant data they hold. |
| Data Subjects right to compensation and liability (UK GDPR Article 82) | The recruiting organisation will be liable for any compensation claims unless the cause is a result of the acts or omissions of the NHSBSA. |
| Contact point for Data Subjects (UK GDPR Article 38) | The Data Protection Officer of the recruiting organisation. |
3. The Parties agree to update and maintain their responsibilities as necessary during the Term to reflect any changes in the arrangement. The responsibilities as stated above shall form part of this agreement. The essence of the arrangement shall be made available to the Data Subject. The Parties acknowledge that irrespective of the terms of the arrangement set out in Schedule 3, the Data Subject may exercise his or her rights under the UK GDPR in respect of and against each of the parties.