LEMONAID HEALTH LIMITED

RECRUITMENT PRIVACY POLICY

Last Updated: March 17, 2023

Let's talk about privacy

This Privacy Policy sets out how Lemonaid Health Limited ("Lemonaid", "we", "us" or "our) collects and process the personal data of applicants who are interested in working for Lemonaid Health Limited (whether as an employee, consultant, contractor, worker, work experience student or other staff member) (together, "you"). If you are an employee, contractor or otherwise engaged in work for us, a separate privacy Policy applies to you instead.

Lemonaid operates the Boots Online Doctor Service (https://onlinedoctor.boots.com/). For information about how we collect and process personal data in connection with the Boots Online Doctor Service (https://onlinedoctor.boots.com/), please see our Boots Online Doctor Service Privacy Policy (https://onlinedoctor.boots.com/privacy-policy), which relates to individuals seeking healthcare services from us, suppliers, individuals who browse our website, and individuals outside our organisation with whom we interact.

At Lemonaid we value your privacy and are committed to complying with all relevant data protection laws to ensure that our patients' personal data is protected. This Privacy Policy is designed to set out how we use your personal data in a clear, concise and easy to read format.

  1. ABOUT THIS POLICY
    1. This notice relates to personal data about you from which you can be identified. We refer to this information throughout this notice as "personal data". Personal data does not include data where the identity has been removed (anonymous data). There are "special categories" of more sensitive personal data which require a higher level of protection. Section 4 of this notice sets out examples of your personal data that we use.
    2. We are the controller of your personal data. This means that we are responsible for deciding how we hold and use personal data about you during the recruitment exercise. As a controller we use (or 'process') the personal data we hold on you in accordance with this notice.
    3. We take our data protection responsibilities seriously and this notice reflects the obligations set out in the United Kingdom's ("UK") retained EU law version of the General Data Protection Regulation (EU Regulation 2016/679) ("UK GDPR") and any laws in England giving effect to its provisions.
    4. This notice sets out how we collect and process your personal data. This notice also provides certain information that is legally required and lists your rights in relation to your personal data.
    5. You can contact us in connection with our processing of your personal data at privacy@lemonaid.com.
    6. Your personal data belongs to you, and it is your choice whether you provide us with your personal data. However, because we require certain items of your personal data in order to consider your application (for example, evidence of qualifications or work history), please be aware that if you do not provide all of the personal data we request from you then we may not be able to consider your application further. It is important that the personal data we hold about. you is accurate and current. Please keep us informed if your personal data changes during the course of the recruitment process.
    7. Please read this notice carefully, so that you are aware of how and why we are using your data.
    8. If you are successful in your application and commence work with us, a separate internal privacy notice will apply to the use of your personal data during your period of work.
    9. This notice may be amended or updated from time to time. Please regularly check this policy to review any changes made.
  2. PRINCIPLES OF DATA PROTECTION
    1. We will use your personal data lawfully, fairly and in a transparent way. Your personal data will be accurate and kept up to date, and kept securely and as long as permitted by applicable law.
  3. RECRUITMENT PROCESS
    1. When you apply for a specifically advertised role via our website or through one of our recruiting services, we will review and process your data via an applicant tracking system.
    2. We will then decide whether your application is strong enough to invite you for an interview or to attend an assessment. If we decide to call you for an interview or to attend an assessment, we will use the information you provide to us at the interview(s) and during any assessments to decide whether to offer you the role. If we decide to offer you the role, we will then take up references carry out a criminal record check, if applicable, before confirming your appointment.
  4. PERSONAL DATA
    1. We may obtain personal data about you, in connection with your application to work with us or in respect of an enquiry about vacancies, including but not limited to the following
      1. Personal details: name(s), title, username or similar identifier, gender, date of birth, age, nationality, languages, marital status;
      2. Contact details: home and work addresses; home, work and personal mobile telephone numbers and work and personal email addresses
      3. Information included in references;
      4. Any other information included on CVs, application forms and covering letters including qualifications, skills (job-related and technical) and level of experience, education history, details of previous employment, employment dates, salary and benefits information and professional memberships;
      5. Immigration status details including copies of your passport, biometric residence permit and other immigration documents;
      6. Other recruitment data: submissions for any assessment at interview stage and notes/results thereof, special arrangements required for interview, interview notes, notes from shortlisting exercises, assessment exercises and tests, building entry, exit records, post interview feedback; and
      7. "Information Technology Data", which includes personal data which relates to your use of our website, such as your internal protocol (IP) address, login data, traffic data, weblogs and other communication data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website.
  5. SOURCES OF PERSONAL DATA
    1. We may obtain your personal data from various sources including the following
      1. Yourself;
      2. Recruitment agencies, employment agencies and employment businesses
      3. The Disclosure and Barring Service;
      4. Statutory or other official bodies such as the Home Office including UK Visas and Immigration;
      5. Professional advisers;
      6. Past employers;
      7. Referees or other references;
      8. Analytics providers (such as Google analytics); and
      9. Public sources including social media.
    2. We will also create personal data about you, such as interview documentation or if you contact us, then we may make a written record of key details of the conversation so that we can take steps to have the relevant person respond to your query.
    3. Via automated technologies, such as cookies, server logs and other similar technologies. We may automatically collect Information Technology Data about your equipment, browsing actions and patterns by using cookies, server logs and other similar technologies. We may also receive Information Technology Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.
  6. LEGAL BASIS FOR PROCESSING
    1. To process your personal data in connection with the purposes set out in section 7 of this notice, we will rely most commonly on one or more of the following legal bases:
      1. we have a legitimate interest in carrying out the processing, which is not overridden by your interests, fundamental rights, or freedoms. When we rely on this legal basis our legitimate interests may include the following:
        1. the management of the recruitment process and employment and engagement of staff in particular making decisions about who to offer employment or engagement to and on what terms; and
        2. to enable us to take legal advice and to defend claims.
      2. the processing is necessary for compliance with a legal obligation; or
      3. the processing is necessary for the performance of a contract with us or in order to take steps at your request prior to entering into a contract.
    2. We do not need your consent if we process your data under one or more of the other legal bases set out above. In some circumstances we may approach you for your written consent to allow us to process certain data.
  7. PURPOSES OF PROCESSING
    1. We will use your personal data for:
      1. Making a decision about your recruitment or appointment;
      2. Determining the terms on which you will work for us if you are offered employment or engagement with us;
      3. Checking you are legally entitled to work in the UK;
      4. Requesting references;
      5. Communicating with you about your application and the recruitment process;
      6. Assessing your skills, qualifications and suitability for a particular job or task;
      7. Retaining details about you in case there are future employment opportunities for which you may be suited;
      8. Optimizing and/or improving our recruitment process;
      9. Dealing with legal disputes (including litigation, claims, and defence or settlement of claims) involving you, or our employees, workers and contractors, including accidents on our premises;
  8. RECIPIENTS OF PERSONAL DATA
    1. Your information will be shared internally for the purposes of the recruitment exercise. This includes, but is not limited to, members of the HR and recruitment team, interviewers involved in the recruitment process, senior staff within our business and IT staff if access to the data is necessary for the performance of their roles.
    2. We may also share your personal data with your named referees when requesting a reference;
    3. In addition, we may disclose the personal data you provide to us to our group companies and affiliates or third party data processers who may process data on our behalf to enable us to carry out our usual business practices. Any such disclosure will only be so that we can process your personal data for the purposes set out in this notice.
    4. All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions
  9. TRANSFERS OF PERSONAL DATA OVERSEAS
    1. Personal data we collect from you will be transferred, stored and/or processed outside the UK and we will transfer your personal data to the United States of America.
    2. Subject to any applicable conditions in each case, such transfers of personal data may be made on the following bases:
      1. there are appropriate standard contractual clauses between us and the recipient, and, to the extent applicable, a copy can be obtained by using the contact details set out in section 1.5; or
      2. there is an adequacy decision, that the relevant country to which the personal data is transferred ensures an adequate level of protection;
      3. where the transfer is necessary for:
        1. the establishment, exercise or defence of legal claims;
        2. to protect your vital interests (or someone else's interests) and you are not capable of giving your consent,
        3. the performance of your employment contract or any other contract with us or the implementation of pre-contractual measures taken at your request;
        4. for important reasons of public interest;
        5. the conclusion or performance of a contract concluded in your interests between us and another party; or
      4. where you have given your explicit written consent.
    3. You can request further information by contacting us as specified in section 1.5.
  10. RETENTION OF PERSONAL DATA
    1. Personal data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems.
    2. We will retain personal data as permitted by applicable law.
  11. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA
    1. You may exercise your privacy rights by writing to privacy@lemonaid.com. You have a number of rights in connection with the processing of your personal data, subject to certain conditions set out in the GDPR, including the right to:
      1. Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
      2. Request the correction of the personal data that we hold about you. This enables you to have incomplete or inaccurate data we hold about you corrected.
      3. Request the erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
      4. Ask us to stop processing personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground.
      5. Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
      6. Request the transfer of your personal data to another party
    2. Lodge a complaint regarding the processing of your data with the relevant supervisory authority (which, in the UK, is the Information Commissioner's Office).
    3. In the limited circumstances where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.
    4. If you want to review, verify, correct or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact our DPO in writing in accordance with section 1.5.