Last updated 26 October 2026.
The short version
- Anyone can read our rankings without giving us anything. We don’t use advertising or analytics cookies.
- If you use the site to look for work or to find staff, we may pass your details (and your CV) to any agency listed on our site, to help you. We do it ourselves, by hand: nothing goes to an agency automatically, and we never sell your details.
- Your mobile and registration number are encrypted. Your CVs sit in private storage only our server can open.
- We only read your CV with AI when you ask us to.
- You can delete your account, and everything in it, yourself, at any time.
Who we are
HealthAgencies.co.uk is a trading name of Velsta Limited, registered in England and Wales, company number 16036737, registered office Unit 9 City Mews, Ilford, Essex, IG6 2FQ, England. Velsta Limited is the data controller for the personal data described here: we decide why and how it’s used.
For anything about your data, email hello@healthagencies.co.uk. We haven’t appointed a Data Protection Officer, as the law doesn’t require one for an organisation like ours.
Everyone who visits
Security and abuse protection. Our hosting provider sees your IP address and browser details on every request and keeps short-lived logs, and its firewall and bot check tell people from automated traffic and limit how fast anyone can send requests. When you send a form or ask for a sign-in code, a bot-protection service also checks, in the background, that a person sent it: it sees your IP address and details of your browser and device, and tells us only whether the check passed. We store your email address and IP address against the attempt, so we can stop people guessing codes or flooding the site. Lawful basis: our legitimate interests in keeping the site and your account safe.
Counting visits, without cookies. To learn which pages and agencies people find useful, we log what was shown and clicked (for example “agency 3 in the nursing ranking was opened”), the page, the type of device, and, if you searched for an agency, its name. We don’t store your IP address, and we don’t set a cookie for it: we turn your IP address and browser details into a code with a secret that changes every day and is deleted after two days, so visits can’t be linked from one day to the next. We keep these events for 13 months and the daily totals after that. Lawful basis: our legitimate interests in improving the site. If your browser sends Global Privacy Control we don’t count your visits at all, and you can switch it off here:
Site analytics, also without cookies. We use an analytics service, hosted in the EU, to see how people move through the site: pages viewed, buttons and links clicked, where a visit came from (such as a search engine, or a link we posted with a campaign tag), the type of device and browser, and roughly which country. It sets no cookies and stores nothing in your browser for this. It throws away your IP address, and tells one visit from another with a code made on its servers from details of the request and a secret that changes every day, so visits can’t be linked from one day to the next. We never tell it who you are, and on your account and sign-in pages it records only that a page was viewed. Lawful basis: our legitimate interests in improving the site. The switch below and Global Privacy Control turn this off too.
We count your visits as described above.
Your location, if you ask. On the jobs search you can press “Use my location”. Your browser asks you first; we use the position once to find the nearest town and don’t keep it.
Google ratings. Agency profiles with a Google listing show the agency’s Google rating using Google Maps Platform, which loads from Google when that part of the page comes into view. Google receives your IP address and browser details when it loads, under the Google Privacy Policy. We don’t receive the rating or share anything about you with Google. See our cookies page.
Errors. If something breaks on our server, an error report goes to our error-monitoring service so we can fix it. We strip anything about you before it’s sent: no form contents, no cookies, no email addresses or numbers.
If you’re looking for work
Your account. You sign in with a code we email you; there’s no password. We keep what you give us: your name, email, role and specialties, the areas and type of work you want, when you can start, and optionally your mobile, professional register and registration number, and CVs. Your mobile and registration number are encrypted before they are stored. Lawful basis: providing the service you asked for (contract).
Reading your CV. If you ask us to fill in your details from your CV, we send the CV to an AI service, which reads it for us as our service provider and doesn’t use it to train its models. Nothing it finds is saved until you check it and press Save. You can always fill your details in yourself instead. CVs often contain more than we need; please leave out things like your date of birth, health or religion, which agencies don’t need to see at this stage.
Uploading your CV before you sign up. You can upload your CV without an account: upload it, have it read, and answer the questions, and you give us your email only at the end. Until then we keep your CV and answers in private storage, encrypted and linked only to your browser by a cookie. No agency sees them. Only that browser can save them, once you’ve signed in there with the code we email you. If you finish, they move into your account (if you already have one, they only fill in what’s missing, and your CV is added alongside any you’ve saved). If you don’t, we delete them after an hour without activity, and always within 24 hours.
Sharing your details with agencies. Helping you find work through agencies is what the site is for. So when you apply for a job, upload your CV, fill in your profile or press “Let agencies contact me”, you agree that we may pass your details and CV to any agency listed on our site; every one of those buttons says so. We do it ourselves, by hand: each application, CV and profile comes to our own inbox with your details, and we pass it on to the agency you applied to, or to other agencies that fit what you want. Nothing is sent to an agency automatically, and agencies can’t search for you on our site. Lawful basis: providing the service you asked for (contract), and our legitimate interests in helping you find work. You can object at any time by emailing hello@healthagencies.co.uk, or delete your account. Once an agency has your details, it’s responsible for them under its own privacy notice.
Your CVs and applications: why we keep them, and for how long. We keep them to provide the service you asked for: showing you where you’ve applied, and passing your details to agencies to help you find work (lawful basis: contract, and our legitimate interests in helping you find work). A CV stays in your account until you delete it, or until your account is deleted: by you at any time, or automatically 2 years after you last used it. An application stays while your account exists, so you can see where you’ve applied; one you withdraw is deleted 30 days later. The copy that reaches our mailbox when you apply or upload a CV is kept only while we need it to introduce you to agencies: we review the mailbox regularly and delete what we no longer need, and we delete it sooner if you object or ask us to. What we’ve already passed to an agency is then held by that agency under its own privacy notice.
What you’re looking for. We keep a short profile from your applications and answers: role, band and specialty, experience, town and region (never your address), the type of work and when you could start, so we can match you with agencies. Your account lists the agencies we’ve introduced you to.
Saved jobs and job alerts. We keep the jobs you save and the searches you ask us to email you about, and send those emails. Lawful basis: contract.
Tips and news. We only email you tips and news about new features if you tick that separate box; it is never ticked for you, and you can stop them at any time in your account. Lawful basis: your consent. Job alerts you set up and emails about your applications aren’t marketing.
If you’re finding an agency for your organisation
When you use Find an agency or “Ask an agency for staff” on an agency’s page, we keep what you tell us: your organisation (which you can pick from the NHS and Companies House registers, or type), its area, what staff you need, and your name and work email. To find your organisation we send the name you type to the NHS Organisation Data Service and Companies House, and nothing else about you.
Who sees it. When you send a request, you agree that we may pass it, with your name, organisation and contact details, to any agency listed on our site that can help; the form says so. Every request comes to our own inbox and we pass it on ourselves, to the agency you asked and, if it helps, to others that fit. Nothing is sent to an agency automatically. Where we suggest agencies, they follow our published ranked order, which no agency can pay to change. Lawful basis: providing the service you asked for, and our legitimate interests in finding you staff. You can object or withdraw at any time by emailing hello@healthagencies.co.uk.
A separate, unticked box lets us email you about staffing in your area; we record that choice and its words too. Lawful basis: your consent, which you can withdraw at any time.
If you work at an agency
Your account. When you verify that you work at an agency, we keep your work email, your name and job title if you add them, which agency you belong to, and what you send us: changes to your agency’s facts, logos, job feeds, corrections and disputes. Your teammates at the same agency can see your name, email and what you’ve sent. Lawful basis: our legitimate interests in keeping agency information accurate and letting agencies manage it.
Candidates and hirers we pass to you. When we pass you a candidate’s application, CV or profile, or an organisation’s request for staff, you receive their details as a separate controller. You’re responsible for them under your own privacy notice and must use them only for that candidate’s or hirer’s request. Please don’t copy candidates into marketing lists. Our terms for agencies say more.
Information about agencies. Our rankings and profiles are about agencies as businesses, built from public sources: their own websites, Companies House, NHS framework lists and the like. Where that includes a person, such as a director’s name from Companies House, we use it under our legitimate interests in publishing accurate, independent information about agencies. You can ask us to correct anything wrong through Report a mistake.
If you contact us or send a form
When you suggest an agency, report a mistake or email us, we keep your message and, if you give it, your email address, so we can check it and reply. Lawful basis: our legitimate interests in running the site and putting errors right.
Who we share data with
Agencies get your details when we pass them on, as described above. Otherwise, the companies that run parts of the service for us process data on our behalf, under contracts that say they may use it only for us. Ask us for the current list of service providers at hello@healthagencies.co.uk.
| Service | What for | Where |
|---|---|---|
| Database hosting | Database, sign-in and file storage (accounts, applications, CVs) | UK |
| Website hosting | Running the site, firewall and bot checks | UK, with a provider based in the USA |
| Cloud storage and backups | Encrypted backups and our data pipeline | UK |
| Email delivery | Sending our emails, including sign-in codes | EU |
| Business mailbox | Our mailbox, where applications, CVs and requests arrive so we can pass them on | UK |
| Bot protection | Checking that forms and sign-in requests come from people, not automated traffic | USA (a global network) |
| AI service | Reading a CV you upload to fill in your profile, only when you ask | USA |
| Error monitoring | Error reports, with personal details stripped | EU |
| Site analytics | Site analytics, without cookies or IP addresses | EU |
| Google ratings on agency profiles (in your browser) | USA |
If you use “Use my location”, we send the position to postcodes.io to find the nearest town. We also send the organisation name you type to the NHS Organisation Data Service and Companies House to look it up. We’ll share data with the police, courts or regulators only if the law requires it, and if the business is ever sold, the buyer would take on this notice. We never sell personal data.
Data leaving the UK
Most of your data stays in the UK. Some providers process data outside the UK (the AI service, bot protection and Google ratings involve the USA; email delivery, error monitoring and site analytics are in the EU, which the UK recognises as adequate). Where they do, we rely on the UK’s adequacy regulations, or on the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses.
How long we keep it
| What | How long |
|---|---|
| Your candidate account, profile and CVs | Until you delete them, or 2 years after you last used your account (a monthly clean-up deletes it, the same way as “Delete my account”) |
| Applications | While your account exists, so you can see where you’ve applied. A withdrawn application: 30 days |
| A CV uploaded before you sign up | An hour without activity, and never more than 24 hours |
| What you’re looking for (your matching profile) | While your account exists |
| Applications, CVs and requests in our mailbox | Until we no longer need them to introduce you; we review the mailbox regularly and delete what we no longer need |
| Introductions we made to agencies | 6 years, as evidence of what we shared and why, even if you delete your account |
| Organisation requests and contacts | Your contact details 12 months, or 30 days after you withdraw; requests 24 months |
| Agency staff accounts | While you’re on your agency’s team; a teammate can remove you |
| Messages and form submissions | 2 years |
| Security records (sign-in attempts, with email and IP address) | 90 days, and the ones recorded against your email go when you delete your account |
| Record of emails we’ve sent you, and our record of changes made | 2 years |
| Visit counting (no IP addresses) | 13 months; daily totals after that |
| Site analytics (no IP addresses) | No longer than the 13 months we keep our own visit counts; these records can’t be linked to you |
| Error reports | No longer than 90 days |
| Backups of all the above | Encrypted and locked against change: daily copies 35 days, monthly copies about a year. Something you delete disappears from backups as they expire |
Your rights
Under UK data protection law you can ask us to:
- show you the personal data we hold about you, and give you a copy;
- correct anything wrong or incomplete (you can change most things yourself in your account);
- delete it. If you have a candidate account, you can delete it and everything in it yourself, in your account settings;
- restrict how we use it while a question is sorted out;
- object to what we do under our legitimate interests, including passing your details to agencies, and to marketing at any time;
- move data you gave us to another service, in a common format;
- withdraw consent you gave, at any time, without affecting what we did before.
Nothing we do makes a decision about you by computer alone that has legal or similar effects: introductions to agencies are decided by a person, and our rankings are about agencies, not people.
To use any of these rights, email hello@healthagencies.co.uk. We may need to check it’s you, and we’ll reply within one month. It’s free.
If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
Keeping it safe
Your mobile and registration number are encrypted with a key only our server holds; CVs are in private storage; sign-in uses one-time codes with strict limits on guessing; agency staff see only what candidates chose to send them; and backups are encrypted and can’t be changed. Only Velsta Limited can see the data in our systems.
Children
This site is for adults looking for healthcare work and the organisations that hire them.
Changes to this notice
We’ll update this page when what we do changes, and change the date at the top. If a change affects how we use data you’ve already given us, we’ll tell you before it applies.