Sessionly Ltd ("Sessionly", "we", "us") operates the Sessionly platform: an iOS app for GP locums, a web portal for GP practices, and an administration dashboard (together, the "Service"). This policy explains what personal data we collect, why, and how we look after it.
Sessionly Ltd is a company registered in England and Wales (company number 17156289), with its registered office at Suite A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE. We are registered with the Information Commissioner's Office (ICO), registration number ZC192863, and are the data controller for the personal data described in this policy.
A note on our pilot: Sessionly is currently operating as a pilot service under active development. Features may change, and we may contact you for feedback as part of the pilot.
Who this policy covers
- Locum GPs using the Sessionly app
- Practice staff using the Practice Portal on behalf of a GP practice
- Visitors to our website (sessionlygp.co.uk)
What we collect
Locum GPs
- Account and profile information: name, email address, phone number, professional details (including GMC number), location and shift preferences.
- Compliance documents and verification data: documents you upload for verification, which may include photo ID, right-to-work evidence, proof of address, GMC registration, qualification certificates, enhanced DBS certificate, occupational health and immunisation/vaccination history, indemnity certificate, training certificates and references. Some of this is special category data (health information) and criminal records data (DBS) — see "Sensitive data" below.
- Pension and payment information: details needed to prepare NHS Pension forms (such as your NHS pension reference and National Insurance number) and, where you use invoicing features, your bank account name, sort code and account number, which are included on the invoices you send to practices.
- Booking and usage data: shifts you view, apply for, book and complete; messages you send through the platform; and technical data needed to run the app (such as device information and notification tokens).
- Calendar data: if you enable calendar integration, we check your device calendar to detect clashes. Calendar access is controlled by your device permissions and can be switched off at any time.
Practice users
- Name, work email address, role, practice details, and the shifts, bookings and messages you manage through the Practice Portal.
How we use your data
- To run the Service: creating accounts, matching locums to shifts, processing bookings, enabling messaging between locums and practices, and sending service notifications (in-app and by email).
- To verify locums: reviewing uploaded compliance documents so that practices can rely on verified professionals. Practices you are booked with can view your approved compliance documents (for example GMC registration, indemnity insurance, right-to-work evidence and training certificates) so they can satisfy themselves of your suitability to work. Your DBS certificate is an exception: practices see only its verified status, not the certificate itself. Every time a practice views one of your documents, this is logged.
- To automate paperwork: generating NHS Pension forms (Locum A and B) and, where used, invoices/timesheets from your shift data. Invoices you send to a practice include the bank details you have provided for that purpose.
- AI features: when you use SessionlyAI (our in-app assistant), your message and a small amount of your own profile and operational data are processed by our AI provider, Anthropic (based in the USA), to return a response. We minimise what is sent — for example only your first name and postcode district, not your full name or full postcode — and we do not send your uploaded compliance documents, health information or DBS data to the AI. SessionlyAI is for your own locum admin only and must not be used to enter patient-identifiable information; it is not used for any automated decision that has a legal or similarly significant effect on you. Anthropic does not use your data to train its models, and holds inputs only for a limited period under its business terms.
- To improve the Service: understanding how the platform is used, fixing problems, and developing features. During the pilot we may review usage closely to improve the product.
Legal bases
For general personal data we rely on: performance of a contract (running your account and bookings), legitimate interests (operating, securing and improving the platform, and enabling practices to engage verified locums), and legal obligations (where applicable, such as right-to-work checks).
For special category data (health) and criminal offence data (DBS), we additionally rely on the conditions in the UK GDPR and Schedule 1 to the Data Protection Act 2018 that relate to employment, health and the assessment of a worker's suitability, supported by our Appropriate Policy Document. Where we rely on your explicit consent for any such processing, you can withdraw it at any time, though this may mean we cannot verify you for bookings.
Sensitive data
Some verification documents contain special category data (for example immunisation and occupational health information) and criminal offence data (your DBS certificate). We process these only to verify your eligibility and suitability to work as a locum GP, under the conditions described under "Legal bases" above, and we restrict and log access to them. They are stored securely and are never sent to our AI provider. Your DBS certificate is never shown to practices; they see only its verified status. Occupational health and immunisation information is used for verification and is not routinely displayed to practices.
Who we share data with
- GP practices: practices you apply to or book with can see your professional profile and verification status, and practices you are booked with can view your approved compliance documents (other than your DBS certificate, for which only verified status is shown). Document views are logged. If you send an invoice to a practice, it will include the details you have chosen to include on it, such as your bank account details for payment.
- Service providers: we use trusted providers to run the platform, including Supabase (database and file storage, hosted in the UK), Anthropic (AI assistant, USA), Resend (email notifications, USA), Apple (app distribution and push notifications, USA) and Vercel (hosting of our website and web portals, USA). These providers process data on our behalf under contract (data processing agreements), and only as needed to provide their service.
- No advertising or data sales: we do not sell your personal data, and we do not share it with advertisers.
- Legal: we may disclose data where required by law or to protect the rights and safety of users.
Where your data is stored
Your core account and document data is stored in the United Kingdom (with Supabase, hosted on Amazon Web Services in London). Some of our service providers operate in the United States (Anthropic, Resend, Apple and Vercel), so limited personal data is transferred there to provide those features. Where data is transferred outside the UK, we put appropriate safeguards in place, such as the UK International Data Transfer Agreement or UK-approved standard contractual clauses, together with a transfer risk assessment.
How long we keep it
We keep your data while your account is active, and after it closes only for as long as we need it. Our retention periods are aligned with the NHS Records Management Code of Practice:
- Compliance and verification records (ID, right-to-work, GMC/Performers List, references, training history): up to 6 years after your last engagement.
- Your DBS certificate: the certificate copy is deleted within 6 months of the engagement decision — wherever possible we hold only the verified status and a DBS Update Service reference rather than the certificate. A short verification record (the date checked, certificate number, check level and decision) is kept for up to 6 years after your last engagement.
- Health verification (occupational health, immunisation): while your account is active and for up to 6 years after your last engagement. Training/competency certificates may be kept for up to 10 years.
- Invoices and financial records: 6 years, for tax purposes.
- NHS pension records: in line with NHS pension requirements.
- Document access logs: retained for audit for a limited period.
Where we no longer need data, we delete or anonymise it. Some records may be kept longer where the law requires. You can ask us to delete your data at any time, subject to any overriding legal obligation. (We are finalising these periods with our advisers; this page will be updated if they change.)
Your rights
You have the right to access your data, correct it, delete it, restrict or object to its processing, and receive a copy in a portable format. To exercise any right, email us at the address below. You also have the right to complain to the ICO (ico.org.uk).
Security
We take appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, row-level access controls so users can only see their own data, private file storage served through short-lived secure links, access logging for sensitive documents, and role-based permissions across the app, Practice Portal and admin dashboard. For our AI assistant, we are moving to a model where the provider key is held securely on our server rather than in the app.
Children
The Service is for healthcare professionals and practice staff and is not intended for anyone under 18.
Changes
We may update this policy as the Service develops (particularly during the pilot). We will post updates on this page and update the date above; for significant changes we will notify you in the app or by email.
Contact