Privacy notice

Advance-HE Fellowship Pathway for NHSE Primary Care

Last reviewed 01 April 2026

1. Who we are

The Advance-HE Fellowship Pathway for NHSE Primary Care (the "Platform") is operated by [operating entity, for example NHS England, acting through the NHSE London Fellowship programme] ("we", "us", "our"), of [registered address]. We are the data controller for the personal data described in this notice.

Our Data Protection Officer can be contacted via the contact form.

2. What personal data we collect

• Account data — name, NHS email address, password (hashed), account role, and sign-in history.
• Profile data — job title, employer or practice, region, role type (clinical / administrative / other).
• Application content — the draft narrative, case studies, context statements and reflective writing you enter.
• Referee and advocate data — the name, email address and statement provided by people you invite to write on your behalf.
• Review data — peer and expert reviewer feedback linked to your application.
• Communication data — messages you send us through the contact form and emails we send you.
• Technical data — audit logs, IP address, and browser type recorded for security and troubleshooting.

3. Why we use it, and our lawful basis

• To run your Fellowship application — necessary for the performance of a contract with you (UK GDPR Art. 6(1)(b)).
• To administer the programme, moderate reviews, and prevent misuse — legitimate interests (Art. 6(1)(f)) in delivering a fair Fellowship pathway across NHS primary care.
• To meet legal, safeguarding, and audit obligations — legal obligation (Art. 6(1)(c)).
• To send optional communications — your consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not carry out automated decision-making that produces legal or similarly significant effects. Fellowship is awarded by Advance HE under its own separate process.

4. Who we share it with

• Regional leads and national administrators within the programme, in line with their role — see the "Who sees what" summary below.
• Peer and expert reviewers — only the application content they have been assigned to review.
• Advance HE — when you choose to submit your completed pack for Fellowship recognition. Advance HE is a separate controller with its own privacy notice.
• Our hosting and email processors — cloud hosting, database, and transactional email providers acting under contract as data processors. They are permitted to use the data only to deliver the service to us.

We do not sell your personal data and we do not use it for advertising.

4.1 Who sees what within the platform

• You see your own data.
• Your regional lead sees applications from your region.
• The national admin team sees all applications.
• Peer and expert reviewers see only what they are assigned.
• Referees and advocates see only the statement they were asked to write.

5. International transfers

Personal data is stored on servers within the United Kingdom or European Economic Area wherever possible. Where a processor transfers data outside the UK/EEA, we rely on approved safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

6. How long we keep it

• Applications and supporting statements — for the duration of your Fellowship process and for two years after submission, then deleted by the national admin team.
• Account and profile data — while your account is active; deleted or anonymised within twelve months of account closure.
• Referee / advocate links and statements — with the associated application (see above), then deleted.
• Contact form messages — kept for up to two years for audit, then deleted.
• Audit and security logs — retained for up to twelve months.

7. Your rights

Under UK GDPR you have the right to:

• Access a copy of your personal data.
• Ask us to correct data that is wrong or incomplete.
• Ask us to erase data where the lawful basis no longer applies.
• Ask us to restrict or object to certain processing.
• Ask for portability of data you provided.
• Withdraw consent at any time where processing is based on consent.
• Complain to the UK Information Commissioner's Office (ico.org.uk/make-a-complaint).

To exercise a right, use the contact form. We respond within one month.

8. Cookies

We use only strictly necessary cookies and browser storage to keep you signed in and to remember your cookie choice. Full details are in the Cookie policy.

9. Security

Access is restricted by role-based permissions and row-level security. Data is transmitted over TLS and stored in encrypted managed databases. Staff access is limited to those who need it to administer the programme.

10. Changes to this notice

We may update this notice from time to time. Material changes will be highlighted on sign-in or by email. The "Last reviewed" date at the top shows when the notice was last changed.

11. Contact

Data-protection questions and general enquiries: contact form.