This Privacy Policy explains how HealthCore LTD (“FlexMed”, “we”, “us”) collects, uses, stores and shares personal data when you use the FlexMed website and marketplace. It should be read together with our Terms of Service.
1. Who we are (controller)
FlexMed is operated by HealthCore LTD, company number 16714575, registered office: Hucknall Business Hub, Unit 2 The Byron Centre, Ogle Street, Hucknall, Nottingham, NG15 7FQ. For the processing described in this policy, HealthCore LTD is the data controller.
Contact for privacy requests: hello@flexmed.uk or support@flexmed.uk.
2. Scope
This policy covers personal data processed through FlexMed accounts, profiles, job listings, bids and quotes, messaging, verification uploads, FlexMed+ billing, job alerts, support contacts, cookies/analytics and related Platform features. It applies to trainers, company users, visitors and anyone whose data is submitted in connection with FlexMed.
3. Personal data we collect
Depending on how you use FlexMed, we may process:
- Identity and contact - name, email, phone, organisation name, billing email, postal/address details where provided;
- Account - login credentials (or hashed equivalents), role (trainer/company/admin), notification preferences, OAuth links (for example Google or Microsoft account identifiers and email);
- Profile - display name, bio, photo, company type, registration numbers, equipment notes and public profile fields;
- Professional / verification - certifications, education, insurance, DBS/CRB checks, healthcare registrations, related files, claimed metadata (for example issuer, expiry, registration number), attestation timestamps, automated review outcomes, confidence scores, short AI-generated review summaries, model identifiers, and admin review notes;
- Marketplace activity - jobs, postcodes, venue addresses and access notes, bids/quotes, awards, contract acceptance timestamps, progress status, ratings and messages;
- Location-related - postcodes and geocoded coordinates used for map browse (with privacy controls for guests/non-verified users);
- Billing - FlexMed+ subscription status, Stripe customer/subscription identifiers and limited payment metadata (card details are handled by Stripe, not stored in full on FlexMed);
- Technical - IP address, device/browser data, logs, reCAPTCHA or similar bot-protection tokens, and analytics events;
- Support - correspondence you send us.
4. Sensitive and special category data
Some verification documents (for example health-professional registration or DBS-related information) may include sensitive data. Provide only what is necessary for Platform verification or an engagement. Do not upload patient-identifiable clinical records or other unnecessary special category data. Where such data is processed, we rely on an appropriate UK GDPR condition (such as explicit consent, employment/social protection obligations where applicable, or establishment/exercise/defence of legal claims) in addition to a lawful basis under Article 6.
5. How we collect data
- Directly from you (registration, profiles, listings, uploads, messages, checkout, support);
- Automatically (cookies, logs, security and analytics tools);
- From other users when they message you, award you work, or otherwise interact with your profile;
- From identity providers when you use social sign-in;
- From payment providers (Stripe) in connection with FlexMed+;
- From automated document-review systems (see section 6) that return a decision, confidence score and short summary about an uploaded file.
6. Automated document verification (AI)
When you upload a verification document (for example a certificate, insurance evidence, DBS/CRB check, education evidence or healthcare registration proof), FlexMed does not treat the upload as self-approved. Uploads stay pending until they pass review.
Where automated review is enabled, we send the uploaded file and the metadata you entered (such as name, document type, issuer, dates or registration details) to a third-party AI routing service (OpenRouter) so a multimodal model can check, among other things:
- whether the file appears to be a readable document of the claimed type;
- whether visible details are broadly consistent with the claimed name, dates and other metadata;
- whether the submission should be accepted automatically or flagged for human review.
The model returns a structured outcome (accept or flag), a confidence score and a short summary for our records and admin queue. High-confidence accepts may approve the document automatically. Low-confidence results, mismatches, unreadable files, failures or disabled automation are queued for FlexMed staff review. We may still override automated outcomes.
Processing for this purpose is based on our legitimate interests in verifying marketplace participants, preventing fraud and misuse, and protecting other users - and, where required, on performance of our contract with you to operate verification features. Where special category data appears in a document you chose to upload, we also rely on an appropriate UK GDPR condition as described in section 4.
OpenRouter and the underlying model providers act as processors / sub-processors for this review. Document content may be processed outside the UK/EEA depending on the selected model and provider. Where that happens, we use appropriate transfer safeguards as described in section 10. We configure review prompts so the model returns only a short decision summary; we do not use verification uploads to train FlexMed’s own models. Provider retention and training practices are governed by their terms - do not upload unnecessary personal or special category data.
You can contact us (section 18) if you have questions about a verification decision or wish to exercise your data-protection rights in relation to uploaded documents.
7. Purposes and lawful bases
We use personal data to:
- provide and secure the marketplace (contract and/or legitimate interests);
- verify accounts and documents (including automated AI review and human admin review), prevent fraud and abuse (legitimate interests / legal obligation);
- enable bidding, quoting, messaging, contracts and job workflow (contract);
- process FlexMed+ subscriptions (contract);
- send service emails and in-app notifications (contract / legitimate interests);
- operate job alerts and optional marketing where permitted (consent or legitimate interests, with opt-out for marketing);
- analyse and improve the Platform (legitimate interests);
- comply with law, respond to regulators and establish/defend legal claims (legal obligation / legitimate interests).
8. Cookies and similar technologies
We use essential cookies for login/session security and may use analytics (for example privacy-focused analytics such as Umami) and bot protection (for example Google reCAPTCHA). You can control cookies via browser settings. Essential cookies are required for the Platform to function.
9. Sharing
We may share personal data with:
- Other users as needed for marketplace function (for example profiles visible to relevant parties, messages, awarded-job details, released venue information after contracts);
- Processors such as hosting, email delivery, file storage, geocoding, analytics, bot protection, Stripe for payments, and OpenRouter / AI model providers used for automated verification document review;
- Professional advisers, insurers, regulators, law enforcement or courts where required or appropriate to protect rights, safety or comply with law.
We do not sell your personal data.
10. International transfers
We aim to process data in the UK/EEA or in countries with adequate protection. Where providers process data elsewhere (including AI model providers reached via OpenRouter), we use appropriate safeguards (such as UK IDTA / SCCs or equivalent) as required by UK data protection law.
11. Retention
We keep data only as long as needed for the purposes above, including security, accounting, dispute handling and legal obligations. In particular:
- rejected verification documents are typically deleted after about 90 days (or the period set in Platform settings);
- automated review summaries and related AI metadata are retained with the verification record while that record is kept;
- when you delete your account, your profile, verification files, bids, jobs you posted, messages, and sign-in links are removed immediately;
- billing and transaction records may be kept longer where required for tax or legal reasons.
12. Security
We apply technical and organisational measures appropriate to the risk (access controls, encryption in transit where used, least-privilege admin access, and similar). No online service is perfectly secure; please use a strong unique password and protect your devices.
13. Your rights
Under UK data protection law you may have the right to access, rectify, erase, restrict or object to certain processing, to data portability where applicable, and to withdraw consent where processing is consent-based. We usually respond within one month. Some rights are limited (for example where we must keep data for legal claims or compliance). Automated verification decisions can be reviewed by FlexMed staff; contact us if you want a human review of an outcome that affects your account.
To exercise rights, email hello@flexmed.uk. You may also complain to the Information Commissioner’s Office (ICO).
14. Marketing
We send essential service messages about your account and jobs. Marketing emails are sent only where permitted; you can unsubscribe using the link in those emails or by contacting us. Opting out of marketing does not stop transactional messages.
15. Children
FlexMed is not intended for under-18s. If we learn we have collected a child’s data without appropriate authority, we will take reasonable steps to delete it.
16. Third-party sites
Links to third-party sites or tools (including Stripe Customer Portal, OAuth providers and AI providers) are subject to those parties’ own privacy policies. We are not responsible for their practices.
17. Changes
We may update this policy from time to time. The latest version will be published on this page with an updated “last updated” date. Significant changes may be notified by email or in-product notice where appropriate.
18. Contact
HealthCore LTD, Hucknall Business Hub, Unit 2 The Byron Centre, Ogle Street, Hucknall, Nottingham, NG15 7FQ.
Email: hello@flexmed.uk · support@flexmed.uk