1. Introduction

St George's University Hospitals NHS Foundation Trust ("we", "our", or "us") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard personal data processed through the Anaesthetic Claims System (the "App").

2. Data We Collect

We collect and process the following categories of personal data:

• Identity Data: full name, email address, and role (e.g. Consultant, SpR).
• Professional Data: payroll/assignment number, GMC number, grade, speciality, department, and contact telephone number.
• Claim Data: theatre session details, overtime hours claimed, TOIL accruals and redemptions, claim statuses, and administrative notes.
• Usage Data: app interactions, messages sent to administrators, and issue reports.

3. Purpose and Legal Basis

We process personal data for the following purposes under the legal bases indicated:

• Service delivery: to enable overtime and TOIL claim submission, review, approval, and payroll processing — necessary for the performance of your employment contract and the Trust's statutory obligations.
• Workforce management: to monitor theatre overruns, manage TOIL balances, and support departmental rostering — legitimate interests of the Trust in managing NHS resources effectively.
• Communication: to send claim status notifications and administrative messages — legitimate interests.
• Audit and compliance: to maintain accurate records for NHS internal audit and regulatory compliance — legal obligation.

4. Data Sharing

Your data is shared only as necessary:

• Within the Trust: authorised administrators and department managers who review and process claims.
• Payroll: relevant claim data shared with the Trust's payroll department for payment processing.
• Service providers: the App is hosted on infrastructure provided by Base44 (a third-party platform). Base44 acts as a data processor and does not use your data for its own purposes.

We do not sell personal data to any third party.

5. Data Retention

Claim records are retained in accordance with the Trust's data retention policy. Finalised claims (e.g. sent to payroll, rejected) are deleted after a configurable retention period set by Trust administrators. You may request earlier deletion of your account and associated data via the in-app deletion request feature or by contacting your department administrator.

6. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data (Subject Access Request).
• Rectify inaccurate or incomplete data.
• Request erasure of your data (right to be forgotten), subject to legal retention obligations.
• Restrict or object to processing in certain circumstances.
• Data portability — receive your data in a structured, commonly used format.

To exercise any of these rights, contact the Trust's Data Protection Officer or use the in-app account deletion request.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. This includes encryption in transit, access controls, and role-based permissions that limit data visibility to authorised personnel only.

8. Cookies and Tracking

The App uses essential session cookies for authentication and security purposes only. We do not use tracking cookies, analytics cookies, or advertising cookies.

9. Contact

For questions about this privacy policy or to exercise your data rights, please contact:

Data Protection Officer
St George's University Hospitals NHS Foundation Trust
Blackshaw Road, Tooting, London SW17 0QT
Email: dpo@stgeorges.nhs.uk