Privacy Notice

Who we are

Noxcon Ltd is responsible for the personal data described in this notice. You can contact us at enquiries@noxcon.co.uk or write to us at 15 Highgate Road, London, NW5 1QX.

Our role

We're a controller for our own business activities and may act as a processor where we handle personal data on behalf of NHS or other clients under their documented instructions. Enquiries about client-controlled data should normally be directed to the relevant client.

Data we use

• Website visitors: contact details, enquiry content, technical/IP data

• Clients & suppliers: names, roles, contact details, contracts, billing

• Consultants/applicants: CVs, qualifications, references, right-to-work, payment and training records

• Tool/service users: account, authentication and audit data; client test records may contain client-controlled personal data

Please don't submit patient information or special category data via our website form.

Why we use it

• Responding to enquiries and building relationships — legitimate interests / pre-contract steps

• Managing contracts, services, suppliers, invoicing — contract / legitimate interests

• Running and securing our systems — legitimate interests / legal obligation

• Financial, tax and regulatory record-keeping — legal obligation / legitimate interests

We don't sell data or use it for marketing lists.

Sharing

We share only what's necessary with NHS/other clients, consultants, suppliers (hosting, authentication, comms, admin), advisers, insurers, payment providers and regulators — all under confidentiality and data protection safeguards.

International transfers

Where data leaves the UK, we rely on adequacy regulations, the UK IDTA, the UK Addendum to the EU SCCs, or another lawful safeguard. Client-controlled data is only transferred as the client authorises.

Retention

• Contracts and consultant records: normally 6 years after the relevant relationship ends

• Financial, tax and VAT records: 6 years after the relevant financial year

• Unsuccessful applicants: 6 months

• Routine enquiries: up to 2 years after last meaningful contact

• Client-controlled records: as agreed with the relevant client

Your rights

You may be able to access, correct, delete, restrict/object to, or port your data, or withdraw consent. Email enquiries@noxcon.co.uk; processor-only requests are referred to the relevant client. You can complain to the ICO (ico.org.uk).

National Data opt-out

We do not currently use confidential patient information for research or planning purposes to which the National Data Opt-out applies. When we act for an NHS client, we follow that client’s instructions on opt-outs.