Privacy notice
Draft for solicitor review, 1 October 2026. Not legal advice and not yet in force. Text in [square brackets] is a placeholder or a question for the solicitor. Parts marked [Build] depend on technical choices not yet final.
Pilot version. This notice covers the closed pilot for GP trainees on the ICGP GP training schemes. We will update it before we open more widely or add any new verification step.
This notice explains what personal data TraineeTrust collects, why, and your rights under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
1. Who we are
[Company name] Limited ("TraineeTrust", "we") is the controller of your personal data. Registered office: [address], Ireland. Contact: [privacy email].
[Solicitor: confirm whether a Data Protection Officer is required under Article 37. Our view is probably not, since core activities are not large-scale systematic monitoring or special category processing, but we may appoint one voluntarily.]
2. The short version
- Reviews are about jobs, not people. Our rules and moderation keep personal data out of them.
- During the pilot we approve each member by hand. We do not check the Medical Council register and never ask for documents.
- Only approved members can see anything on the site.
- Your identity is kept separately from your reviews, encrypted, and is never shown to other members or given to any institution.
- We disclose who wrote a review only when the law requires it, such as a court order.
- Deleting your account deletes your reviews.
- Your home point for travel times stays on your device and is never linked to your account.
3. What we collect, why, and our legal basis
| Data | Why | Legal basis |
|---|---|---|
| Email address; passkey public key (we never see your private key) | To create your account and sign you in | Contract (Art. 6(1)(b)) |
| Name, GP training scheme and year, and anything you tell us to support your sign-up; who approved you and when | To check by hand that you are an eligible GP trainee | Legitimate interests (Art. 6(1)(f)): keeping the pilot to genuine GP trainees |
| Your reviews: site, specialty, year, grade and post type (optional), facts, scores, text, the declaration and its time, edit history | To publish reviews and calculate scores | Contract; legitimate interests |
| Moderation records: automated check results, moderator decisions, strikes, statements of reasons | To apply the guidelines and meet Digital Services Act duties | Legal obligation (Art. 6(1)(c)); legitimate interests |
| Security data: IP address, device and browser type, sign-in times, rate-limit counters | To protect accounts and detect fake or coordinated reviews | Legitimate interests |
| Reports and complaints: your name, email, the content reported and your explanation | To handle notices and complaints | Legal obligation (DSA Art. 16); legitimate interests |
| Institution representatives, once institution accounts are introduced (not during the pilot): name, role, work email, the institution | To verify institution accounts and publish responses | Contract; legitimate interests |
We do not use your data for advertising, and we do not sell it.
Where the data comes from. From you. To check sign-ups, we may also hold lists of trainee names and emails that a training hub or the ICGP gives us (pre-approval lists). We use them only to check sign-ups, never contact anyone on them, and delete them once the pilot ends. [Pilot: name each source of these lists here. Solicitor: confirm what Article 14 GDPR requires us to tell people on a list who have not signed up.]
Special category data. We do not want it. Our guidelines forbid health, ethnicity, religion, sexuality, pregnancy, union membership and similar information about anyone, and the automated check and moderators remove it. If any reaches us by mistake, we delete it.
Legitimate interests. Our interest is a trustworthy source of first-hand information for doctors choosing jobs, which depends on knowing reviewers are real GP trainees. We have balanced this against your interests in our legitimate interests assessment (available on request) and protect you by keeping identity separate and private. You can object at any time (section 8).
4. What is on your device only
- Home point. If you set a home point (Eircode, town or a pin) to compare travel times, it is stored only in your browser. It is not stored on our servers or linked to your account. To calculate walking, cycling, public transport and driving times we send only a rounded area (about 1 km across), never your exact location or any account details, to TravelTime, and we cache results per area for a day. If you type a town or Eircode to place your pin, we look up only the town or the Eircode's area (its first three characters), never a full Eircode or street address.
- Unfinished reviews. A review you have started but not submitted is kept in your browser until you submit it or sign out.
- Cookies. We use only cookies and storage that are strictly necessary for sign-in and security. [If analytics are added: name them and ask for consent first.]
5. Who sees your data
- Other approved members see your reviews with a pseudonymous profile: a "member" badge, your number of reviews and, where allowed, your grade band. Never your name or email. Nothing is visible to the public.
- Reviews of hospitals and other departments are shown only once that department has at least [3] reviews. Reviews of GP practices are shown from the first one, so a practice that hears about a review may be able to tell who wrote it.
- Institutions cannot see the site during the pilot. They never see who wrote a review, and we never tell them, even if they complain or threaten action.
- Administrators. During the pilot a very small team [Pilot: currently one person] approves members and also moderates reviews, so they may know who you are. They are bound by confidentiality, do not use your identity in moderation decisions, and record the reason for every decision. Linking a review to an identity for any other purpose needs a documented reason (a court order, a legal claim, or serious abuse such as threats or impersonation), and each access is logged.
- Service providers who process data for us under contract: hosting [provider, region], email delivery [provider], the automated text check [provider] (receives review text only, not your identity), and travel times and place lookup (TravelTime, UK; rounded area or town only). [Build: complete list before launch.]
- Courts and authorities where the law requires it. The Circuit Court can order us to identify the author of an anonymous post alleged to be defamatory. We may also have to share data with An Garda Síochána or a regulator under a legal obligation. Where the law allows, we will tell you first. Anonymity on TraineeTrust does not protect fabricated or defamatory content.
6. Transfers outside the EEA
TravelTime processes travel-time and place lookups in the UK, which has an EU adequacy decision. It receives only a rounded area or a town name, never anything that identifies you. [Build: name any other provider that processes data outside the EEA and the safeguard used, such as an adequacy decision or Standard Contractual Clauses. Our preference is EU hosting.]
7. How long we keep it
| Data | How long |
|---|---|
| Account and sign-up data | While your account exists |
| Reviews | Until you delete them or your account, or we remove them |
| After you delete your account | Account, identity and reviews deleted within 30 days; backups overwritten within a further [35] days |
| Sign-up requests we do not approve | [3 months] |
| Moderation records and statements of reasons | [2 years] after the decision |
| Reports, complaints and the content they concern | [2 years] after the case closes, longer if a legal claim is open |
| Security logs | [90 days] |
Defamation claims in Ireland usually have to be brought within one year, extendable by a court to two. If a complaint, legal claim or court order about a review is open when you delete your account, we keep only the records needed for it (in a restricted store) until it is resolved, as Article 17(3)(e) GDPR allows. The review itself stays unpublished. [Solicitor: confirm periods.]
8. Your rights
You can ask us to:
- give you a copy of your data (access);
- correct it;
- delete it (the quickest way is to delete your account);
- restrict how we use it;
- give it to you in a reusable format (portability);
- stop using it on the basis of legitimate interests (objection).
Write to [privacy email]. We reply within one month. We may need to confirm it is you.
Automated decisions. We make no decisions about you by automated means alone. Membership is decided by a person. The automated text check only highlights sentences; a person makes any decision to reject or remove.
Complaints. You can complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, www.dataprotection.ie. We would appreciate the chance to sort it out first.
9. Security
Identity and sign-up data are encrypted and stored separately from reviews. Access is limited to named staff and logged. We sign you in without passwords. [Build: summarise encryption at rest, key management and breach process.]
10. Age
TraineeTrust is for doctors in GP training. We do not knowingly collect data from anyone under 18.
11. Changes
We will tell you by email and on the site before any significant change to this notice.
Last updated: [date].