Candidate Privacy Notice

When you submit an application, Medserv UK Ltd ("we", "us", or "the Company") process your personal data in accordance with this Privacy Notice. This notice has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other applicable UK data protection legislation. You may withdraw your consent at any time by contacting us at: hr-ukmailbox@medserv.co.uk

1. Data Controller

The data controller responsible for your personal data is: Medserv UK Ltd

Email: hr.uk@medserv.co.uk

2. Personal Data We Collect

We collect and process the following categories of personal data during recruitment:

Data we are required to collect

• Identification data (name, date of birth)
• Contact details (address, email, phone number)
• Education history and qualifications
• Professional experience and employment history
• Skills and competencies

Data processed on the basis of legitimate interest

• Expected salary and availability to start work
• Information relating to recruitment meetings and scheduling
• Our assessment of your suitability for the role
• Email address used for system identification (BambooHR)
• Publicly available professional information (e.g. LinkedIn profile)
• Results of competency assessments
• Data obtained in connection with recruitment agency cooperation

Data processed on the basis of your consent

• Any voluntary information included in your application (e.g. photograph, interests)
• References or testimonials from former employers
• Any sensitive personal data you choose to include (see Section 7)

Please do not include sensitive data (e.g. health, religion, ethnicity) unless strictly necessary. Where such data is provided, we will request your separate explicit consent before processing it.

3. AI-Assisted Screening

Important Notice: As part of our recruitment process, we use an AI-assisted screening tool to support the initial review of candidate applications. This section explains how it works and your rights in relation to it.

How the AI screening tool works

Upon submission of your application via BambooHR, our AI-assisted tool processes your CV and application data to produce a structured assessment. The tool assigns one of the following preliminary labels:

• Progress - the application appears to meet the role's core requirements
• Further review required - the application may partially meet requirements, or requires further review

A summary of the assessment is shared with the relevant hiring manager to inform, not replace, their decision-making.

Legal basis for automated processing

This automated processing is carried out on the basis of our legitimate interest in operating an efficient, consistent, and fair recruitment process (Article 6(1)(f) UK GDPR). We have conducted a Legitimate Interests Assessment (LIA) to balance these interests against your rights.

Human oversight - no solely automated decisions

In accordance with Article 22 UK GDPR, no recruitment decision is made solely on the basis of automated processing. All decisions are made by a human reviewer with full visibility of your original application. We also apply the principles of the EU AI Act as best practice in relation to high-risk AI systems used in recruitment.

AI governance and oversight

We apply governance controls for high-risk AI systems used in employment contexts, consistent with the UK Government's pro-innovation approach to AI regulation and the ICO's guidance on AI and data protection. In accordance with these controls, we:

• Maintain human oversight of all AI-generated outputs
• Log AI assessments for audit and accountability purposes
• Conduct ongoing monitoring of the tool's accuracy and potential for bias
• Do not use the AI tool as the sole basis for any recruitment decision
• Make this notice available to all candidates prior to or at the point of application

Opting out of AI-assisted screening

You have the right to request that your application is reviewed without the use of our AI-assisted screening tool. To opt out, please select your preference at the application stage. Opting out will not disadvantage your application in any way. If you wish to opt out after submission, please contact us as soon as possible.

Your rights in relation to automated processing

You have the right to:

• Be informed that automated processing is taking place (which this notice fulfils)
• Request human review of any AI-assisted assessment applied to your application
• Express your point of view and contest the outcome of any automated assessment
• Object to automated processing
• Opt out of AI-assisted screening entirely - see above

To exercise any of these rights, please contact: hr.uk@medserv.co.uk

4. Purposes and Legal Bases for Processing

We process your personal data for the following purposes:

• Recruitment for the advertised role: Legal basis - compliance with employment law and legitimate interest.
• Pre-contractual actions: Legal basis - Article 6(1)(b) UK GDPR (steps taken at your request prior to entering a contract).
• AI-assisted screening: Legal basis - Article 6(1)(f) UK GDPR (legitimate interest), subject to human oversight.
• Future recruitment (with consent): Legal basis - Article 6(1)(a) UK GDPR (your explicit consent).
• Recruitment satisfaction surveys: Legal basis - Article 6(1)(f) UK GDPR (legitimate interest).
• Establishing, pursuing, or defending legal claims: Legal basis - Article 6(1)(f) UK GDPR (legitimate interest).
• Repeat recruitment (if required): Legal basis - Article 6(1)(f) UK GDPR (legitimate interest).

5. Data Retention

We retain your personal data for the following periods:

• Recruitment for the advertised role: 12 months from application submission
• Future recruitment (if consented): 24 months from the date of consent
• AI screening logs and assessments: 12 months, for audit and accountability purposes
• Legal claims: 12 months from conclusion of the recruitment process
• Repeat recruitment: 12 months
• Recruitment satisfaction surveys: 12 months

After these periods, your data will be securely deleted or anonymised unless we are required by law to retain it for longer. Retention periods are set in accordance with the UK GDPR and the Data Protection Act 2018.

6. Data Sharing and Transfers

We may share your personal data with:

• Job advertisement service providers
• Recruitment management system providers (including BambooHR)
• AI tool and technology providers (including API-based AI services)
• IT and hosting service providers
• Xpert HR and other HR advisory or compliance service providers

Some recipients may be located outside the United Kingdom. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, including the use of International Data Transfer Agreements (IDTAs) or addendums to Standard Contractual Clauses as approved by the ICO. The EEA is recognised as providing an adequate level of protection for UK personal data.

You may request a copy of the safeguards we apply to international transfers by contacting: hr-ukmailbox@medserv.co.uk

7. Sensitive Personal Data

We ask that you do not provide sensitive personal data (special category data as defined under Article 9 UK GDPR - including data relating to health, ethnicity, religion, sexual orientation, or disability) unless strictly necessary. Sensitive data is not processed by our AI screening tool.

8. Your Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access - to obtain a copy of your personal data
• Right to rectification - to correct inaccurate or incomplete data
• Right to erasure - to request deletion of your data in certain circumstances
• Right to restriction - to limit how we process your data
• Right to data portability - to receive data you provided in a structured, machine-readable format, where processing is based on consent or contract
• Right to object - to object to processing based on legitimate interest, including AI-assisted screening
• Right not to be subject to solely automated decisions - to request human review of any AI assessment
• Right to withdraw consent - at any time, without affecting the lawfulness of prior processing

To exercise any of your rights, or to lodge a complaint with the Information Commissioner's Office (ICO), please contact: hr-ukmailbox@medserv.co.uk or by contacting the ICO via their website at ico.org.uk/make-a-complaint.

9. Review of This Notice

We are committed to keeping this Privacy Notice accurate, current, and compliant with applicable legislation. We will review this notice:

• At least annually
• Following any material change to our recruitment practices or the AI screening tool
• In response to changes in applicable legislation or regulatory guidance

10. Additional Changes

Where changes are material and your data is still held by us, we will take reasonable steps to notify you. The version date below reflects when this notice was last reviewed.

Questions or requests: hr-ukmailbox@medserv.co.uk | Version: June 2026 | Medserv UK Ltd HR & Compliance