How we handle your information

Last updated 5 August 2026.

Before this goes in front of a real trust: register with the ICO, insert the controller details below, and have a solicitor read this alongside the employment business terms.

Who we are

Rostra is a trading name of [REGISTERED COMPANY NAME], a company registered in England and Wales, number [COMPANY NUMBER], at [REGISTERED ADDRESS]. We are the data controller for the information described here. Our ICO registration number is [ICO NUMBER]. Questions go to [CONTACT EMAIL].

What this service holds

This is the hospital side of Rostra. It holds work information about the people who post and approve shifts, and the shifts themselves:

Your name, work email address and job title
The department and trust you work for
Shifts your department posts: grade, date, times, rate and any notes you add
The name of the doctor put forward, their grade, and their attendance record
Who approved a booking and when, because a named person has to sign it off

What it deliberately does not hold

No patient information of any kind. No criminal record certificate numbers. No health, immunisation or occupational health data. No professional registration numbers. Those checks happen elsewhere, and this service records only that they were done.

Why we hold it

To match doctors to the shifts your department needs covered, which is our contract with you, and to keep a record of who approved which booking, which we need in order to meet our obligations as an employment business under the Conduct of Employment Agencies and Employment Businesses Regulations 2003.

Who sees it

People at your own department see your department’s shifts. Our staff see shifts across departments in order to match them. Nobody at another trust sees your shifts. Our hosting and database are provided by Supabase and Vercel, who process data on our instructions and nothing more.

Where it is kept, and for how long

Data is held in the United Kingdom or the European Economic Area. We keep shift and booking records for [RETENTION PERIOD, six years is the usual answer for employment business records] and then delete them. Account information is deleted within 30 days of you asking us to close your account.

What you can ask us to do

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or complain to the Information Commissioner’s Office at ico.org.uk. Write to [CONTACT EMAIL] and we will answer within one month.

Cookies

One cookie, which keeps you signed in. There is no analytics, advertising or third party tracking on this service.