Updated: 23 October 2026.
Who is responsible
IMGate is an independent NHS career preparation service. The sole trader operating IMGate will be the controller of client information. Full legal identity and contact details are pending publication; our contact page will provide the route for privacy requests before intake opens.
What we collect and why
- Enquiries: name, email and message, to answer your request and take steps towards a contract at your request.
- Service delivery: contact details, service choice, vacancy details, the complete unsubmitted TRAC application PDF (including supporting statement and completed fields), job description, person specification, relevant CV or interview invitation, edits, notes and feedback. We use these to perform our contract with you.
- Orders and payments: order reference, amount, payment status, invoices and refunds, to perform the contract and meet accounting and tax obligations. Payment card details are handled by the selected payment provider; do not send them to IMGate.
- Security and disputes: proportionate access logs, acceptance records and correspondence, for our legitimate interests in protecting the service and resolving complaints. We balance these interests against your privacy.
- Optional marketing: only with a separate opt-in where required. You can withdraw consent at any time without affecting your service.
Send only what we need
For an application review, preserve the completed application answers and relevant qualification, registration and employment fields so we can assess the whole application. Redact home address, date of birth, signatures, referee contact details and identifiers that are not needed for that assessment. Do not include TRAC login details or passwords, passports, visa scans, payment details, patient information, confidential NHS records, or unnecessary sensitive information. Describe clinical examples anonymously. If prohibited information arrives, we will restrict access, remove it as appropriate and ask for a redacted replacement.
Three-month document limit
Client documents are deleted from active IMGate systems no later than three calendar months after their upload. For example, a file uploaded on 23 October is due for deletion by 23 January. Where there is no corresponding date, the last day of the month applies. We may delete sooner when no longer needed or following a valid request.
This covers uploaded CVs, complete application PDFs, statements, job descriptions, person specifications and invitations, extracted text, working copies, document-specific notes, edits and personalised feedback. Derived copies inherit the source document’s deadline; creating an edit or reopening a case does not restart it. Where several sources are combined, the earliest relevant deadline applies. Save your own copies of delivered work before the stated expiry date.
Cancelled or abandoned orders do not extend document retention. A narrowly necessary exception may apply where preservation is legally required or necessary for a specific legal claim; affected material will be restricted, reviewed and deleted when that need ends. We will explain any applicable exception unless legally prevented.
Records kept separately
The document limit does not mean that all transaction records disappear after three months. We retain only the minimum invoice, payment, refund and tax records for the legally required period, without attaching your CV or application. The exact tax-record schedule will be confirmed before checkout opens. General enquiries not leading to an order will be deleted within three months after the last substantive reply. Minimal records of terms accepted, early-start requests, delivery and complaint outcomes may be retained for up to six years after case closure for contract administration and legal claims, subject to review; these records will not contain application text. Marketing data is kept until you unsubscribe or it is no longer needed, with a minimal suppression record to honour your choice.
Access, providers and transfers
Access to client documents will be limited to the authorised reviewer and providers necessary to deliver the service, under appropriate contractual and security arrangements. We do not sell documents or give them to recruiters or employers. Provider names, purposes, storage locations, any overseas transfers and the safeguards used will be published here before intake opens. We do not promise UK-only storage without verifying it.
AI assistance
No client-document AI processing is currently configured. We will not send identifiable client documents to an AI service until its role, contractual safeguards, retention, transfer arrangements and training settings have been assessed and disclosed here. Any future AI-assisted draft must be checked by a human before delivery. We do not make solely automated decisions about employment or eligibility.
Deletion and backups
The three-month deadline applies to active files and working copies. Before uploads open, we will verify deletion of versions, trash, temporary exports and provider copies, and publish any remaining provider backup expiry period. Residual backup copies must be inaccessible for ordinary use and expire on the verified schedule; restored copies must be deleted again. We will not claim immediate removal from every backup unless that has been verified.
Your rights and complaints
Depending on the circumstances, you can request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where we rely on it. Rights are not absolute. We normally respond within one month; lawful extensions may apply to complex or numerous requests. We will use proportionate identity checks. You can complain to the Information Commissioner’s Office and need not contact us first.
Cookies and changes
The website is hosted through Wix. A verified cookie inventory and any required consent controls will be provided before optional analytics or advertising is enabled. We will update this notice when processing changes and explain material changes before using information for a new purpose.