adept

Privacy notice

Last updated: 5 November 2026

This notice explains how Adept Training Platforms Ltd processes personal data when you use the platform. adept helps medical training programmes manage trainees, hospital placements, rotations and ARCP administration. It processes data about NHS training staff (trainees, programme directors, college tutors, the consultants who sit on ARCP panels and the educational and clinical supervisors named on a placement) and holds no patient data.

1. Who we are

adept is provided by Adept Training Platforms Ltd (company 17275687, ICO registration ZC185340). The data controller for your training data is the organisation that runs your training programme: NHS England (Workforce, Training and Education), Yorkshire and the Humber ("the deanery"), which decides what is recorded and why. Adept Training Platforms Ltd processes that data on the deanery's behalf as its processor, and is the controller only for your account credentials, support correspondence and security logs. You can contact us at support@adept-platforms.com. Our data protection contact is Omar Jundi, Director (support@adept-platforms.com).

2. What this notice covers

This notice covers the adept web application at manage.adept-platforms.com and the adept app for Android, which shows the same service. It does not cover any third-party site we link to. The application processes data about NHS training staff - it does not hold patient data.

3. Personal data we collect

  • Identity & contact: name, email address, phone number.
  • Professional identifiers: GMC number, National Training Number (NTN), grade, specialty.
  • Training records: rotations and placements, ARCP dates and outcomes, less-than-full-time (LTFT) status, training pauses (the fact, the dates and the category), CCT dates, and programme-director notes.
  • Account & consent: sign-in email, a unique account ID, and your acceptance of these terms (version and date).
  • Usage / audit: a record of changes made in the system (who changed what, and when).
  • Page-use counts: how many times each page is opened each day, by role (for example trainee or college tutor). These are counts only and never record who opened a page.
  • Images: a profile / avatar image, if uploaded; for programme directors, an image of their signature if they upload one for the letters they send.
  • ARCP panel review: before an ARCP, your programme director and the consultants on your ARCP panel note what they found in your evidence (for example your PDP, supervision, MSF, logbook, exams and the absence on your Form R), any concern and a plan. If you sit on an ARCP panel, we hold your name, email address and the ARCP dates you sit on.
  • Email delivery: whether an email we sent you was delivered, bounced or reported as spam, kept for 90 days so that a failed invitation can be noticed and sent again.
  • Requests to change your working pattern: if you ask to work less than full time, or to change your percentage, we hold the percentage and dates you asked for, the reason group you chose (caring responsibilities, well-being or personal choice, a unique opportunity, or other), any note you add, and your programme director's decision and note. Only you and the programme directors of your region can see your request; college tutors cannot. Please don't put medical details in the note: your director will talk them through with you. Emails and in-app messages about a request never include your reason or your note.
  • Supervisors and supervisor meetings: the names and work email addresses of the educational and clinical supervisors on each placement, entered by your college tutor or programme director. You can log the dates of your supervisor meetings; we record only the type of meeting (initial, mid or end) and its date, never what was discussed. If you are a supervisor, we hold only your name and work email against the placements you supervise. We may email you about a trainee's educational supervisor's report (ESSR), but only once you have joined adept.
  • Time out of programme: the type of out-of-programme time (OOPT, OOPR, OOPE, OOPC or OOPP), and whether it counts towards your training.
  • Teaching attendance: which teaching sessions you attended, and whether you checked in with the code shown in the room or were marked by a member of staff. You and staff in your region can see it. It forms part of your ARCP evidence.
  • Joining or leaving: when your programme director is told that you are joining or leaving the region (for example, by an inter-deanery transfer), they may note your name, email address and GMC number before you have an account. We never record the reason for an inter-deanery transfer, such as its eligibility criterion.
  • Your ESSR: whether you have ticked "ESSR completed" on your ARCP checklist. If your programme director has switched reminders on, we may email you (and, if they choose, your educational supervisor) before your ARCP when it is not yet ticked.
  • Messages and calendar links: messages in your in-app inbox, which are kept for 180 days. If you choose to make a calendar link, we keep a scrambled (hashed) copy of it. Anyone who has the link can see your training dates and places, so keep it to yourself. You can turn it off or replace it on your profile. It stops working after 12 months, or when your password or two-factor login is reset.
  • Educational development time (EDT) requests: if your trust has switched EDT on, you can ask for EDT. We hold your name, email address, deanery, stage of training and trust; the date and session you asked for (morning, afternoon or whole day); the reason you give; and whether the request was approved, declined or withdrawn, who decided, when, and any note they add. You, the college tutors and the programme directors of your deanery can see your requests, and a college tutor at your trust decides. adept declines a request automatically if it would take you over your yearly allowance (16 sessions at stage 1-2, 32 at stage 3). Your trust's college tutors are emailed your name, the date and your reason, and you are emailed the decision and any note; each person can switch these emails off, and the message in your in-app inbox is always sent. Please don't put medical details in the reason: give a short description, and talk any health matter through with your tutor.
  • Module-change emails: when you change the modules on a placement, the college tutors at that trust who have chosen to be told (it is off unless they switch it on) are emailed your name, the trust and the modules added or removed.
  • Stage update requests: you can ask your programme director to record a new stage of training. We hold which stage you asked for and when, and the date if a director declines it. There is no free text, and only a programme director records a stage.
  • Meeting requests and drop-ins: you can ask your programme director for a meeting, or book a drop-in session they run. We hold your name, email address and year of training, any note and preferred times you add, the director's reply, and your bookings. Only the programme directors of your deanery see them; college tutors do not.

Some information relates to a training pause or a less-than-full-time (LTFT) arrangement. We record that the arrangement exists, its dates, and the category of any pause (for example out-of-programme experience, maternity or parental leave, or sickness absence). The category can reveal health or family circumstances, so we treat it as special category data and limit who can see it to your programme director and college tutor. Absence recorded on your Form R, which your ARCP panel notes in its review, is seen only by your programme directors and that panel.

4. Why we use it and our lawful basis

We use this data to administer postgraduate medical training - planning placements, managing rotations and ARCPs, and providing oversight to programme directors.

Our lawful basis under UK GDPR is Article 6(1)(e) - the performance of a task carried out in the public interest: improving the training experience for medical resident doctors and reducing the administrative burden on NHS education leaders and managers.

The category of a training pause is the only special category (more sensitive) data we hold, and we keep it to the minimum a programme director needs to plan your return and your progression. Our condition for processing it under Article 9(2)(b) is that it is necessary for the deanery's obligations in the field of employment and training, with the safeguards set out in the Data Protection Act 2018, Schedule 1. It is never used for automated decisions, and it is deleted with the rest of your record at the end of the retention period below.

A request to change your working pattern does not ask for special category information: the reason groups name no condition or belief, and the note asks you not to include medical details. Only you and your region's programme directors can see it.

EDT requests are used to arrange and keep track of your educational development time against your allowance, under the same Article 6(1)(e) basis. They do not ask for special category information; the reason is free text, so please leave out medical details. Module-change emails let your college tutor know that the modules on your placement have changed.

Prompts before your ARCP. Before an ARCP, your programme directors see a short list of things that may need sorting. Each item is a plain fact taken from your own record, for example:

  • your ESSR is not ticked;
  • no educational supervisor is recorded for your placement;
  • your ARCP checklist is incomplete;
  • your recorded teaching attendance is low;
  • an exam or milestone is overdue;
  • your last ARCP outcome was not a standard one.

These are fixed rules, not a score or a prediction. They are not stored. Only programme directors see them; college tutors and panel members do not. No decision is made automatically: your ARCP panel makes its decisions in the usual way. If something on the list is wrong, update your checklist or meeting log, or tell your programme director.

5. Who we share it with

We do not sell your data. We use trusted providers to run the service:

  • Google / Firebase - hosting, authentication, database and storage.
  • Resend - sending account and notification emails (including EDT and module-change emails).

Your deanery (NHS England (Workforce, Training and Education), Yorkshire and the Humber), as controller, sees your training data through the programme directors and college tutors it authorises. The consultants on your ARCP panel see the panel's review of your evidence for that ARCP only, and only until a week after it; they do not see the rest of your record, and your college tutor does not see the review. We do not share it with anyone else except the providers above, and with others only where required by law.

What your programme director may download from adept and send on:

  • To the trust you are going to. Before you start a placement, your programme director may send the trust's medical staffing team an "arrivals" list. It gives your name, GMC number, grade, working pattern (percentage), placement dates, site, programme and email address, so the trust can set up your rota and work schedule. It never includes reasons for time out or for a change of working pattern, or any notes.
  • To NHS England's Trainee Information System (TIS). Your deanery may export your training details in TIS's format to keep TIS up to date.
  • In reports. Programme directors can produce reports and an annual programme report. Reports can name you and are for use inside your deanery only. The annual report never names anyone.

adept does not keep a copy of these downloads. Once downloaded, your deanery looks after them under its own records rules.

6. Where your data is stored

  • Application database: the European Union (Google Cloud multi-region eur3; Belgium and the Netherlands).
  • Server functions: the United Kingdom (London).
  • Uploaded files (profile photos, signatures and handbook attachments): the United Kingdom (London).
  • Sign-in accounts: Google's Firebase Authentication, which processes and stores them only in the United States. It holds your sign-in email, display name, a scrambled (hashed) copy of your password, your two-factor enrolment, and sign-in times and network details. This is covered by Google's Cloud Data Processing Addendum (the UK International Data Transfer Addendum to the EU Standard Contractual Clauses) and Google's certification under the UK Extension to the EU-US Data Privacy Framework.
  • Email delivery: Resend, in the United States. It receives the recipient's name and email address and the message. This is covered by Resend's certification under the UK Extension to the EU-US Data Privacy Framework, with the Standard Contractual Clauses and UK Addendum in its data processing agreement as a fallback.

Transfers between the UK and EU are covered by data-protection adequacy. Transfers to the United States are covered by the safeguards above, so your data remains appropriately protected.

7. How long we keep it

We keep personal data only as long as necessary for administering postgraduate medical training and meeting our legal obligations. In line with the NHS Records Management Code of Practice and the Limitation Act 1980, we retain a trainee's training records for the duration of their participation in a training programme and for 6 years after they complete or leave it, after which the records are securely deleted or anonymised. We may retain records for longer where there is an outstanding ARCP outcome, appeal, complaint, or legal or regulatory matter; any such extension is recorded and given a review date.

In particular:

  • training records (including decided working-pattern requests and teaching attendance): while you are in the programme and for 6 years after you complete or leave;
  • the audit log of changes: 12 months, then deleted automatically;
  • sign-in accounts: switched off when you leave and deleted after 12 months;
  • undecided or withdrawn working-pattern requests, and meeting requests: 12 months;
  • EDT requests: 12 months after the request is decided or withdrawn, and sooner if your record is erased;
  • security logs (sign-ins and system logs): 365 days.

Some things are deleted automatically: in-app messages after 180 days; calendar links after 12 months at most; ESSR reminder records a month after your ARCP; and password-reset requests within 24 hours.

A decided working-pattern request is part of your training record. If your record is erased, the request is kept without your name, email address or any notes, as the programme's record that a decision was made.

8. How we protect it

Data is encrypted in transit and at rest, access is controlled by sign-in and role-based permissions, accounts are invite-only, and changes are audit-logged. The database has delete-protection and point-in-time recovery enabled.

9. Your rights

Under UK GDPR you have the right to: be informed; access your data; have inaccurate data corrected; request erasure; restrict or object to processing; and data portability.

You can download a copy of your data or request deletion from your profile in the app, or contact us at support@adept-platforms.com. Requests about your training data are decided by your deanery as controller; we pass them on and assist within 5 working days, and you will receive a response within one month. Where processing is a public task the right to erasure may not apply, in which case we will explain why.

10. Cookies & analytics

The application uses only strictly necessary cookies and local storage - specifically, the session token that keeps you signed in. These are essential for the service to work and do not require consent. We do not use analytics, advertising, or tracking cookies, and we do not track your activity across other websites.

11. Complaints

If you have concerns we haven't resolved, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

12. Changes to this notice

We may update this notice; the "last updated" date shows the latest version. Material changes will be brought to your attention.