Last updated: 21 October 2026
Qura Ltd, trading as Qura Health ("Qura", "we", "us"), operates the Qura website and mobile app. This policy explains what we collect, why, and your rights. We are the data controller for the information described here.
Qura Ltd, registered in England & Wales (company no. 17310951), 167-169 Great Portland Street, 5th Floor, London W1W 5PF. Contact: privacy@qurahealth.org.
Qura Ltd is registered with the Information Commissioner's Office as a data controller, registration reference ZC248209. You can verify this on the ICO's public register of fee payers at ico.org.uk.
The Qura mobile app is published on the Google Play Store and the Apple App Store by ImadeForte Holdings Limited, the group company of which Qura Ltd is part, so that is the developer name shown on the store listing. Qura Ltd remains the data controller for everything described in this policy, and the contact details above are the right route for any question or request about your information.
Account information: your name, email address, and the lens you choose (clinician, workforce supplier, or healthcare provider). Professional information you provide: profession, registration details where your profession is regulated, country, the countries you would work in and your eligibility in each, experience, the roles you want next, and a CV or professional summary. Usage information needed to run the service, such as applications you make, opportunities you save, and introductions you request. Payment information is processed by our payment provider, Stripe; we do not store card details.
We do not store the IP addresses of visitors. Where we need to limit how often a request can be made, we store a one-way cryptographic hash instead, which serves the purpose without holding anything that identifies you.
To create and manage your account, record professional credentials, match clinicians with relevant opportunities, enable organisations to discover and connect with clinicians, process subscriptions and introduction fees, send you service notifications, and improve and secure the service.
Many roles on Qura are "Discovered by Qura": live vacancies found on public job sites such as NHS Jobs, where you read the full advert and apply on that site under its own privacy notice.
What we record. When you are signed in as a clinician, we record which of these roles were shown to you in Opportunities, which you opened the details of, and which advert you went on to open, with the date and whether you used the website or the app. A role you open is added to My applications.
What we ask. The job site does not tell us whether you applied, so about 2 days after you open an advert we ask you, in the app, by app notification and by email. Notifications and email subject lines never name the role or employer, so they cannot give your job search away on a locked screen or in a shared inbox. If you applied, we later ask about interview, offer and starting. We ask at most once a day, only in UK daytime, and stop asking about a role after 2 unanswered questions. Opening an advert is never counted as applying, and nothing you tell us is presented as confirmed by an employer.
How it is used. Your records and answers are for your own tracker and for anonymous totals that show how roles get from search to application. We never share them with the employer or the job site. You can change or delete any record, and turn the reminders off, in My applications or from the link in any reminder email.
Why we are allowed to. Keeping your tracker and asking you about it is part of the service you signed up for (contract, Article 6(1)(b) of the UK GDPR). The anonymous totals rely on legitimate interests (Article 6(1)(f)), balanced against your rights; you can object at any time by emailing privacy@qurahealth.org.
There are two routes to a verified profile, and every verified profile shows which one was used, because they confirm different things.
Register checked. Where your profession is regulated, a person at Qura opens the relevant official public register, finds you, and confirms your registration number, your name and that the registration is current and unrestricted.
Credentials checked. Where your profession or country does not require registration, which is common in clinical research and in several jurisdictions, a person at Qura confirms your identity from a government-issued document, confirms your primary qualification with the awarding institution, and confirms a current professional certification with the body that issued it.
Until one of those checks has been carried out, your profile is described as active rather than verified. We do not collect more than is needed for this purpose.
Documents are held in private storage in Frankfurt (EU), never published, and visible to an organisation only where you have shared them, where that organisation has requested an introduction to you, and while the document remains in date. A new document is not shared until you choose to share it. An organisation sees the type of document, its name and its dates; it cannot download your files. A member of the Qura team opens each file you upload to check it. Every time one of your documents is opened we record who opened it and when, and you may ask us for that record at any time.
Why we are allowed to. Holding and checking your documents is part of the service you signed up for (contract, Article 6(1)(b) of the UK GDPR). Your fit-to-work status is health information, so we record it only with your explicit consent (Article 9(2)(a)), which you give with the box beside it and can withdraw at any time by deleting the entry.
Files we refuse. We check what each file really is before storing it. A file whose contents do not match a PDF, Word document or image, a Word file containing macros, or a PDF containing scripts is refused.
Two deliberate limits. We do not store DBS certificates. We record the certificate number, its level and its issue date, which an organisation verifies for itself on the DBS update service; holding the certificate would make us a controller of criminal offence data without good reason. We do not store occupational health reports. You record your fit-to-work status and its date, and that is all an organisation sees.
Renewal reminders. If you add the date a document is valid until, we remind you by email and app notification about 60, 30 and 7 days before it expires. Reminders never name the document in the subject line, the inbox preview or on a locked screen, and you can turn them off in your Document vault or from the link in any reminder email.
Verified clinician profile information (such as profession, registration body, country and experience) may be shown to organisations on the platform so they can consider you for opportunities. We do not sell your personal data. We use trusted processors including Supabase (data hosting), Vercel (hosting), Stripe (payments), Resend (email), Expo (app notifications), Anthropic (AI features) and, where you have agreed to analytics, PostHog (product analytics, hosted in the EU); each processes data only on our instructions.
Organisation teams. When someone at your organisation invites you to their Qura team, we use your email address to send the invitation, and keep a record of it (who invited whom, and when) for as long as the team exists. If the address is outside the organisation's email domain, a Qura founder sees it before the invitation is sent. People in the same team see each other's names and email addresses, and share the team's pipeline, saved opportunities and talent pool. This is part of the service the organisation signed up for (contract, Article 6(1)(b) of the UK GDPR). You can leave a team, and a team's owner can remove you, at any time.
Some features use AI to summarise information you provide, to surface relevant opportunities, and to draft the first version of documents and messages. They operate on information already provided.
AI does not decide who is verified, who is shortlisted, who receives a contract, or who is suitable for a role. Those decisions belong to the organisation making them, and the platform is built so that it cannot quietly take them. Where you see a match score, it is our assessment of a profile against an opportunity and nothing more; it is never a decision by an employer.
Qura maintains a directory of named healthcare decision-makers, made available to subscribers. If you are one of those people, this section explains how we hold your information and what you can do about it.
Where it comes from. The directory has been researched and compiled by Qura's founders over many years from publicly available business information, including official organisation websites, publicly accessible professional profiles, conference and event speaker listings, published papers and board papers, and public procurement notices. We do not buy contact databases, and we do not scrape.
What we hold. Your name, your job title, the organisation you work for, your professional specialty, and where it is published, a work email address or work telephone number. We hold this in a professional capacity only. We do not hold personal addresses, personal telephone numbers or any special category data.
Why we are allowed to. We rely on legitimate interests under Article 6(1)(f) of the UK GDPR: the interest of healthcare organisations and suppliers in reaching the right professional contact, balanced against your rights. We have assessed that balance and we keep that assessment on file. You can ask to see it.
How it is used. Contact details are shown only to subscribers on a plan that includes directory access, and only for legitimate business communication about healthcare services and workforce. Subscribers agree to our terms, which prohibit adding you to a marketing list, bulk mailing, or using your details for anything other than the specific enquiry.
It is separate from any Qura account you may hold. A directory entry and a user account are different records with different lawful bases. We never link the two on the strength of a matching name, and closing an account does not remove a directory entry, nor does removing a directory entry close an account. If you want both, tell us and we will do both.
Your rights. You can object to us holding your information, ask for it to be corrected, or ask us to remove you entirely, at any time and without giving a reason. Email privacy@qurahealth.org and we will action it promptly and confirm when it is done. Removal is permanent: we keep a note of the request so the record is not reinstated by a later update.
Being told. Where we hold an email address, we tell people directly. Where we do not, this notice is how we make that information available, which is the route Article 14 of the UK GDPR provides where individual notification would involve disproportionate effort. Any first approach made through Qura also tells the recipient where the details came from and how to be removed.
Council SEND contacts. SEND Intelligence also shows the contact details that councils publish on their own websites for the officers and teams responsible for SEND services and contracts. How we find, show and remove them is set out on how Qura sources SEND data, which also has a form to ask us to remove your details.
Care Intelligence. Care Intelligence uses the CQC care directory and the careers pages care providers publish on their own websites. It holds the names and addresses of care services and the roles they advertise, never the names of care staff or managers, and nothing about the people who use care services. See how Qura sources care data.
Cookies that are strictly necessary to run Qura, such as keeping you signed in, are always used. We cannot provide the service without them.
Analytics cookies are used only if you agree. When you first visit we ask, and you can choose "Essential only" or "Accept all". If you decline, no analytics code is loaded at all. You can change your mind at any time using the "Cookie preferences" link in the footer.
Where you agree, we use PostHog to understand how the service is used, hosted on their EU infrastructure so your data does not leave the EU. This records pages viewed, features used, and a replay of your session so we can see where the product is confusing. Session replays mask every text field, so anything you type, including registration numbers, email addresses and passwords, is never recorded or replayable. We use this only to improve Qura, never to build a profile of you for advertising.
We keep your information for as long as your account is active. Specific periods apply to the things most worth being precise about, and an automated process enforces them daily rather than leaving them to memory.
You can request deletion at any time, and you do not have to close your account to remove individual documents or details.
Depending on your location, you may have rights to access, correct, delete, or restrict use of your personal data, and to data portability. You can delete your account in the app (Account > Delete my account) or by contacting us. To exercise any right, email privacy@qurahealth.org.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put things right first.
We use appropriate technical and organisational measures to protect your information, including encryption in transit, private storage for documents, links to documents that expire within minutes, and an access log on every document read. No system is perfectly secure, but we work to keep your data safe.
Qura is for qualified professionals and organisations and is not intended for anyone under 18.
We may update this policy and will change the date above when we do.
Questions? Email privacy@qurahealth.org.