MapleMedic Privacy Policy

Summary (the short version)

This summary gives you the key points. The full policy below explains everything in detail, and the full policy is what applies.

• Who we are. MapleMedic (MAPLEMEDIC LTD) helps UK-trained GPs find work in independently owned clinics in Canada, starting in Ontario and expanding to British Columbia and other provinces. We are responsible for (the "controller" of) the personal information described in this policy.
• Our service is free for doctors. Clinics pay us. We never charge doctors a fee for finding them work, and we do not sell your personal information.
• What we collect. If you are a doctor working with us, this includes your contact details, CV, qualifications, GMC and licensing information, right-to-work and immigration information, references, your preferences, and any family or relocation information you choose to share. If you are a clinic, we collect business contact details and information about your clinic, including what we learn on visits. If you visit our website or join our mailing list, we collect limited technical and contact information.
• Who we share it with. We share a doctor's profile with a Canadian clinic only with that doctor's knowledge and agreement. With your agreement, we may also share relevant information with Canadian medical regulators, immigration professionals, relocation helpers and, for our MaplePledge programme, UK partner surgeries. We also use trusted service providers (such as email and website hosting) who act on our instructions.
• Sensitive information. Some information you share (for example about your health, or information revealing your ethnic origin) is sensitive. We only use it where you have given your explicit consent or where the law otherwise allows, and only for the purpose you shared it for.
• International transfers. We work between the UK and Canada, so your information will be transferred between those countries. We explain how we protect it in section 10.
• Marketing. We only send marketing emails if you have agreed, and every email has an easy unsubscribe link.
• Your rights. You can ask to see, correct or delete your information, withdraw your consent, object to certain uses, and complain to us or to a regulator: the UK Information Commissioner's Office (ICO), the Office of the Privacy Commissioner of Canada (OPC) or, in British Columbia, the Office of the Information and Privacy Commissioner for BC (OIPC BC).
• Questions? Contact our Privacy Officer, Dr Tiraan Thambipillai, at tiraan@maplemedic.com.

Full Privacy Policy

Contents

1. About this policy
2. Who we are and how to contact us
3. The laws that apply
4. Information we collect, and where it comes from
5. How and why we use your information (with our lawful bases)
6. Sensitive information
7. Consent
8. Who we share your information with
9. Our service providers
10. International transfers
11. How long we keep your information
12. How we keep your information safe
13. Marketing emails
14. Cookies and similar technologies
15. Your rights
16. How to make a complaint
17. Automated decisions
18. Children and family members
19. Links to other websites
20. Changes to this policy

1. About this policy

This policy explains how MapleMedic collects, uses, shares and protects personal information (also called "personal data") when you:

• visit our website at maplemedic.com;
• sign up to our mailing list;
• contact us by email, through our website or in any other way;
• register with us, or work with us, as a doctor looking for a role in Canada (we call you a "candidate");
• take part in our MaplePledge programme;
• work with us as a clinic owner, manager or member of clinic staff; or
• are a referee for a candidate, or a family member of a candidate whose details have been shared with us.

In this policy, "we", "us" and "our" mean MapleMedic (MAPLEMEDIC LTD). "You" means the person whose information we are using.

We may give you extra, more specific privacy information at the point we collect particular information (for example, on a sign-up form). That information should be read together with this policy.

2. Who we are and how to contact us

MapleMedic is a recruitment company founded by NHS doctors, Dr Tiraan Thambipillai and Dr Mikhail Nozdrin.

Our role. We are the controller of the personal information described in this policy. This means we decide why and how it is used, and we are responsible for it.

Accountability. Our Privacy Officer is responsible for our compliance with privacy law and this policy. If you have any question, concern or request about your personal information, please contact the Privacy Officer using the details above.

3. The laws that apply

Because we work with people in both the UK and Canada, more than one set of privacy laws may apply to your information. Depending on where you are and what we are doing, these include:

• Canada: the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to private-sector organisations handling personal information in the course of commercial activities, including in Ontario; British Columbia's Personal Information Protection Act (BC PIPA), which applies to many private-sector activities within British Columbia; and Canada's Anti-Spam Legislation (CASL), which applies to commercial electronic messages.
• United Kingdom: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (both as amended, including by the Data (Use and Access) Act 2025), and the Privacy and Electronic Communications Regulations 2003 (PECR), which cover marketing emails and cookies.

We aim to meet the requirements of each law that applies to us. Where the laws differ, we aim to follow the approach that gives you the greater protection.

4. Information we collect, and where it comes from

4.1 Website visitors

• Technical information: your IP address, browser type and version, device type, operating system, time zone, pages visited, the website you came from, and the date and time of your visit.
• Cookie and similar information: see section 14.
• Information you enter into forms on our website (for example, a contact or sign-up form).

Source: you and your device, and our website host and (if used) analytics providers.

4.2 Mailing list subscribers

• Name and email address.
• Your role (for example, GP, GP trainee, clinic owner or practice manager).
• Any optional interests or preferences you choose to tell us (for example, the provinces you are interested in).
• Records of your consent (when and how you signed up) and of your unsubscribe requests.

Source: you, and our mailing list provider (Brevo).

4.3 People who contact us

• Your name, contact details and the content of your message.
• Any information you choose to include in your message or attachments.
• Records of our correspondence with you.

Source: you.

4.4 Candidates (doctors looking for roles in Canada)

Depending on how far you go with us, we may collect:

• Identity and contact details: name, email address, phone number, postal address, date of birth, and photographs or video if you share them (for example, during a video call, if recorded with your agreement).
• Professional information: CV, work history, current and previous roles, training history, specialty interests, qualifications (including medical degree and postgraduate qualifications such as MRCGP), Certificate of Completion of Training (CCT) details, continuing professional development, appraisal and revalidation information you choose to share, and language test results if needed.
• Registration and licensing information: your GMC number and registration status, UK performers list status, and information relating to Canadian licensure (for example, applications to provincial medical regulators such as the College of Physicians and Surgeons of Ontario or the College of Physicians and Surgeons of British Columbia, and related bodies).
• Right-to-work and immigration information: nationality and citizenship, passport details, immigration status, visa and work permit applications and outcomes, and related documents.
• References: names and contact details of your referees, and the references they provide.
• Background checks: where a clinic, regulator or immigration process requires it, information about criminal record or police checks and professional standing (for example, certificates of good standing).
• Preferences: preferred locations, type of clinic, working pattern, desired start date, salary or remuneration expectations, and what matters to you in a role.
• Values and fit information: your notes and our notes from conversations about your career goals, working style, values and what you are looking for in a clinic, so we can make good matches.
• Relocation information: information you choose to share so that we can help you and your family relocate, such as your partner's employment needs, your children's schooling needs, housing requirements and banking needs. This may include information about your partner and children (see section 18).
• Sensitive information: in some cases, information about your health or disability (for example, if you tell us about adjustments you need), or information that reveals your racial or ethnic origin or religious beliefs. See section 6.
• Placement information: which clinics your profile was shared with, interview feedback, offers, the outcome, your start date, and information needed for us to invoice the clinic.
• Communications: our emails, messages, call notes and meeting notes with you.

Sources: mostly you. We may also collect information from:

• your referees;
• public registers (for example, the GMC's List of Registered Medical Practitioners, the UK performers list, and Canadian regulators' public registers);
• professional networking sites and other publicly available professional sources (for example, if we first contact you through a professional networking site);
• clinics you are introduced to (for example, interview feedback and offer details);
• Canadian medical regulators, immigration professionals and relocation helpers, where you have asked us to help with those processes; and
• people who recommend you to us (for example, a colleague who refers you). If someone refers you, we will tell you where we got your details when we first contact you.

4.5 MaplePledge participants

If you take part in MaplePledge (our programme to help GPs stay on the UK performers list and find UK work if they return), we may collect information about your UK performers list status, UK work preferences, availability and contact details, and we may share relevant information with UK partner surgeries (see section 8).

4.6 Clinic owners and staff

• Business contact details: name, job title, work email, work phone number and clinic address.
• Clinic information: information about the clinic, its ownership, services, patient population, team, working environment, culture, support for new doctors, and terms offered.
• Vetting visit information: notes from our in-person and remote vetting visits, including conversations with owners and staff about the clinic, how it works, and what it is like to work there. We will tell staff why we are speaking with them, and they are free not to take part.
• Contract and billing information: information needed to agree terms with the clinic, invoice for our services and receive payment.

Sources: you and your colleagues, our visits, the clinic's website and other public sources, and candidates who have worked with or been interviewed by the clinic.

4.7 Referees

If a candidate names you as a referee, we will collect your name, job title, contact details, your relationship to the candidate, and the reference you provide. Source: the candidate, and you.

4.8 If you do not provide information

Most information we ask for is needed to help you find a role, to check suitability for a role, or to support licensing and immigration processes. If you do not provide it, we may not be able to help you with some or all of these things. Information marked as optional (for example, family or relocation information) is entirely your choice. We will not ask for more information than we need for the purposes we tell you about.

5. How and why we use your information (with our lawful bases)

Under Canadian law, we collect, use and share personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and with your consent (express or implied, depending on how sensitive the information is and what you would reasonably expect), unless the law allows otherwise. See section 7.

Under UK law, we must have a "lawful basis" for each use of personal information. The table below sets out our main purposes and the lawful bases we rely on under the UK GDPR. Where we rely on "legitimate interests", we have considered your interests and rights and believe our use is fair and balanced. You can ask us for more details of this balancing test.

We will only use your information for the purposes we have told you about, or for purposes that are compatible with them. If we want to use it for a new, unrelated purpose, we will tell you first and, where required, ask for your consent.

We do not sell your personal information. We do not share it with anyone for their own marketing.

6. Sensitive information

Some information is especially sensitive. Under the UK GDPR, "special category data" includes information about health, racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation, and some other types. Information about criminal convictions and offences also has extra protection. Under Canadian law, health information, government identification numbers, immigration information and financial information are generally treated as sensitive.

What we may hold. We do not ask candidates for special category data unless it is genuinely needed. However, it may come to us if, for example:

• you tell us about a health condition or disability (for example, because you need reasonable adjustments for interviews, or because it affects your relocation needs);
• your immigration, passport or nationality documents reveal your racial or ethnic origin;
• you share information about your family that reveals religious beliefs or other special category information (for example, when discussing schooling); or
• a licensing, clinic or immigration process requires a criminal record check or declaration.

How we protect it. We use sensitive information only for the specific purpose for which it was shared, we limit who can see it, and we do not include it in profiles sent to clinics unless you have specifically asked us to. Nationality and immigration status are not, in themselves, special category data under the UK GDPR, but we treat them as sensitive and handle them with the same care.

Our UK legal conditions. Where we process special category data, we rely on:

• your explicit consent (UK GDPR Article 9(2)(a)), which you can withdraw at any time; or
• where necessary, the condition for the establishment, exercise or defence of legal claims (Article 9(2)(f)).

Where we process criminal offence information, we rely on your consent, or on the legal claims condition, under Schedule 1 of the Data Protection Act 2018.

Canada. We will obtain your express consent before collecting, using or sharing sensitive information.

7. Consent

How we obtain consent. Where we rely on consent, we ask for it clearly, separately from other matters, and before we collect or use your information for that purpose. For sensitive information, and for sharing your profile with a clinic, we ask for your express consent. For less sensitive information, consent may be implied where it is obvious from the circumstances (for example, when you email us a question, you can expect us to use your email address to reply).

Sharing your profile with clinics. Before we send your profile or CV to a specific clinic, we will tell you which clinic it is and ask you to agree.

Withdrawing consent. You can withdraw your consent at any time by contacting us at tiraan@maplemedic.com or, for emails, by clicking "unsubscribe". Withdrawing consent does not affect anything we did before you withdrew it. If you withdraw consent to a use of information that we need to provide a service (for example, sharing your profile with clinics), we may no longer be able to provide that service, and we will explain the consequences to you. Information that a clinic, regulator or other organisation has already received will be governed by that organisation's own privacy policy, but we will tell them about your withdrawal where appropriate.

8. Who we share your information with

We share personal information only where necessary for the purposes in this policy, and only as much as is needed. We may share information with:

• Prospective Canadian clinics: with your knowledge and agreement, we share your candidate profile, CV, references and relevant preferences with clinics that may wish to offer you a role, and we pass on information to arrange interviews and support offers. Once a clinic receives your information, it is responsible for how it uses that information as a separate controller under its own privacy obligations.
• Canadian medical regulators and related bodies: where you ask us to help with licensing or registration, we may share relevant information with bodies such as provincial colleges of physicians and surgeons, or other organisations involved in assessing medical credentials.
• Immigration professionals: where you ask us to, we may signpost or introduce you to licensed Canadian immigration lawyers we work with, and share relevant information with them. They act for you, not for us, and are responsible for their own handling of your information.
• Relocation helpers: with your consent, we may share relevant information with people who can help you relocate, for example housing contacts, schools, banks, or employers or recruiters who may be able to help your partner find work.
• UK partner surgeries (MaplePledge): with your consent, we may share relevant information with UK GP surgeries that partner with us, to help you stay on the UK performers list and find UK work if you return.
• Referees: we contact referees you have named and tell them who the reference is for.
• Service providers: businesses that provide services to us, such as website hosting, email, mailing list, storage, scheduling and customer relationship management. See section 9.
• Professional advisers: our lawyers, accountants, insurers and auditors, where necessary.
• Regulators, law enforcement and courts: where the law requires or permits us to share information, for example to respond to a lawful request from a public authority, to comply with recruiter licensing rules, or to protect the rights, property or safety of us, our candidates, clinics or others.
• Business transfers: if we restructure, merge with or are acquired by another business, personal information may be shared with the other business and its advisers, subject to confidentiality protections. The new owner would continue to be bound by this policy, or would tell you about any changes.

9. Our service providers

We use service providers (known as "processors" or "service providers") to help us run our business. They may only use your information on our instructions and for the purpose of providing their services to us, and we put contracts in place requiring them to protect it. Under Canadian law, we remain responsible for information we transfer to them.

The categories of service provider we use are listed below.

10. International transfers

We work across the UK and Canada, so your personal information will be transferred between those countries. Some of our service providers may store or process information in other countries, such as the United States.

Transfers from the UK to Canada. The UK has "adequacy regulations" for Canada, but they are partial. They cover personal information that is subject to PIPEDA, which applies to private-sector organisations handling personal information in the course of commercial activities. Where information we receive or transfer is subject to PIPEDA, we rely on these adequacy regulations.

Some recipients in Canada, or some types of information, may not be covered by PIPEDA (for example, public bodies such as some regulators or government immigration authorities, organisations whose handling of the information is governed by provincial law instead, or information handled outside commercial activities). In those cases, we rely on one of the following, as appropriate:

• appropriate safeguards approved under UK law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses;
• the transfer being necessary for steps you have asked us to take, or for a contract made in your interests (for example, sending your application to a clinic or regulator at your request); or
• your explicit consent, after we have told you about any risks.

Transfers to other countries. Where our service providers process information outside the UK and Canada, we rely on UK adequacy regulations where they apply (for example, the UK Extension to the EU-US Data Privacy Framework, if the provider is certified), or on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.

Transfers from Canada. When we transfer personal information to a service provider or partner outside Canada (including in the UK), we use contracts or other means to provide a comparable level of protection. Please be aware that information held outside Canada is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities.

You can ask us for more information about the safeguards we use, including a copy of relevant safeguards, by contacting the Privacy Officer.

11. How long we keep your information

We keep personal information only for as long as we need it for the purposes in this policy, including to meet legal, regulatory, tax, accounting and reporting requirements, and to deal with any complaints or legal claims. When we no longer need it, we securely delete or destroy it, or anonymise it so it can no longer identify you.

Our standard retention periods are below.

12. How we keep your information safe

We use appropriate technical and organisational measures to protect personal information against loss, theft and unauthorised access, use, disclosure, copying, changing or destruction. The level of protection reflects how sensitive the information is. These measures include limiting access to people who need it, using reputable service providers bound by confidentiality and security obligations, and training anyone who handles personal information on our behalf.

No method of transmitting or storing information is completely secure. Please take care when sending us information by email, particularly sensitive documents such as passports. If you would prefer to send documents another way, please ask us.

If something goes wrong. If a security breach affects your personal information, we will act quickly to contain it and reduce any harm. Where the law requires, we will notify the relevant regulators (for example, the ICO, generally within 72 hours of becoming aware of a reportable breach, and the Office of the Privacy Commissioner of Canada where a breach creates a real risk of significant harm), and we will tell you as soon as feasible if the breach is likely to put you at real or high risk of harm.

13. Marketing emails

We send our newsletter and other marketing emails only to people who have actively signed up or otherwise given consent, or where the law otherwise permits. Every marketing email we send will:

• clearly identify MapleMedic as the sender;
• include our contact details, including a postal address; and
• include a free and easy way to unsubscribe.

Our mailing list is run by Brevo, which acts as our service provider (see section 9).

If you unsubscribe, we will stop sending you marketing emails as soon as possible, and in any event within 10 business days. We keep a record of your request so we can respect it (see section 11).

Unsubscribing from marketing does not stop service messages. If you are a candidate or clinic we are working with, we will still contact you about that work.

14. Cookies and similar technologies

Cookies are small files placed on your device when you visit a website. Similar technologies include pixels, tags and local storage.

• Strictly necessary cookies make our website work (for example, security and remembering your cookie choices). We do not need your consent for these.
• Analytics cookies help us understand how visitors use our website so we can improve it.

You can also block or delete cookies through your browser settings, but some parts of the website may not work properly if you do.

15. Your rights

You have rights over your personal information. Which rights apply can depend on where you are and which law applies, but we will respond to any reasonable request wherever you are.

Rights under UK law (UK GDPR). You have the right to:

• Access: ask for a copy of the personal information we hold about you and information about how we use it.
• Correction (rectification): ask us to correct information that is inaccurate or incomplete.
• Erasure: ask us to delete your information in certain circumstances.
• Restriction: ask us to limit how we use your information in certain circumstances.
• Portability: ask for information you gave us, in a structured, commonly used, machine-readable format, or ask us to send it to another organisation, where we rely on consent or contract and process it by automated means.
• Object: object to our use of your information where we rely on legitimate interests. You have an absolute right to object to direct marketing.
• Withdraw consent: at any time, where we rely on consent.
• Rights relating to automated decisions: see section 17.
• Complain: see section 16.

Rights under Canadian law (PIPEDA and BC PIPA). You have the right to:

• Access: ask whether we hold personal information about you, how it has been used, and to whom it has been disclosed, and to obtain access to it.
• Correction: challenge the accuracy and completeness of your information and have it corrected where appropriate. Where we have shared inaccurate information with others, we will tell them about the correction where appropriate.
• Withdraw consent: at any time, subject to legal or contractual restrictions and reasonable notice. We will explain the consequences.
• Challenge our compliance: raise concerns with our Privacy Officer and, if you are not satisfied, with the relevant Canadian privacy commissioner (see section 16).

How to make a request. Email tiraan@maplemedic.com. Please tell us what you are asking for. We may need to confirm your identity before we respond, and we will only ask for information we need to do this.

Timescales and cost. We will respond within the time the applicable law requires. Under UK law, this is generally one month, which may be extended by up to two further months for complex or numerous requests. Under PIPEDA, it is generally 30 days, and under BC PIPA generally 30 business days, which in some circumstances may be extended. If we need more time, we will tell you why. Requests are normally free. We may charge a reasonable fee, or refuse a request, only where the law allows (for example, where a request is clearly unfounded or excessive), and we will tell you in advance if a fee applies.

Limits. Some rights are not absolute. For example, we may not be able to give you access to information that would reveal personal information about someone else (such as a confidential reference), or that is legally privileged. If we refuse a request, we will explain why, unless the law prevents us, and tell you how to complain.

16. How to make a complaint

Complain to us first. If you are unhappy with how we have handled your personal information, please contact our Privacy Officer at tiraan@maplemedic.com. We will acknowledge your complaint, investigate it, and tell you the outcome without undue delay.

Complain to a regulator. You also have the right to complain to a privacy regulator:

• United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Website: https://ico.org.uk/make-a-complaint/. The ICO generally expects you to raise your complaint with us first.
• Canada (federal): Office of the Privacy Commissioner of Canada (OPC). Website: https://www.priv.gc.ca/en/report-a-concern/.
• British Columbia: Office of the Information and Privacy Commissioner for British Columbia (OIPC BC). Website: https://www.oipc.bc.ca/.

17. Automated decisions

We do not make decisions about you based solely on automated processing (that is, without meaningful human involvement) that have legal or similarly significant effects on you. Decisions about which clinics to introduce you to are made by people at MapleMedic.

18. Children and family members

Children. Our website and services are intended for adult professionals. We do not knowingly collect personal information directly from children.

Family members. If you are a candidate, you may choose to share information about your partner, children or other family members so that we can help with relocation (for example, schooling or partner employment). Please share only what is needed, and please let them know that you are sharing their information with us and point them to this policy. We will use family members' information only to provide the relocation help you have asked for, will treat information about children with particular care, and will not share it without your agreement.

19. Links to other websites

Our website and emails may contain links to other websites, such as regulators, clinics or partners. We are not responsible for the privacy practices of other websites. Please read their privacy policies.

20. Changes to this policy

We may update this policy from time to time, for example if our services, the tools we use, or the law changes. We will post the updated policy on our website with a new "last updated" date. If we make significant changes, we will tell you directly where appropriate, and where the law requires it, we will ask for your consent.