Where do we get the data from if not directly from you?
We receive trainee data from external organisations notifying us of information relating to recruitment, registration, exams, training and certification. For example, we receive ARCP outcomes, NTN and Training posts, including working less than full time from your Postgraduate Deanery or LETB and information from Health Education England (HEE) to ensure our trainee data is accurate and to support other work, such as workforce planning.
From within RCPCH we use your name and GMC number as provided by you either as part of your RCPCH Membership and/or Recruitment application. All this information will be visible to you on your ePortfolio.
We have begun collecting reasonable adjustment information into your ePortfolio.
Why do we collect this information?
- Trainees and those applying for CESR
-
UKGDPR requires a legal basis for any processing of personal data. Our legal bases for processing your data are:
"Legal Obligation" Where we are required to keep your training data for the administration of specialist registration and certification by the General Medical Council (GMC) under the Medical Act 1983. It is mandated by our GMC approved curriculum that this information must be maintained on an ePortfolio.
Where we process special category data, our "condition for processing" is "substantial public interest" in ensuring equality of opportunity or treatment.
Specifically, we may use your personal data for the following purposes:
- To communicate with you about the ePortfolio service and any maintenance via the relevant dashboard(s). It is your responsibility to ensure that your personal details are kept up to date and accurate (all users);
- To provide supporting evidence for your training progression (trainees only); Managing the provision of training programmes including recommending entry onto the GMC specialist register for CCT or CESR to the GMC (trainees and those applying for CESR);
- To enable the booking of exams and START assessments; To host your online CPD record and enable you to update it as necessary; (trainees only)
- Quality assurance of training programmes; (all users)
- Maintaining patient safety. We may be required under Section 35A of the Medical Act 1983 to disclose information held on ePortfolio to the GMC if it is relevant to a Fitness to Practice investigation. If the GMC allow us to, we will inform the individual of the request (all users);
- We will also share anonymised data with the RCPCH Workforce team for Workforce planning as it is in our legitimate interests to inform workforce planning and child health policy in the future (all users).
- Compliance with regulatory and legal obligations (all users)
- If you submit reasonable adjustment information to the College during your training, it will be used to enable you to exercise your right to receive reasonable adjustments throughout your training. If you submit equality, diversity and inclusion (EDI) information to the College during your training, it will be used in line with our diversity monitoring work and to monitor and report of progression of trainees under the Equality Act 2010. For more information, please see the EDI privacy notice.
- Paediatric clinicians not in the training pathway (e.g. Consultants, SAS doctors, other career grade doctors)
-
UKGDPR requires a legal basis for any processing of personal data. Our legal bases for processing your data are:
"Contractual Obligation" Where we need to process your personal data so that we can provide you with a personal account on ePortfolio for your CPD and also to enable you to fulfil any other roles you may hold relevant to postgraduate training, e.g. educational supervisor, training programme director etc. We would not be able to provide this service without collecting your personal data.
ePortfolio integrates with your RCPCH member account so any changes you make to your RCPCH account, such as updating your email address, will also update your ePortfolio account.
Specifically, we may use your personal data for the following purposes:
- To communicate with you about the ePortfolio service and any maintenance via the relevant dashboard(s). It is your responsibility to ensure that your personal details are kept up to date and accurate (all users);
- To provide you with updates and resources relating to your role (eg, educational supervisors,
- Managing the provision of training programmes including recommending entry onto the GMC specialist register for
- To enable the booking of exams and START assessments;
- To host your online CPD record and enable you to update it as necessary;
- Quality assurance of training programmes;
- Maintaining patient safety. We may be required under Section 35A of the Medical Act 1983 to disclose information held on ePortfolio to the GMC if it is relevant to a Fitness to Practice investigation. If the GMC allow us to, we will inform the individual of the request (all users);
- We will also share anonymised data with the RCPCH Workforce team for Workforce planning as it is in our legitimate interests to inform workforce planning and child health policy in the future (all users).
- Compliance with regulatory and legal obligations (all users)
- If you submit equality, diversity and inclusion (EDI) information to the College during your training, it will be used in line with our diversity monitoring work and to monitor and report of progression of trainees under the Equality Act 2010. For more information, please see the EDI privacy notice.
Who might we share your information with?
We will only ever share your data where we have a legal reason to do so. As part of the process of administering your training programme or application for registration on the GMC specialist register, we will share your information with the following (as appropriate):
- The General Medical Council.
- Postgraduate Medical Deans and their staff (Deaneries, LETBs and Heads of School), Training Programme Directors, Educational and Clinical Supervisors and College Tutors. Access permissions are restricted on ePortfolio for each role so that they can only view and edit the information as required by their role.
- Health Education England (HEE) for validation, training management and eligibility purposes.
- If we are asked to verify training and qualifications with potential employers or other Royal Medical Colleges.
- British Paediatric Surveillance Unit (BPSU) to identify new clinicians so that BPSU can contact them via their reporting system as it is in the public interest to inform them about the BPSU 'reporting card' which enables us to collect information on a number of rare or uncommon disorders. We also share Senior Fellows’ information with the BPSU to enable them to identify which of the reporting clinicians are Senior College Fellows. Reporting clinicians can opt out of receiving the 'reporting card' at any time by contacting: bpsu@rcpch.ac.uk.
- To enable us to ensure you receive relevant reasonable adjustments, we may share your reasonable adjustment data with test centres, assessors, and exam supervisors.
If you are taking a START (assessment), please see our START privacy notice.
If you are using the PaedCCF tool for feedback from patients and parents, please see our PaedCCF privacy notice
Your personal data will not be transferred outside of the EEA.
Understanding your data rights
Under the UK GDPR some of your data rights are limited where we have an obligation or legal requirement to retain your data. Please see below for details:
- The right to data portability only applies for non-trainees where we are processing your data with consent or as part of a contract with you and where technically possible.
- Some of your personal data you can change yourself via your RCPCH website account. Some of your data you cannot change yourself as it has been added by other people. If you think some of this data is inaccurate, please let us know us know so that we can investigate.
- For trainee data, we are legally required to keep some data permanently to evidence requirements for completion of training. For this reason, we cannot delete all personal data. We can delete non-essential contact information not relating to training on request, but this may affect our ability to offer you training if your training is still ongoing. For non-trainees, this will only apply in certain circumstances and will be considered on a case by case basis in line with the UK GDPR.
- Restrict the use of your data. You can request that we deactivate your account so that we only store your data but undertake no further processing, but this is only available under certain circumstances. For training, if this right is applicable, we can only do this if you are no longer in training or have completed training. If you are still in active training, we cannot do this.
- Object to processing. You can ask that we stop using data that is not necessary for fulfilling our regulatory obligations ahead of the 12-year deletion period. However, we cannot do this whilst you are still in training. For non-trainees, if you object to processing and no longer want to use the service, we will archive your account.
To help you understand more about this information, please see our page Understanding GDPR and your data rights. This explains common words and phrases used in our privacy notices, describes our use of artificial intelligence (AI) and details the rights you have in relation to the processing of your personal data under UK General Data Protection Regulation (UK GDPR).
To find out more about your rights visit the ICO website or to make a request contact the Data Protection Officer Information.Governance@rcpch.ac.uk or write to Information Governance Manager, RCPCH, 5-11 Theobalds Road, London WC1X 8SH.
In accordance with Data Protection Legislation, we have a legal duty to protect any information we collect from you and we have measures in place to ensure your data is securely and safely stored. You do have the right to complain to the ICO if you have concerns about the way your personal data is being handled: casework@ico.org.uk.
How long do we keep hold of your information for?
We will retain your data for the duration of your training and ongoing for purposes of CPD recording and any confirmation of training or other legal request from the GMC. In line with our Retention Policy, we will retain your data for 50 years from your CCT date or, if you do not have CCT, for 50 years from the first data entry date
Changes to this privacy notice
We review our privacy notices regularly and any updates to this notice will be made here.
Last updated 1 December 2025