About this statement
This statement explains how the Royal College of Paediatrics and Child Health (the Data Controller) uses any information provided by candidates and assessors during the START Assessment process.
Personal data will be collected through general correspondence and more specifically through the RCPCH online account and online examination application systems.
This privacy statement covers both overseas and UK candidates and operational assessment stakeholders.
Data we collect
- Candidates
-
The START Assessment is run entirely online.
You are being monitored over the Internet through your computer via your webcam and microphone during your online assessment. START candidates and assessors will log on to the assessment platform through the internet to undertake the assessment.
You will be monitored in real time, during your entire assessment session so that your face, voice, desk and workspace will be captured.
It is your responsibility to ensure that only you will be on camera during an assessment and that no one else will be physically in the room where you are testing and that no one speaks to you during your testing sessions.
Professional Role Players may also collect and record further information about you when you take the assessment such as:
- Your name, email address
- ID photo/government issued ID and START assessment document,
- Physical (visible) health /condition, racial/ethnic origin/religious beliefs
- IP address, browser agents, browser and operating system identifiers,
- Your exam setting (home, office etc),
- Name of the assessment you are taking and other assessment based data that may be collected, including information about browser version etc.
- Assessors
-
Most of the data we process about you comes from your original application to act as an assessor.
Professional role players may also collect and record further information about you when you conduct the assessment such as:
- Your name, email address
- IP address, browser agents, browser and operating system identifiers,
- Name of the assessment you are conducting and other assessment based data that may be collected, including information about browser version, etc.
Why we collect this data
- Candidates
-
UK GDPR requires a legal basis for any processing of personal data. Our legal bases for processing your data are:
- "Public Task" - where we process your data in the public interest
- "Contractual Obligation" - where we need to process your data to enter into or fulfil a contract with you. The START Assessment is an online assessment and we, therefore, cannot provide the assessment without collecting this data.
The video and audio recordings are standard test procedures for our online invigilated tests and your video and audio recording will be, where necessary, used for purposes of:
- Enabling access to the Osler platform (contractual obligation)
- Confirming your identity and eligibility to take the exam (public task)
- Physical (visible) health /condition, racial/ethnic origin/religious beliefs (contractual obligation)
- IP address, browser agents, browser and operating system identifiers (contractual obligation)
- Your exam setting (home, office etc) (contractual obligation)
- Assessment session such as IP address and assessment timestamp (contractual obligation)
- Assessors
-
UKGDPR requires a legal basis for any processing of personal data. Our legal bases for processing your data are:
- "Contractual Obligation" - where we need to process your data to enter into or fulfil a contract with you. The START Assessment is an online assessment and we, therefore, cannot provide the assessment without collecting this data.
The video and audio recordings are standard test procedures for our online invigilated tests and your video and audio recording will be, where necessary, used for purposes of:
- Enabling access to the Osler platform (contractual obligation)
- Confirming your identity and eligibility to assess the exam (public task)
- IP address, browser agents, browser and operating system identifiers (contractual obligation)
- Assessment session such as IP address and assessment timestamp (contractual obligation)
How long we keep your data
Any assessment remote video recordings are retained for six weeks from the end of the exam, unless there is an investigation or concern which requires the video to be kept for longer.
For more information on how your personal information is processed for online invigilation, please see the Osler Privacy Policy, linked below.
Who we share your data with
When you agree to online invigilation, video recordings of your assessment, as well as image capture, will be supplied to Osler (Professional Role Players) and RCPCH, to assist with the management of your assessment and for audit purposes. As part of the provision of the service you agree that some or all of the above personal data may be processed outside the UK and EEA. In such circumstances, and if you are based in the UK or EU, Osler will, as required by GDPR, ensure that your privacy rights are protected by appropriate safeguards, such as EU model contract clauses.
We share telephone numbers of START candidates with assessors and training assessors during a START assessment. This is so assessors can use them as back up should the system fail with audio issues.
Understanding GDPR and your data rights
To help you understand more about the information in this and all our privacy notices, see our page, Understanding GDPR and your data rights. This explains common words and phrases used in our privacy notices, describes our use of artificial intelligence (AI) and details the rights you have in relation to the processing of your personal data under UK General Data Protection Regulation (UK GDPR).
We undertake end-to-end tracking of exam user journeys so that we can monitor and make improvements to our exams. This includes information about what pages you visit, how long you are on the site, how you got here and what you click on. We also use cookies for authentication purposes and to validate an active browsing session.
Security
Our systems will have appropriate security measures in place to protect against the loss and alteration of your information. Any documents/data sent to you from the RCPCH become your responsibility. RCPCH cannot be held responsible for the security of data copied to and held outside of its systems or its accuracy. Such information should only be accessed from a secure computer and/or held in a safe place.
Changes to this privacy notice
We keep our privacy notice under review, and we will place any updates on this web page.
Last updated 2 December 2025