DPIA & Privacy Risk Assessment

Our approach to assessing privacy risks associated with the Evergreen platform and staffing services.

1. Areas Considered

• Identity and right-to-work verification.
• Professional registration and compliance records.
• DBS and occupational health/immunisation information.
• Practice and worker communications.
• Booking, timesheet and assignment-specific safety information, including worker acknowledgements.
• Location or GPS features where used.
• Account authentication and access permissions.
• Third-party processors and international data transfers.
• Data retention, deletion and individual rights.

2. Risk Controls

Risk assessments consider necessity and proportionality, access controls, data minimisation, retention, supplier safeguards, incident response and the rights of affected individuals. Higher-risk processing is subject to additional review where required.

3. Documentation

Evergreen maintains internal privacy and security records appropriate to its processing activities. Detailed internal assessments are not reproduced on this public page where doing so would disclose sensitive operational information.