Candidate Privacy Notice

Who are we?

We are Oviva – a digital health company on a mission to make better health outcomes accessible to everyone. We operate through the following entities:

• Oviva AG – Zürcherstrasse 64, 8852 Altendorf, Switzerland
• Oviva AG (German Branch) – Dortustraße 48, 14467 Potsdam, Germany
• Oviva Limited – Runway East, 150 Borough High Street, London SE1 1LB, United Kingdom
• Oviva sp. z o.o. – Skyliner 67, 00-838 Warszawa, Poland

These are collectively referred to as “Oviva”, “we”, “us”, or “our” throughout this notice. The data controller for your application will be the Oviva entity in the country the role is based in.

This notice explains what personal data we collect when you go through a hiring process with us, and how we use it – whether you’ve applied directly for a role, been approached by one of our recruiters, or been referred to us by an agency or a current Oviva employee.

Contact Details of Our Data Protection Officer

Email: privacy@oviva.com

Postal addresses are listed in section “Who are we”. Please direct any postal correspondence for the Date Protection Office to the relevant entity address, Attn: Data Protection Officer. 

What we collect about you

When you apply for a role or express interest in working at Oviva, we may ask for:

• Your name and contact details (address, phone number, and email)
• Your CV, cover letter, education history, and employment history
• The country you’re applying to work in, and your right-to-work status there
• Your responses to application questions and any take-home tasks
• Your current and desired salary, and any preferences around benefits
• Your current notice period

If we invite you to interview, we may also collect:

• Your availability and any special requirements or reasonable adjustments you need
• Notes and observations from interviews and assessments
• ID documents, proof of address, and national ID numbers for background checks
• Details of referees you’d like us to contact

We’ll also ask whether you’d like to share the following – this is completely voluntary and has no bearing on your application:

• Age
• Ethnicity
• Gender identity
• Sexual orientation
• Disability and neurodiversity status

We use this data in aggregated, anonymised form only, to track our DEI progress. It won’t be visible alongside your application.

Information we get from outside Oviva

We may also receive your details from:

• Recruitment or executive search agencies we work with
• Professional networking sites or other public sources, like LinkedIn or job boards
• Oviva employees who refer you for a role (with your permission)

If you’re offered a role, we’ll additionally collect:

• Background check results from our screening partners – which may include criminal record information, financial data, and immigration status, where permitted by local law
• References from previous employers, managers, or colleagues

How we use your information

Data protection law requires us to have a legal basis for using your personal data. Here’s what we rely on, and why.

Because we need it to enter into a contract with you (Art. 6(1)(b) GDPR / UK GDPR / Art. 30–31 Swiss FADP / § 26(1) BDSG [German Federal Data Protection Code])

• To contact you during the hiring process
• To assess your suitability for the role you’ve applied for
• To carry out right-to-work checks
• To run background checks where legally permitted
• To take up references and verify information in your CV

Because the law requires it (Art. 6(1)(c) GDPR / UK GDPR / Art. 30–31 Swiss FADP / § 26(1) BDSG [German Federal Data Protection Code])

• To confirm your right to work in the country the role is based in
• To run criminal background checks for regulated roles, where required by local law

Because it’s in our legitimate interest (Art. 6(1)(f) GDPR / UK GDPR / Art. 30–31 Swiss FADP)

• To assess your suitability for the role you’ve applied for, including using AI and non-AI tools to track applications, schedule interviews, and screen CVs efficiently
• To consider you for future roles at Oviva that might be a good fit
• To share your details with travel providers if you need to attend an in-person interview
• To improve our recruitment practices through anonymised analysis

These are our legitimate interests.

Because you’ve given us your consent (Art. 6(1)(a) GDPR / UK GDPR / Art. 30–31 Swiss FADP)

• To collect your diversity and inclusion data – voluntary, as described above
• To keep your details in our talent pool if your application is unsuccessful, so we can reach out about future roles
• To use AI for the purposes listed above

You can withdraw your consent at any time by emailing privacy@oviva.com. This won’t affect anything we’ve already done on the basis of your consent.

Actively sourced candidates

If one of our recruiters reaches out to you rather than you applying directly, you’ll receive a consent notice through our Applicant Tracking System (ATS) at the point of first contact. This explains how your data will be used and gives you the opportunity to confirm you’re happy for us to proceed.

How we use AI

We may use AI tools to support our recruitment process – for example, to help screen applications, summarise interviews, or assist with scheduling. This is based both via opt-in consent and on our legitimate interest in running an efficient and fair process.

AI is used to support our recruiters, not to replace them. Any significant decisions will always involve a human. You have the right to object to our use of AI in relation to your application – see “Your rights” below.

Who we share your data with

We only share your data with people and organisations who have a genuine need to access it.

Internally

• Our recruitment and HR teams
• Hiring managers and interviewers for your role
• IT and systems administrators

Externally

• Our ATS and recruitment software providers
• Background screening partners, where applicable and permitted by law
• Recruitment or executive search agencies engaged for the role
• Cloud infrastructure and data storage providers
• Travel providers, if you need to travel for an interview
• Legal, compliance, or regulatory authorities where disclosure is required

All external parties who handle your data on our behalf are bound by data processing agreements and may only use your data for the purposes we’ve set out.

How long we keep your data

Unsuccessful candidates

If your application is unsuccessful and you haven’t opted into our talent pool, we’ll keep your data for up to 24 months after we close the hiring process. We need to keep a record of applications in case we face a legal challenge, and to consider you for similar roles in the near term.

Proactive renewal

Before the 24-month period expires, we’ll contact you to give you the opportunity to provide fresh consent for us to hold your data for a further period. If we don’t hear from you, or if you choose not to renew, we’ll securely delete your data.

Talent pool

If you’ve opted into our talent pool, the same 24-month period applies from the date of your consent. We’ll contact you before it expires to seek renewed consent. You can ask us to delete your data at any time.

Successful candidates

If you join Oviva, some of your recruitment data will transfer to your employee file and be retained under our Employee Privacy Policy, which you’ll receive during onboarding.

Where we store and send your data

Your data may be processed outside your home country, including outside the European Economic Area (EEA), UK, or Switzerland. Unless a country is recognized as providing an adequate level of data protection (by an adequacy decision of the European Commission, UK Government, or Swiss Federal Council), we ensure appropriate safeguards are in place in accordance with applicable data protection laws (including EU GDPR, UK GDPR, and the Swiss Federal Act on Data Protection), e.g.: 

• Standard Contractual Clauses (SCCs): Standard Contractual Clauses approved by the European Commission, incorporating the necessary national addenda/modifications for transfers subject to UK data protection law (the UK Addendum) or Swiss data protection law (the Swiss Addendum).
• UK International Data Transfer Agreement (IDTA): The standalone transfer agreement approved by the UK Information Commissioner’s Office (ICO) for UK data transfers.

We also apply appropriate technical and organisational security measures alongside these legal mechanisms.

Your rights

You have the right to:

• • Access the personal data we hold about you
  • Receive a copy of your data in a portable, machine-readable format
  • Ask us to correct inaccurate or incomplete data
  • Ask us to delete your data – for legal reasons, we might not always be able to do so straight away, and we’ll explain if that’s the case
  • Restrict how we process your data in certain circumstances

• Object to our processing of your data, including any use of AI
• Withdraw consent at any time – this doesn’t affect any processing already carried out
• Ask a human to review any automated decision we’ve made about you

You also have the right to complain to your local data protection authority. We’d always prefer you to contact us first so we can try to resolve things directly.

UK: Information Commissioner’s Office (ICO) – ico.org.uk

Germany: The Land Commissioner for Data Protection and the Right to Inspect Files of Brandenburg  – https://www.lda.brandenburg.de/lda/de/

Switzerland: Federal Data Protection and Information Commissioner (FDPIC) – edoeb.admin.ch

Poland: Office for Personal Data Protection (UODO) – uodo.gov.pl

To exercise any of your rights, email privacy@oviva.com.

Does Oviva use automated-decision making in the recruitment process?

Oviva uses AI tools, but there is always a human in the loop for the final decision. Therefore, you are never subject to a decision based solely on automated processing in the sense of Art. 22 (1) (UK) GDPR or Art. 21 Swiss FADP.

Do you have to give us your data?

Providing your personal data is voluntary – but without it, we won’t be able to consider your application. We’ll always be upfront about what we need and why.

Changes to this notice

We review this notice regularly and update it when needed. The latest version will always be on our careers site and in our ATS. We’ll let you know about any material changes.