Recruitment privacy notice

1. Controller and contact

Treat Health Oy (business ID 3618620-6), Helsinki, Finland.
Questions about your data and requests to use your rights: privacy@treat.health.

2. What data we process

• What you write in the form: your GitHub username, email address and message.
• The language of the form and the time you sent the application.
• From GitHub, when you send the application: the public SSH keys on your account and the date the account was created. We use them only to check your signature and the account's age. They are kept, with your GitHub username, in Cloudflare's cache for up to one hour so that a retry does not need GitHub again, and are then discarded. GitHub, Inc. learns that Treat looked up your account.

The challenge itself sees your GitHub username, which is checked and then forgotten when the connection closes. The flag and its signature are checked when you apply and are not stored.

Your IP address and browser signals are processed for a moment to prevent automated misuse (rate limiting and the Cloudflare Turnstile check). We do not store them with your application. The site uses no analytics or advertising cookies.

Please do not send health information or other special categories of personal data. If you do, we delete it.

3. Why we process it and on what legal basis

• Assessing your application and contacting you about it. Steps taken at your request before a possible employment or service contract (GDPR Article 6(1)(b)).
• Protecting the form against bots and abuse. Our legitimate interest in keeping the service secure (GDPR Article 6(1)(f)).
• Keeping applications for the retention period. Our legitimate interest in being able to show that the recruitment was fair if it is questioned (GDPR Article 6(1)(f)).

We collect data mainly from you, as the Finnish Act on the Protection of Privacy in Working Life requires. By sending the application you ask us to read the public details listed above from your GitHub account. We collect information from other people, such as references, only with your consent.

The form automatically refuses an application whose flag or signature does not verify, whose GitHub account is younger than two years, or that comes from a GitHub account which already applied in the last 180 days. You can ask a person at Treat to review such a refusal by writing to privacy@treat.health. Every application that passes is read by people; no hiring decision is made by automated means.

The challenge is designed to be solvable with a terminal, screen readers and AI tools. Because of the overwhelming amount of applications, we don't have the resources to accommodate the challenge format for now. Thanks for your interest.

4. Who processes the data

Only the Treat employees who take part in the recruitment read applications. We use these service providers, who process data on our behalf under a data processing agreement:

• Cloudflare, Inc.: hosting the form, storing applications in a database located in the European Union and the Turnstile bot check. Cloudflare's network may process connection data outside the EU and EEA. Those transfers rely on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
• Slack Technologies, LLC: our internal messaging, where the people involved in recruitment discuss applications in a private channel. Slack may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. The automatic notice of a new application contains no personal data.
• Our email service provider, when we correspond with you.

We do not sell or otherwise hand over your data.

5. How long we keep it

We delete an application automatically 24 months after it was sent. Claims of discrimination in recruitment can be brought within the time limits of Finnish equality and non-discrimination law, and the retention period lets us respond to them. If you ask, we delete your application earlier, unless we must keep it because of a claim already raised. If we hire you, the data needed for the employment moves to our personnel records.

6. Your rights

You may request access to your data, correction of inaccurate data, erasure, restriction of processing and a copy of the data you gave us in a machine-readable format. You may object to processing based on our legitimate interest. Send requests to privacy@treat.health; we answer within one month.

You may also lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

7. Security

Applications travel over an encrypted connection and are stored encrypted. Only the people involved in recruitment can read them, each through a personal user account.

8. Changes

We update this notice when our processing changes. The date at the top shows the latest version.