Data protection
This page describes how the app is designed. It is not legal advice. Your own data protection officer or adviser should decide whether and how you use Zapier with personal data, and your Hub terms and data processing terms apply as usual.
Who is responsible for what
When you connect Zapier, you decide to send your own Hub data to Zapier and on to whatever other apps your Zaps use. Zapier says it acts as your processor for the personal information in your Zaps. Healthier Business does not receive or store your Zap data: the app runs on Zapier, calls the Hub with your key, and keeps nothing of its own.
Flow | Started by | What the Hub does |
|---|---|---|
A Zap step calls the Hub API with your key | Your Zap | Serves your own data to your own key, as for any API key. |
The Hub posts a webhook to Zapier | The Hub, on a subscription your Zap made | Sends the event to the address you registered. |
The app's code runs on Zapier | Zapier | Zapier's own logs may show what the app sent, see below. |
What is never sent to Zapier
The app returns a fixed list of fields for each step, an allowlist, so a field the Hub adds later is not passed on until someone decides it should be. These are never in a trigger, action or search result:
Health and criminal-record data. There are no Occupational Health, DBS or Right To Work steps or events at all, and a key that can read them cannot connect.
Assessment results. Interview outcomes, scores and reports, and appraisal evaluation reports. A reference's answers, scores and a referee's email address, phone number and answers.
Phone numbers, dates of birth, NMC numbers and free-text notes, restrictions, compliance officer and specialties of a candidate or monitored registration.
Links. Invitation links, submission links, payment links and meeting links. Only the public booking page address (a Hub page, neither secret nor one-time) is returned, and a payment link or an invitation link only when you tick the box for it.
Video meeting ids and passwords.
Matched certificate records of a training verification, the address a notification goes to, interview report flags and the Hub's credit package prices.
The Hub's DBS and Right To Work blocks in a candidate record.
Only two things of that kind remain, each with a written reason in the app: the venue address of a practical training session (a booking is about where to go), and the registration number (the regulator PIN) of a monitored registration.
What is passed on
Be clear about this when you decide who can see a Zap.
Names and email addresses of candidates are returned by candidate steps (Find Candidate, New Candidate, Create Candidate) and, with Include details, by the booking, reference, registration and training triggers. Training Verification events carry the candidate name whether or not you tick anything.
References to a candidate (the Hub's candidate reference) are in almost every event. It is an id, but anyone with the Hub could look the person up.
What you type or map into an action is sent to the Hub, for example a referee's name and email in Create Reference Request, or a date of birth in Add Registration to Monitor. Those are other people's personal data: map them from your own system instead of typing them into the Zap.
Your credit balances and booking money balances are returned by the balance actions.
Whatever you pass to the next app in a Zap then belongs to that app's rules.
Why Occupational Health, DBS and Right To Work are out
Zapier's data terms say its service is not designed for sensitive information, and name health data, biometric data and criminal records, and ask customers not to submit them. A result such as cleared or new information attached to a candidate is itself sensitive, even with no name. Those terms bind every Zapier user, whether or not an app is public. So the app has no step for them, ignores the events about them, and refuses to connect with any key that can read them (including a full access key). Assessment results and reference answers are left out for a related reason: they are opinions and scores about a named professional.
If you need Occupational Health automation, use the Hub API and webhooks from your own server, where your own data protection assessment applies. The Hub SDK is the way to start.
Logging
The app writes to Zapier's log only the step name, the HTTP status, the Hub request id, how many calls remain in the hour and counts. It never writes inputs, outputs, response bodies, emails, candidate references or keys. A test of the app fails if it would, so the rule is checked. The API key field is a password field, so Zapier masks it in its own logs.
Zapier keeps its own records of your runs, the Zap history, with the data each step received and sent. How long it keeps them depends on your Zapier plan: see Zapier's documentation. Delete runs in Zap history, or use the data-retention settings your plan offers, if a Zap handles personal data.
The Hub keeps a request log of every call your key makes, as it does for any key. Calls made by the app carry the source
zapier/0.1.0 and the step name, so you can filter everything Zapier did. In a sandbox the console shows it under Request log (filter by Made by).Zapier cannot verify that a message came from the Hub
The Hub signs every webhook with a secret. Zapier cannot check that signature: the app would have to store the secret and read it back on every delivery, and Zapier does not allow that. So the app discards the secret, and an instant trigger's address is the only protection. The address is long and unguessable, but it is not a managed secret, and anyone who learns it could post a fake event to that one Zap.
The remedy is the Include details choice (see Triggers): the Zap then reads the record from the Hub, so a made-up message cannot make a Zap act on invented data. Turn it on for any Zap whose later steps do something consequential, such as starting access or approving a renewal.
Calls, limits and what Zapier does on 429
Limit | Value |
|---|---|
Calls per key per hour | Set when you create the key (1,000 by default). Every response carries X-RateLimit-Remaining. |
Key exchange | 10 a minute. The app exchanges a key once per hour and when Zapier retries after a 401. |
Practical Training | A further limit of 120 calls a minute for each access token, not for each address, so other Zapier users' traffic does not count against you. |
Webhooks | Not counted against the hourly limit. |
When the Hub answers 429, the app turns it into a Zapier throttle: Hub is rate limiting this key (rate_limited). Zapier will retry shortly. Zapier waits for the number of seconds in the Hub's
Retry-After header (one minute if there is none, at most an hour), plus a few seconds chosen at random so that many Zaps do not all return together, and then tries again. Three kinds of 429 are not retried, because retrying cannot help or would make it worse: the daily credit cap and daily start cap of the key (nothing was charged or started) and the hold limits too_fast, client_limit and ip_limit. See Troubleshooting.Give each connection its own key so a runaway Zap cannot use the limit of another system.
Keys, IP lists and revoking access
One key for Zapier alone. Name it, scope it narrowly and give it an expiry date. See Connect the app.
Do not allowlist addresses on a Zapier key unless you must. Zapier's addresses are shared. If you do, add Zapier's two ranges (44.214.195.64/28 and 18.246.81.208/28); Zapier offers them only on paid accounts, so a free account's calls would fail with The key has an IP allowlist and Zapier's address is not on it.
To revoke everything, delete or switch off the key on the Developer page. All its tokens stop at once.
To stop events only, delete the webhook endpoints named
Zapier: … on the Webhooks page. Events stop at once.Deleting the connection in Zapier does not revoke the key. Delete the key as well.
The invitation link only adds the app to a Zapier account and gives no access to Hub data. Do not post it publicly, but a leaked link does not expose anything: the Hub, not Zapier, is the access control, and nothing flows without a valid key. If you suspect a key has leaked, delete it.
Was this page helpful?