Privacy Policy

The data controller for personal data processed on the CareShift platform is:

We collect the following categories of personal data:

We process your personal data on the following lawful bases under UK GDPR:

• Contract performance — to provide you with access to the Platform and our Services
• Legal obligation — to comply with employment law, tax obligations, and anti-money laundering requirements
• Legitimate interests — to improve the Platform, prevent fraud, ensure platform security, and send relevant product updates
• Consent — for marketing communications and non-essential cookies (which you may withdraw at any time)

We use your personal data to:

• Create and manage your account
• Match you with relevant shifts or workers
• Verify compliance documents and professional credentials
• Process payments and generate invoices
• Facilitate communication between platform users
• Provide customer support
• Send transactional notifications (shift confirmations, compliance alerts)
• Detect and prevent fraud, abuse, and security incidents
• Comply with our legal and regulatory obligations
• Improve the Platform through aggregated analytics

We do not sell your personal data. We share your data only:

• With Care Organisations and Agencies as necessary to facilitate shift placements you have agreed to
• With our trusted service providers who process data on our behalf (cloud hosting, payment processing, email delivery) under strict data processing agreements
• With regulatory authorities (HMRC, ICO, CQC) where required by law
• In the event of a corporate transaction (merger, acquisition), where we will notify you in advance

All third-party processors are contractually obligated to process data only as instructed and to maintain appropriate security standards.

Our platform infrastructure is hosted in data centres located in the United Kingdom and European Economic Area (EEA). Where data is transferred outside the UK/EEA, we ensure adequate safeguards are in place, including UK-approved Standard Contractual Clauses (SCCs) or adequacy decisions.

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to legal requirements:

• Active account data: retained for the duration of your account
• Shift and transaction records: 7 years (UK tax law requirement)
• Compliance documents: until expiry plus 12 months, or as required by law
• Audit logs: 2 years
• Deleted account data: anonymised or deleted within 30 days of account closure, except where retention is legally required

Under UK GDPR, you have the following rights:

• Right of access — request a copy of personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your data in certain circumstances
• Right to restrict processing — ask us to pause processing of your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Rights related to automated decision-making — we do not make solely automated decisions with legal or significant effects

To exercise any of these rights, please email dpo@careshiftltd.com. We will respond within one calendar month. You also have the right to lodge a complaint with the ICO at ico.org.uk.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include end-to-end encryption, role-based access controls, regular security assessments, and staff data protection training.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware, as required by UK GDPR.

We use cookies and similar tracking technologies on our platform. For full details, see our Cookie Policy.

We may update this Privacy Policy periodically. We will notify you of material changes by email and in-platform notification. The date of the most recent update is shown at the top of this page.

For data protection enquiries, contact our Data Protection Officer: dpo@careshiftltd.com

CareShift Ltd, 1 Canada Square, Canary Wharf, London, E14 5AB, United Kingdom