Privacy Policy

1. Who we are

UK CARE NEST LTD, trading as Care Nest, is a nursing and healthcare recruitment and staff-supply agency based in London. We are the "data controller" of the personal data described in this policy.

Registered office and contact: Office 18, 241e High Street North, London, England, E12 6SJ. Email contact@carenest.co.uk. Telephone 020 3929 7608. Company number 14517661.

2. How your data is stored, and what we do not do

Your information is held in secure, access-controlled cloud systems: an encrypted database for records and private, encrypted file storage for uploaded documents. Documents are never public; only authorised staff can open them, using short-lived links.

We do not use your information for advertising, we do not sell it, and we do not share it with data brokers. We do not keep it in public places, and nothing you type into a form is saved in your browser.

Our website does not use advertising cookies, analytics trackers or social-media tracking pixels. The only cookie we set is a strictly necessary sign-in cookie for our own staff (see our Cookie Policy).

The technology providers we use may be part of international groups. Where personal data could be accessed outside the UK, we rely on the UK's approved safeguards (adequacy regulations or the International Data Transfer Addendum).

3. What we collect

We only ask for what we need to register, check and place you, and to run our service.

• Identity and contact details: name, date of birth, phone, email, preferred time to call, photograph.
• Right-to-work and compliance information: passport and/or BRP, National Insurance number, DBS certificate details, training certificates, NMC PIN for nurses, work history/CV (optional).
• Employment details: role, care-home experience, availability, holidays, shifts worked, timesheets and notes made by our staff.
• Optional information: Covid-19 vaccination status and bank statement. These are optional, and we explain why we ask at the time. Vaccination status is health information (special category data); you can choose not to tell us.
• Care-home clients: contact name, role, email, phone and your staffing requirements.
• Website messages and requests: what you write to us and your contact details.
• Technical and security data: IP address, browser/device type, the page you submitted a form from, and timestamps (for security, fraud prevention and keeping the service running). Staff sign-in and activity logs are kept for security.

We do not knowingly collect information from anyone under 18. If you are under 18 please do not register; if we learn that we hold such data we will delete it.

4. Why we use it, and our lawful basis

• To assess your registration, verify identity, right to work and suitability for care roles, and to place you with care homes. Basis: steps at your request before a contract, and our legal obligations (for example right-to-work and safer-recruitment checks).
• To manage rotas, availability, shifts, timesheets and pay-related records. Basis: performing our contract with you and legitimate interests in running the agency.
• To respond to enquiries and messages. Basis: legitimate interests, and steps at your request.
• To keep the service secure, prevent abuse and keep audit records. Basis: legitimate interests and legal obligations.
• Health information you choose to give (vaccination status): only with your explicit consent, which you can withdraw.
• Birthday greetings sent to staff: legitimate interests; you can ask us not to.

We do not make decisions about you by solely automated means.

5. Who we share it with

We share personal data only when needed:

• Care-home clients you may be placed with (for example your name, role, relevant training and compliance status).
• DBS and similar checking services, and professional bodies such as the NMC, where checks are needed.
• Our technology and service providers (processors), who host, secure and support our systems, store files and deliver messages sent from the contact form. They act only on our instructions and under contract.
• Address and postcode look-up services used by our staff to show locations on a map. They receive the postcode or address, never names or other details.
• Regulators, the police, courts and our professional advisers where the law requires or allows it.

We do not sell personal data and we do not share it with advertisers or data brokers.

6. How long we keep it

• Registrations that are rejected are removed from active use after 6 months, and registrations never progressed after 12 months. Removed records stay in a 30-day recycle bin and are then permanently deleted, including their files.
• Records of people who work with us are kept while you are registered and for the period needed for employment, tax, safer-recruitment and legal-claim purposes, then deleted.
• Records you or we delete go to a 30-day recycle bin and are then permanently deleted, including all files in storage. When a document is replaced or deleted, the previous copy is kept for 30 days and then permanently deleted (or deleted immediately if we choose to).
• Security and audit logs are kept for 3 years. Spam-prevention counters are kept for 2 days.
• Website messages are kept for as long as needed to deal with them and then deleted.

7. Security

Data is encrypted in transit (HTTPS) and at rest; identity numbers are additionally encrypted in our database and hidden on screen. Access is limited to authorised staff by role, sensitive documents need approval or a re-entered password, uploads are checked, and all access is logged. No system is perfectly secure; if there is a breach that is likely to risk your rights we will tell you and the ICO as the law requires.

8. Your rights

Under UK GDPR you can ask us to: see the data we hold about you; correct it; delete it; restrict or object to our use; receive a copy in a portable format; and withdraw consent at any time. You can also unsubscribe from any marketing at any time.

Use our Data Request page (/data-request) or email contact@carenest.co.uk. We may need to verify your identity, and we reply within one month. There is no fee unless a request is clearly unfounded or excessive.

If you are unhappy, please contact us first. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

9. Cookies and other technologies

See our Cookie Policy. In short: only strictly necessary cookies, no analytics or advertising cookies.

10. Marketing emails

We do not currently send marketing emails. If we ever do, we will only send them with your consent (or as the law otherwise permits), each email will include a working unsubscribe link, and you can opt out at any time via the Data Request page.

11. Links to other sites

Our site links to @ukcarenest on Instagram, Google and WhatsApp. Those services have their own privacy policies and we are not responsible for them. We only link out; we do not load their scripts on our pages.

12. Changes

We will update this policy if what we do changes and show the date above.