Privacy Policy

CarerLink provides staff compliance software to care agencies registered with the Care Quality Commission (CQC). This policy explains how we handle personal data.

Who is responsible

Each agency that uses CarerLink is the data controller for the staff records it keeps. CarerLink acts as a data processor and only uses that data to provide the service, under our Data Processing Agreement.

For the details of agency account holders (names, work emails, billing contacts), CarerLink is the controller.

What we hold

• Account details: name, work email, role, sign-in times.
• Staff records entered by agencies: employment details, training, supervision, DBS reference details, right to work checks and uploaded documents.
• Audit records of who changed what and when.

DBS information

By default we do not store copies or images of DBS certificates — only the certificate number, issue date, result and check date. An agency can choose to allow certificate uploads in its settings.

Security

• Data is encrypted in transit and at rest.
• Documents are kept in private storage and opened with short-lived links.
• Access is limited by role, and every change is recorded in an audit log.
• Support access to an agency's account is read-only and logged in that agency's audit log.

Retention and deletion

Agencies set how long each type of record is kept. Leavers are archived automatically after a configurable period (6 years by default). An agency's Owner can export all its data and request full deletion at any time.

Your rights

If you work for an agency that uses CarerLink, contact that agency first about access, correction or deletion of your records. We will help them respond. You can complain to the Information Commissioner's Office (ico.org.uk).

Contact

[Company name, registered address, ICO registration number and privacy contact email to be added.]