GDPR Policy

Vital Hands is committed to protecting personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable UK laws. This GDPR Policy (also serving as our comprehensive Privacy Notice and Data Protection Policy) explains our practices for processing personal data as a data controller.

Company Details Vital Hands Limited Company number: 16647582 Registered office: 68 Nottingham Road, Eastwood, Nottingham, United Kingdom, NG16 3NQ

Contact for privacy matters Data Protection Lead Email: privacy@vitalhands.co.uk Post: 68 Nottingham Road, Eastwood, Nottingham, United Kingdom, NG16 3NQ

Effective date: 11 February 2026 (last reviewed/updated)

1. Scope and Who This Applies To

This policy covers all personal data we process through:

  • Our website (vitalhands.co.uk and subdomains)
  • The Vital Hands mobile app (iOS/Android)
  • Platform interactions (registration, shift posting/applying, communications)

It applies to:

  • Care home providers (and their managers/representatives)
  • Care professionals (care assistants, senior carers, nurses, etc.)
  • Website visitors and general enquirers

We act as the data controller. We do not act as a processor for third parties unless explicitly agreed in writing.

2. Personal Data We Collect

We collect only data necessary for operating a secure, compliant staffing marketplace in the care sector.

From Care Home Providers / Representatives:

  • Identity & contact: name, job title, email, phone, care home name, address, CQC registration details (if provided)
  • Account & preferences: login details, shift requirements, compliance preferences
  • Financial (limited): billing/payment info if platform fees apply
  • Usage: shift postings, approvals, messages, reports

From Care Professionals:

  • Identity & contact: name, date of birth, email, phone, address
  • Professional & verification: qualifications, training certificates, DBS certificate details/number/date, right-to-work status, experience/specialisms (e.g., dementia, nursing)
  • Profile: availability, optional photo, shift history
  • Usage: applications, acceptances, ratings/feedback received

From All Users:

  • Technical: IP address, device ID/type, browser/app version, approximate location (for shift matching)
  • Usage & analytics: logins, interactions, timestamps

Special Category Data & Criminal Convictions Data

  • We may process special category data (e.g., health-related information if disclosed in DBS context or shift notes) and criminal offence data (DBS disclosure details).
  • This is strictly limited to what is necessary for safe staffing in regulated social care (assessing suitability for roles with vulnerable adults).
  • We do not process health data of residents/service users — only incidental data related to staff suitability.

3. How We Collect Data

  • Directly from you (registration, profile uploads, shift interactions, enquiries)
  • From third parties (e.g., official DBS checking services for verification)
  • Automatically (cookies, device info — see our separate Cookie Policy)

4. Purposes and Lawful Bases for Processing

We process data lawfully under UK GDPR Article 6, with additional conditions for special category/criminal data under Article 9/10.

Main Purposes & Bases:

  • Performance of a contract (Art. 6(1)(b)): Providing the platform, matching shifts, managing accounts, facilitating shift confirmations/tracking.
  • Legitimate interests (Art. 6(1)(f)): Platform improvement, fraud prevention, analytics, direct marketing (non-sensitive, opt-out available) — balanced via LIA where needed.
  • Legal obligation (Art. 6(1)(c)): Compliance with safeguarding, CQC, employment/right-to-work laws.
  • Consent (Art. 6(1)(a)): Optional features (e.g., marketing emails, profile photos) — freely given and withdrawable.

Special Category & Criminal Data (Art. 9/10):

  • Employment, social security, or social protection law (Art. 9(2)(b)) — necessary for assessing fitness for care roles.
  • Substantial public interest (Art. 9(2)(g)) — safeguarding vulnerable adults in regulated social care.
  • Health/social care provision (Art. 9(2)(h)) — where relevant to suitability.
  • Criminal data: Authorised under employment law or substantial public interest (Schedule 1 DPA 2018).

5. Sharing Personal Data

We share data only as necessary:

  • Between platform users: Providers see relevant professional profiles (name, experience, DBS status, ratings); professionals see shift details.
  • Service providers: UK/EEA cloud hosting, payment processors, DBS verification partners (with contracts ensuring UK GDPR compliance).
  • Regulators/authorities: CQC, ICO, police (if legally required).
  • We never sell data or share for unrelated marketing.

6. International Transfers

Data is primarily stored/processed in the UK or EEA. Any rare transfers outside use UK-approved safeguards (e.g., adequacy decisions or IDTA/standard contractual clauses).

7. Data Retention

  • Active accounts: Retained while needed for service + reasonable post-termination period.
  • Inactive profiles: Deleted after 2 years inactivity (unless legal requirement).
  • Shift/compliance records: Retained for up to 6–7 years for audit, tax, or legal purposes.

8. Your UK GDPR Rights

You have the right to:

  • Access your data (subject access request)
  • Rectify inaccurate/incomplete data
  • Erase data (right to be forgotten — where applicable)
  • Restrict processing
  • Object to processing (e.g., legitimate interests or direct marketing)
  • Data portability
  • Withdraw consent (where used)
  • Not be subject to solely automated decisions with legal/significant effects

To exercise rights: Email privacy@vitalhands.co.uk. We respond within one month (extendable if complex). No fee unless manifestly unfounded/excessive.

Complain to the ICO: ico.org.uk/make-a-complaint | 0303 123 1113.

9. Security Measures

We implement appropriate technical and organisational measures:

  • Encryption (in transit/rest)
  • Access controls & regular testing
  • Breach notification procedures (to ICO/users where required)

10. Children’s Data

Our services are not directed at children under 18. We do not knowingly collect data from minors.

11. Changes to This Policy

We review and may update this policy. Changes posted here with new date. Material changes notified via email/app notice.

12. Contact

privacy@vitalhands.co.uk Vital Hands Limited 68 Nottingham Road, Eastwood, Nottingham, NG16 3NQ

Thank you for trusting Vital Hands. We are dedicated to transparent, secure data handling to support safe, reliable care staffing across the UK.