Legal

Privacy Policy

Last updated 16 August 2026

In short: CarerHR is HR, hiring and compliance software built for UK domiciliary care agencies (each, a “Tenant”). For the day-to-day people data a Tenant puts into the platform — their employees, job applicants, and the clients they care for — that Tenant is the data controller, and CarerHR acts as their data processor, only using that data to provide the service and following the Tenant’s instructions. For the account, billing and marketing data CarerHR collects directly (a Tenant’s admin contacts, or a visitor to this website), CarerHR is the controller. The rest of this page explains both roles in detail.

Who we are

CarerHR (“CarerHR”, “we”, “us”) provides a white-label recruitment, HR and compliance platform for UK domiciliary care agencies, at carerhr.com and each Tenant’s own branded subdomain or custom domain.

[Registered company name, company number, and registered office address to be added here before this policy is treated as final.]

Data we process as a processor, on a Tenant’s behalf

When a care agency uses CarerHR, we process the following categories of data strictly on that Tenant’s instructions, to provide the features they’ve chosen to use:

Job applicant data — name, contact details, right-to-work status, and answers submitted through a Tenant’s careers site.
Employee records — contact details, employment details, branch/role assignment, and documents uploaded to the platform.
Compliance and DBS data — Disclosure and Barring Service check results and history, right-to-work checks, and other compliance-record types a Tenant configures. This can include special category data (criminal offence data) and is handled under stricter safeguards than ordinary personal data, retained on an append-only basis for audit and CQC-inspection purposes.
Client (care-recipient) records — where a Tenant uses CarerHR to track compliance checks relating to the people they care for.
Leave and HR records — leave requests, balances, and related approval history.
Signed documents — documents sent for e-signature, the resulting signed PDF, and an audit trail of who signed what and when.

If you are an employee, applicant, or client of a care agency using CarerHR and want to exercise a data protection right over this data, please contact that agency directly — as the data controller, they are responsible for responding to your request. We support them in doing so.

Data we process as a controller

Separately, we act as the controller for data we collect to run our own business:

Account and billing contacts — name, email, and role of the people who sign up for and administer a Tenant’s CarerHR account, plus billing details processed for us by Stripe (we do not store card numbers ourselves).
Marketing site usage — pages visited and basic device/browser information when you visit carerhr.com, and any details you submit through a demo-request or contact form.
Support and correspondence — anything you send us directly, e.g. by email.

Who we share data with

We use a small number of specialist providers (“sub-processors”) to run the platform, each engaged under a data processing agreement:

Supabase — database, authentication, and file storage.
Cloudflare — hosting and content delivery.
Stripe — subscription billing and payment processing.
Brevo — transactional and reminder email delivery.

We do not sell personal data, and we do not share Tenant data with other Tenants or use it to train third-party AI models. Some of these providers may process data outside the UK/EEA; where that happens, it is covered by their own standard contractual safeguards.

How long we keep data

General account and HR data is kept for as long as a Tenant’s account is active, plus a reasonable period afterwards to meet legal and accounting obligations. Compliance and DBS-related records are kept for longer, append-only retention periods reflecting UK care-sector audit and CQC-inspection requirements — a Tenant does not have the option to delete these outright, only to correct or supersede them, since the record of a check having taken place is itself the compliance evidence.

Your rights

Under UK GDPR you have the right to access, correct, or (in some cases) ask us to erase your personal data, restrict or object to its processing, and receive a portable copy of it. Where a care agency is the controller of your data, please raise this with them directly in the first instance. Where CarerHR is the controller (see above), contact us using the details below. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) at any time.

Cookies

We use a minimal set of cookies required to keep you signed in and to remember basic preferences. We don’t use third-party advertising or tracking cookies.

Changes to this policy

We’ll update the date at the top of this page whenever this policy changes, and for material changes we’ll let active Tenants know directly.

Contact

Questions about this policy, or a data protection request: info@carerhr.com.