Data protection

Your agency is the controller of your staff’s personal data. It decides why their training and registration records are kept. Checked and Ready is the processor: we store and handle those records only to provide the service, and only on your instructions. These commitments form our data processing agreement and are part of our terms of service.

• People: your managers and care staff.
• Information: names, work contact details, roles, start dates, training dates, certificates, registration numbers and dates, and sign in activity.
• Why: to track training and registration, send reminders and produce reports for your agency.
• Not for: health records or other special category data. Please do not upload them.

• We only use your records to provide the service, never for our own purposes and never for sale.
• Everyone who can access them is bound by confidentiality.
• We protect them with the measures on our security page.
• We help you answer requests from your staff to see, correct or delete their information.
• We tell you without undue delay, and within 48 hours of confirming it, about any breach affecting your records.
• When your account closes, we return your records by export and then delete them, as set out on our data deletion page.
• We give you the information you need to show you meet your own duties, and answer reasonable audit questions.

These providers help us run the service. Each is bound by a written contract with the same level of protection we promise you.

We will tell account managers at least 30 days before adding or replacing a provider that handles your staff’s records, so you can raise any concerns.

Agency records are stored in the UK. Where a provider processes limited data elsewhere, such as the email address an invite is sent to, we use the safeguards UK data protection law requires.

If your agency needs a signed data processing agreement for your records or your regulator, email hello@checkedandready.com and we will send one to sign.