Privacy policy

Checked and Ready helps care providers keep track of their staff’s training, certificates and registration. Our company registration details will be added here before we launch.

We have two roles under UK data protection law, depending on whose information it is:

• We are the controller for information about the people who run agency accounts, visit our website or contact us. This policy covers that information.
• We are the processor for the staff records an agency keeps in Checked and Ready, such as training dates and certificates. The agency is the controller and decides how that information is used. Our data protection page explains how we handle it for them.

For anything about your data, email us at hello@checkedandready.com.

• Account details: your name, work email address, password and the name of your agency. Passwords are stored in scrambled form, so nobody at Checked and Ready can read them.
• Two step sign in: a secret linked to your authenticator app, stored encrypted, so we can check your 6 digit codes.
• Agency settings: where you provide care, the courses you track and how often they renew.
• Billing details: handled by our payment provider once paid plans start. We never see or store your full card number.
• Messages to us: what you write in the contact form or by email, so we can reply.
• Technical details: your IP address, device and browser type, and the cookies needed to keep you signed in and protect our forms from spam.
• How you use the website: the pages you visit and roughly where you are (country or city), only if you allow analytics cookies. We never record what you type, and never record anything from inside an agency’s account for analytics.

UK data protection law says we need a lawful reason for each use. Ours are:

• To provide your account and the service, because it is needed for our contract with your agency.
• To keep accounts and records secure, for example spotting unusual sign in attempts. This is in our legitimate interests, and a legal obligation where the law requires it.
• To send service emails such as invites, reminders, sign in codes and password resets.
• To keep financial records that the law requires us to keep.
• To understand how the website is used and improve it, only with your consent where cookies are used.
• To send product news, only if you have said yes. You can change your mind at any time.

We never sell personal information. We only share what each of these needs to do its job:

• Supabase, which stores our database and certificate files and handles sign in, on servers in London.
• Vercel, which hosts the website and app.
• Cloudflare, which protects our forms from spam and our domain from attacks.
• Resend, which sends our emails, such as invites, reminders and password resets.
• PostHog, our website analytics provider, only if you allow analytics cookies. Its data is stored in the European Union.
• Our payment provider, once paid plans start.
• Police, regulators or courts, only where the law requires it.

We keep agency records in the UK. Some of our providers process limited data outside the UK, for example to send emails or count website visits. Where that happens, it is in countries the UK recognises as giving adequate protection, or we use the safeguards UK data protection law requires, such as approved contract terms.

We keep account details while your agency’s account is open. If the account is closed, we delete its records within 30 days, after giving the agency the chance to export them. Copies in our backups are removed within a further 30 days. The exception is billing records, which we must keep for up to 6 years for tax and accounting. Full details are on our data deletion page.

You have the right to:

• ask for a copy of the information we hold about you
• ask us to correct anything that is wrong
• ask us to delete your information, where we do not have to keep it by law
• object to, or ask us to limit, how we use it
• ask for your information in a format you can take elsewhere
• withdraw your consent to analytics or product news at any time

To use any of these rights, email hello@checkedandready.com. We will reply within one month. If you are a member of care staff, your agency controls your training records, so we will pass your request to them and help them answer it. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

We use essential cookies that the site needs to work, such as the ones that keep you signed in. Analytics cookies are only used if you allow them, and you can change your choice at any time in cookie settings. We do not use advertising cookies. Our cookie policy lists every cookie and what it does.

Your data travels over encrypted connections and is encrypted when stored. Our database is set up so each agency can only ever see its own records, and each member of staff only their own. No system is perfect, so if we ever find a breach that puts you at risk, we will tell you and the Information Commissioner as the law requires. Our security page has the details.

Checked and Ready is a service for care providers and their staff. Accounts are for adults aged 18 and over, and we do not knowingly collect information about children.

If we change this policy, we will update the date at the top. If a change affects you in a significant way, we will tell you by email before it takes effect.