CareNexa

Legal

Privacy Policy

Effective: 27 June 2026 · Version 1.0 · Maintained by CareNexa Ltd.

This notice explains how CareNexa Ltd ("CareNexa", "we") collects, uses, and protects personal data when you use our marketplace to book home visits with independent healthcare professionals. We process data under the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Who is the controller?

CareNexa is the controller for account, booking, payment, and platform-usage data. Independent professionals you book are separate controllers for the clinical records they generate during your visit. We are a joint controller only where we jointly determine purposes (e.g. safeguarding).

2. What we collect

  • Identity & contact: name, email, phone, password hash, optional photo.
  • Verification: regulator number, government ID (professionals only), KYC checks.
  • Bookings: appointment time, address, service type, free-text notes you provide.
  • Health-related data ("special category"): any symptoms or concerns you choose to share when booking or messaging. Processed under Article 9(2)(h) — provision of health care.
  • Payments: handled by our payment processor; we store only the last 4 digits and a token.
  • Technical: IP address, device, browser, and audit logs of who viewed sensitive files.

3. Legal bases

  • Contract — to deliver the bookings you request.
  • Legal obligation — record-keeping, anti-fraud, safeguarding.
  • Vital interests — sharing data when there is a risk to life.
  • Legitimate interests — platform security, abuse prevention.
  • Consent — marketing emails (you can withdraw anytime).

4. Retention

  • Booking records: 7 years (clinical record-keeping standard).
  • Verification documents: duration of your professional account + 6 years.
  • In-app messages: 12 months from the conversation's last activity.
  • Audit logs of admin file access: 2 years.
  • Marketing preferences: until you withdraw consent.

5. Sharing

We share data with the assigned professional, our payment processor, our verification partners, regulators where legally required, and law-enforcement when there is a safeguarding or court order. We do not sell personal data.

6. International transfers

Data is hosted in the UK / EU. Where a sub-processor is outside the UK, we rely on UK International Data Transfer Agreements or adequacy decisions.

7. Your rights

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. Submit a request via /data-rights. You can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

Data is encrypted in transit (TLS) and at rest. Access to sensitive documents is role-restricted, time-limited (30-second signed URLs), and audited. Passwords are hashed with industry-standard algorithms.

9. Cookies

We use strictly-necessary cookies for sign-in and CSRF protection, and optional analytics cookies you can opt out of in the cookie banner.

10. Contact

Data Protection Officer: dpo@carenexa.example.