Privacy Policy

Last updated: 9 November 2026

Medicare People (“we”, “us”, “our”) operates as a medical staffing agency and currently provides introductory live-in care services.

We are committed to protecting your personal information and ensuring your data is handled safely, securely, and in line with the UK GDPR and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, and protect your data when you use our services, register with us, or visit our website.

1. Who We Are

Medicare People Ltd provides introductory live-in care and healthcare staffing, supplying clinical staff to health and social care providers.

We act as the Data Controller for all personal information we collect.

Contact: our contact form or 020 3443 9844
Address: 86-90 Paul Street, London EC2A 4NE
ICO registration number: ZB960612

Our data protection contact is Stuart Wells, Director. You can reach him using our contact form, by phone on 020 3443 9844, or by post to Medicare People Ltd, 86-90 Paul Street, London EC2A 4NE. We have not appointed a Data Protection Officer, because the law does not require us to.

2. Information We Collect

We collect different types of information depending on whether you are a client, care recipient, family member, job applicant, worker, referee, or website visitor.

Candidates & clinical staff: name, contact details, address and postcode, date of birth, National Insurance number, right‑to‑work documents (which can show your nationality and immigration status), identity documents, DBS checks (including the certificate number), your answers to our criminal convictions declaration, references, training evidence, qualifications, vaccination status, your answers to our occupational health questionnaire, work history, availability, interview and screening notes, signed declarations and contract acknowledgements, your ID badge photo, bank details, shift records, timesheets, performance feedback.
Referees: your name, contact details, job title and the reference you give us about a candidate.
Live‑in care clients & families: personal details, contact information, care assessments, health information, risk assessments, medication information, GP details, next‑of‑kin information, care records, visit logs, communication history.
People who enquire about care: your name, contact details, postcode and anything you tell us about the care needed. This can include health information about you or the person you are enquiring for, so please only share what you are happy for us to use to help you.
Staffing clients: service contacts, booking details, invoices, communication logs, service requirements.
Website users: IP address, browser type, cookie information, form submissions, and how you found our website (for example the advert or search engine you came from, and the page you were on), which we record with any form you send us.

If you use the live chat on our website, your name, contact details and chat messages are stored in our own system (Sync) so our team can reply and keep a record of your enquiry. Please don’t share health details in the chat; our team can talk them through with you by phone. Chat messages are anonymised automatically 12 months after they are sent (see section 7).

3. How We Use Your Information

We use personal information to:

Provide medical staffing agency services
Arrange safe introductory live‑in care
Complete compliance and safeguarding checks
Assess suitability for employment or care roles
Manage bookings, care visits, rotas, and shifts
Maintain accurate care and clinical documentation
Record visit logs and care activity for record-keeping and compliance purposes
Process payroll and invoicing
Communicate service updates, opportunities, and enquiries
Comply with legal, regulatory, and safeguarding obligations

We do not sell or trade personal data.

Our system, Sync

Job applications, enquiries and website chats go straight from our website into Sync, our own recruitment, compliance, staffing and sales system. Our team uses Sync to deal with your application or enquiry, keep your compliance file, and arrange work and care.

Online forms, references and declarations

Instead of paper forms, we may email you a private link to complete a form online, for example our occupational health questionnaire, our criminal convictions declaration, the interview declaration, our privacy and consent form, your contract acknowledgement or the optional Working Time opt‑out. If you are a referee, we email you a private link to our online reference form.

Each link is for one person, works once and expires after 30 days. When you sign a declaration online, we keep a copy of the exact wording you signed, the time, and the IP address and browser you used, so we can show what was agreed.

Our occupational health questionnaire asks about your fitness for the work and your immunisations. A “yes” answer is never a reason on its own not to offer you work: it tells us to talk to you about support or adjustments, and staff or an occupational health adviser make any decision.

The worker portal

If you are a candidate or worker, you can sign in to our worker portal to upload documents, complete your forms, add referees, set your availability, view and accept shift offers, and submit timesheets. You sign in with a one‑time code that we email to you. Each code works once and expires after 10 minutes.

Emails we send automatically

Sync sends some emails automatically, and others when a member of our team chooses to send them, for example:

confirming that we have received your job application or enquiry;
your worker portal sign‑in codes;
the private links for references, questionnaires and declarations;
shift invitations that match your role, location and availability;
and, if you downloaded a guide and agreed to hear from us, a short series of follow‑up emails.

Marketing and follow‑up emails always include an unsubscribe link, and we stop as soon as you unsubscribe. Emails to you about your application, compliance or work are part of working with us.

Distance search

To find workers near a shift, or carers near a family, Sync works out the straight‑line distance between postcodes. To do this it sends the postcode only (no name or other details) to postcodes.io, a free UK postcode lookup service, and gets back the approximate location of the centre of that postcode.

Decisions are made by people

Sync helps our team by showing which documents are missing or about to expire and which workers match a shift. It does not decide whether to employ you, place you or offer you a shift. A member of our team always makes those decisions.

Carer profiles on our website

If you are a live‑in carer and you agree in writing, we may show a short profile with your first name, photo and a few words about you on our website. We never show your surname, contact details, checks or documents. You can ask us to remove it at any time.

4. Legal Basis for Processing

We process data under the following lawful bases:

Contract: providing care services or staffing
Legal obligations: safeguarding, right‑to‑work, payroll, care regulation
Legitimate interests: service delivery, business operations
Consent: marketing communications or optional information
Vital interests: protecting someone in a health or safety emergency

You may withdraw consent at any time.

Health, criminal records and other sensitive information

Some information is more sensitive and the law gives it extra protection. We only use it where we need to, and only for these reasons:

Health information about candidates and workers (occupational health answers, vaccinations, adjustments): to meet our obligations as an employer and agency, including health and safety, and for occupational health purposes (UK GDPR Article 9(2)(b) and (h), and the employment and health or social care conditions in Schedule 1 of the Data Protection Act 2018).
Criminal records information (DBS checks and your convictions declaration): because the roles we fill involve working with children or adults who may be at risk, and to meet our safeguarding and employment obligations (UK GDPR Article 10, and the employment and safeguarding conditions in Schedule 1 of the Data Protection Act 2018).
Right‑to‑work documents, which can reveal your nationality or ethnic origin: because the law requires us to check that you can work in the UK (UK GDPR Article 9(2)(b)).
Health information about people who need care: to arrange and provide health or social care (UK GDPR Article 9(2)(h)), or to protect someone’s vital interests in an emergency.

We may share information with:

Health and social care providers
Families or authorised representatives (for care services)
Background‑check and training organisations
Payroll and pension partners
Our finance partners, including our invoice finance provider (Bibby) and our accounting software (Xero)
Technology providers that run our systems on our behalf (see below)
Local authorities or safeguarding teams
Regulators and public bodies, such as the NMC or the DBS
Law enforcement when legally required

We only share what is necessary and always securely.

Technology providers (our processors)

These providers act only on our instructions, under contracts with data protection terms:

Render (Render Services, Inc.): hosts Sync, its database and its files in Frankfurt, Germany (European Union).
Microsoft (Microsoft 365): our team’s email and sign‑in to Sync. If we connect a team mailbox to Sync, emails between that mailbox and our candidates or clients are copied into Sync so we have a full record; other emails are not saved.
Mailgun, using its EU region: sends the emails from Sync and our website, such as confirmations, sign‑in codes, form links and, if you opted in, our follow‑up emails. You can unsubscribe at any time using the link in every marketing email.
postcodes.io: receives postcodes only, for distance search (see section 3).
Cloudflare: hosts our website. The forms you fill in on our website are sent straight to Sync.
Google (Google Tag Manager, Google Analytics and Google Ads): measures how people use our website and how well our adverts work, only if you accept cookies (see section 11). If you accept advertising cookies and send us an enquiry after clicking one of our Google adverts, we share a scrambled (hashed) version of your email address, phone number and name, with your postcode, with Google so it can tell us the advert worked; Google can’t read the original details.
Microsoft Advertising (Bing): measures how well our adverts on Bing work, only if you accept cookies (see section 11).
Meta (Facebook and Instagram): measures our adverts and, if you fill in one of our lead forms on Facebook or Instagram, passes your details to us so we can call you. On our website, Meta’s measurement runs only if you accept cookies (see section 11).
Anthropic: only if we switch on AI help with checking training certificates, which is not switched on at the moment (see section 6).
An AI image‑editing provider, only if you agree to the uniform edit of your badge photo (see section 6).

6. Data Security

We protect your data through secure encrypted systems, controlled access, and ongoing security monitoring. Our internal platform, Sync, tracks compliance, care documentation, and expiry dates in real time to maintain accuracy and safety.

Where your data is stored

Sync, its database and its files are hosted by Render Services, Inc. in its Frankfurt, Germany (European Union) region. The EU has a UK adequacy decision, and Render is certified under the UK Extension to the EU‑US Data Privacy Framework. If we move Sync to Microsoft Azure in the UK in the future, we will update this policy.

How we protect it in Sync

Encryption: every document you upload is encrypted by Sync before it is stored. The most sensitive details in the database are encrypted too, including DBS certificate numbers, National Insurance numbers, occupational health answers, convictions declarations, references, notes, and what people tell us about care needs in enquiries. Information travels over encrypted (HTTPS) connections.
Access on a need‑to‑know basis: each member of our team has a role in Sync that limits what they can see. Sensitive documents, DBS and National Insurance numbers, health answers and convictions declarations can only be opened by our compliance team and administrators. Sensitive numbers are partly hidden on screen unless someone with the right role chooses to reveal them, and that is recorded.
Secure sign‑in: our team signs in to Sync with their Microsoft 365 work account and multi‑factor authentication. Workers sign in to the portal with a one‑time code.
Audit trail: Sync records who viewed, changed, revealed or downloaded sensitive information.
Backups: the database and files are backed up automatically, so they can be restored if something goes wrong.

Checking training certificates

We have not switched this on yet. If we do, when a worker uploads a training certificate or qualification to Sync, an AI service (Anthropic) will read it to help our compliance team. It would check things like the name, course, training provider and dates, and highlights anything that needs a closer look. A member of our compliance team would always review the document and make the decision; the AI service would never approve or reject anything on its own.

We would not use this service for DBS certificates, right to work, identity or health documents, which are checked by our team only. The AI service would process documents on our behalf under a contract with data protection terms, and would not be allowed to use them to train its AI models. If you would rather your certificates were checked by a person only, tell our compliance team. We will update this policy before we switch it on.

ID badge photos

If you are a candidate or worker, we collect a head-and-shoulders photo of you to make your ID badge. Our team crops the photo and removes the background in Sync, inside our own web browser, without sending it to anyone else.

If you agree, we can also send your photo to an AI image-editing provider acting on our instructions under a data processing agreement, to change only your clothing to plain navy medical scrubs or a navy fleece top. We never change your face. Our team compares the before and after photos, and you can choose to keep your own clothing instead. We keep a record of your consent and of which provider was used.

Only the photo and a fixed instruction are sent to the provider: never your name or any other details. The provider will be OpenAI or Microsoft’s Azure OpenAI Service. We have not switched this feature on yet, and we will only use it once the provider’s data processing terms are in place.

We make your badge because we need it to arrange your work with us (contract) and to show who you are on shift (legitimate interests). We only use the uniform edit if you consent, and you can withdraw that consent at any time; we will then use your original photo instead. We keep your badge photo while you work with us, then for 6 years after your last activity, in line with our candidate worker records (see section 7). If the provider processes your photo outside the UK, we protect it with approved safeguards, such as the UK International Data Transfer Agreement (IDTA) or a UK adequacy decision.

7. Data Retention

We retain data only for the required period:

Care records: minimum 8 years
Candidate worker records: 6 years after last activity
Unsuccessful applicants: 6 months after our last contact or activity on your application, then anonymised. This covers applications that do not go further after the pre-screen or interview, or that we find not suitable. Your name, contact details, address, date of birth, NI number, documents, notes and answers are removed. We keep only anonymous details for statistics, such as the role, the stage reached, how you found us and the dates. If you ask us in writing to keep your details on file for future roles, we keep them until a review date we agree with you. If you have worked for us, the worker records period applies instead.
Criminal records information: we keep a record that a DBS check was done, with its date, certificate number and result, as part of your worker record. The copy of the certificate and any details of convictions are deleted 6 months after the recruitment decision, in line with our Criminal Records Check policy and the DBS Code of Practice.
Referees’ details and references: kept with the candidate’s worker record.
Enquiries that do not lead to us providing care or work: 2 years after our last contact with you. If you become a client, your enquiry is kept with your client records.
Website chat messages: anonymised automatically 12 months after they are sent. The message text, and your name and contact details in the chat, are removed.
Client business records: 6 years
Payroll/financial information: 6 years
Audit log (the record in Sync of who viewed or changed information): 6 years
Copies of emails sent by Sync (the email outbox): 12 months
Copies of Outlook emails saved in Sync: kept with the candidate’s or client’s record, for that record’s period
Worker portal sign‑in codes: 10 minutes, and each works only once
Automatic backups: kept for up to 7 days, then overwritten
Weekly database export kept in our company storage: 90 days
Website analytics: up to 26 months

Data may be deleted earlier where legally appropriate.

8. Your Rights

Under UK GDPR, you have the right to:

Access your data
Request correction
Request deletion (where legally allowed)
Restrict processing
Object to processing
Data portability
Withdraw consent
Complain to the ICO (www.ico.org.uk)

To use any of these rights, contact us using our contact form, by phone on 020 3443 9844, or by post to Medicare People Ltd, 86-90 Paul Street, London EC2A 4NE. We will reply within one month.

9. Health & Care Data

When arranging live‑in care, we may process sensitive health data. We only do this where necessary to deliver safe care, meet regulatory requirements, protect vital interests, or fulfil legal obligations.

When you apply to work with us, we also collect some health information (our occupational health questionnaire and your vaccination records) and criminal records information. Only our compliance team and administrators can see it, it is encrypted in Sync, and we use it only to check that the work is safe for you and for the people you care for (see sections 4 and 6).

10. International Transfers

We keep your data in the UK and the European Union where we can. Sync is hosted in Frankfurt, Germany (EU), which has a UK adequacy decision.

Some of our providers are US companies or may process data outside the UK. When they do, we protect your data with an approved safeguard: either the provider is certified under the UK Extension to the EU‑US Data Privacy Framework (the “UK‑US data bridge”), which the UK government recognises as adequate, or we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

We have checked each US provider we use on the official Data Privacy Framework list (dataprivacyframework.gov, checked 5 November 2026):

Render (Render Services, Inc.): certified under the UK Extension. Sync and its files are stored in Frankfurt, Germany (EU).
Microsoft (Microsoft Corporation, for Microsoft 365 and Microsoft Advertising): certified under the UK Extension.
Mailgun (Mailgun Technologies, Inc., part of Sinch): certified under the UK Extension. We use its EU region.
Cloudflare (Cloudflare, Inc.): certified under the UK Extension.
Google (Google LLC): certified under the UK Extension.
Meta (Meta Platforms, Inc.): not certified under the UK Extension. Transfers to Meta are covered by the UK Data Transfer Addendum in Meta’s Business Tools Terms.
Anthropic and our AI image‑editing provider: not switched on. Before we switch either on, we will check it is certified under the UK Extension or put the IDTA or UK Addendum in place.

11. Cookies

Our website uses cookies for analytics, performance, and functionality. When you first visit, we ask whether you accept analytics and advertising cookies. We only set them if you click “Accept”. To change your choice later, clear this website’s cookies and site data in your browser and we will ask you again. You can also manage or disable cookies through your browser. See our cookie policy for details.

12. Updates to This Policy

We may update this Privacy Policy when legal or operational changes occur. A revised “Last updated” date will appear at the top.