1. Who is responsible
The data controller for your personal data under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 is:
[Registered company name][Street]
[Town]
Co. [County]
[Eircode]
Ireland
Email: info@kavodhomecare.com
Phone: +353 89 240 1434
Data protection officer: [name and contact. Because we process health data and vetting disclosures on a large scale, check with your solicitor whether you must appoint one (Art. 37 GDPR)]
2. In short
- We only collect what we need to run Kavod Homecare: to answer your questions, check health professionals, match them with home care offers and pay them.
- We don't use analytics, advertising or tracking tools, and we don't sell data.
- Our website loads its fonts and scripts from our own server. It doesn't connect to Google or other third parties when you visit it.
- We only use cookies that are strictly necessary for logging in and for remembering your language.
- You can download your data and ask us to delete it at any time.
3. Visiting our website
When you open our website, your browser sends technical information to our server, such as your IP address, the date and time, the page requested, your browser and operating system. Our hosting provider [hosting provider, name and location] stores this in server log files.
Purpose and legal basis: showing the website and keeping it secure, for example to detect attacks (Art. 6(1)(f) GDPR, our legitimate interest in a secure, working website). Log files are deleted after [7–14] days unless they're needed to investigate an incident.
Our fonts (Bricolage Grotesque, DM Sans) and scripts are stored on our own server, so no data is sent to font or script providers.
5. Contact form and email
If you write to us using the contact form, we process your name, email address, your message and your IP address. We use the IP address only to stop spam (limiting how many messages can be sent).
Purpose and legal basis: answering your request (Art. 6(1)(b) GDPR if it relates to a contract or a planned contract, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries).
Your message is stored in our system and forwarded by email to our team. We delete it 12 months after your request has been dealt with, unless we must keep it for legal reasons.
6. Signing up as a health professional
When you register, we process:
- Account and contact details: name, email address, mobile phone number, password (stored only as an irreversible hash).
- Professional details: profession, years of experience, languages, your registration number with the Nursing and Midwifery Board of Ireland (NMBI) or CORU where your profession requires one, the counties and towns you work in, and your maximum travel distance.
- Documents: passport or national ID card, qualification certificates, CV, your Garda vetting disclosure (or a police clearance certificate from another country) and, if you choose to upload it, your vaccination record.
- Payment details: IBAN, account holder, your PPS number or Revenue tax reference number, and whether you're VAT-registered.
- Your consent to these terms and the date you gave it.
Purpose and legal basis: checking that you're qualified and suitable to care for patients at home, matching you with offers and paying you (Art. 6(1)(b) GDPR). We keep tax and billing records because Irish tax law requires it (Art. 6(1)(c) GDPR). We use your PPS number or tax reference number only for tax and invoicing purposes.
Garda vetting: you'll work alone with older and vulnerable people in their homes, so we need a vetting disclosure before approving you. Vetting is carried out under the National Vetting Bureau (Children and Vulnerable Persons) Acts 2012 to 2016 through [your own registration with the National Vetting Bureau, or the registered organisation that vets on your behalf]. We process this information under Art. 10 GDPR and section 55 of the Data Protection Act 2018. Only our approval team can see it.
Vaccination record: this is health data (Art. 9 GDPR). Uploading it is optional, and we only process it with your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by deleting it or contacting us.
Email confirmation: we send you a link to confirm that the email address is yours.
Our team reviews every application by hand. We don't make automated decisions about you.
7. Using the portal
- Offers: we show you offers that match your profession and work area. We record which offers you've viewed, when you claim or accept an offer (to the millisecond, so we can tell who was first), and any cancel or swap requests.
- Patient information: once you hold an offer, you see the patient's name, address, care instructions and emergency contact, only while the assignment is active. Every time this information is opened, it's logged. You must keep it confidential and use it only for the assignment.
- Clock in and out: while the Clock in / out page is open on your screen, your phone shows your live distance from the patient's address. This stays on your phone and isn't sent to us. When you clock in and when you clock out, we store the time, your live GPS position at that moment, how accurate it was, when it was taken, and its distance from the patient's address, plus your breaks and any visit notes or reasons you enter. We use this to approve your hours and pay you, and keep it with your payment records. We don't track your location in the background or between clock-in and clock-out.
- Security log: we log logins, failed logins (with IP address), password changes and important actions in the portal. This protects your account and lets us trace changes (Art. 6(1)(f) GDPR). We keep these entries for [e.g. 2 years].
Legal basis: Art. 6(1)(b) GDPR (our contract with you) and Art. 6(1)(f) GDPR (security and accountability).
8. Patients
To organise home care, we process patients' names, addresses, dates of birth, care needs and instructions, and emergency contacts. This includes health data (Art. 9 GDPR), which we process to provide and manage health and social care (Art. 9(2)(h) GDPR and section 52 of the Data Protection Act 2018), under a duty of confidentiality. Patients and their representatives are informed about this separately. Only our coordinators and the professional currently holding an assignment can see these details, and every access is logged.
9. Who receives data
- Hosting: [hosting provider] runs our servers for us, under a data processing agreement (Art. 28 GDPR).
- Email: we send emails through [email provider (SMTP)], under a data processing agreement.
- Vetting: to arrange Garda vetting, your details go to the National Vetting Bureau through [the organisation that processes vetting for us].
- Banks, Revenue and advisers: your bank details go to our bank to pay you, and billing data to our accountant and to the Revenue Commissioners where the law requires it.
- Map links: addresses in your assignments have a "map" link. If you tap it, Google Maps opens and Google receives the address and your device's data. This only happens when you choose to open the link.
- Address look-up (staff only): when our coordinators add a patient, they can look up the GPS coordinates of the address. Only the street, Eircode and town are sent to the OpenStreetMap Foundation (United Kingdom), which the EU recognises as providing adequate data protection.
We don't send your data to any other third parties, and we never sell it. We don't transfer your data outside the European Economic Area except as described above.
10. How long we keep data
| Data | Kept for |
|---|---|
| Your account, profile and documents | As long as you have an account. Earlier versions of replaced documents are deleted when you delete your account. |
| Applications that weren't approved | [e.g. 6 months] after the decision |
| Invoices, timesheets and payment records | 6 years from the end of the tax year they relate to, as Irish tax law requires (section 886 of the Taxes Consolidation Act 1997 and section 84 of the VAT Consolidation Act 2010) |
| Contact form messages | 12 months after your request is dealt with |
| Security log | [e.g. 2 years] |
| Server log files | [7–14] days |
11. Your rights
You have the right to:
- get a copy of your data (Art. 15 GDPR). Professionals can download it any time under Profile & documents → Your data;
- have incorrect data corrected (Art. 16 GDPR);
- have your data deleted (Art. 17 GDPR), unless we must keep it by law;
- restrict how we process your data (Art. 18 GDPR);
- receive your data in a common machine-readable format (Art. 20 GDPR);
- object to processing based on our legitimate interests (Art. 21 GDPR);
- withdraw your consent at any time, without affecting what we did before (Art. 7(3) GDPR);
- complain to the Irish data protection authority (Art. 77 GDPR): Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 (www.dataprotection.ie).
To use your rights, email us at info@kavodhomecare.com. We'll reply within one month.
12. Do you have to give us your data?
You don't have to. But without the details and documents marked as required, we can't approve you as a health professional or pay you. The vaccination record is always optional.
13. Security
We protect your data with technical and organisational measures. These include encrypted connections (HTTPS), hashed passwords, encrypted storage of sensitive settings, documents stored outside the public part of the website, role-based access for our staff, account lock-out after repeated failed logins, and a log of who accessed what. If a personal data breach puts you at high risk, we'll tell you and the Data Protection Commission as the law requires (Art. 33 and 34 GDPR).
14. Changes to this policy
We update this policy when our service or the law changes. The current version is always available on this page. If a change affects you significantly, we'll let you know by email.