Privacy Policy
How we collect, use, and protect your data
1. Introduction
NurseFlex Ltd ("we", "us", "our") operates the NurseFlex platform. We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains how we collect, use, store, and share your information.
Data Controller: NurseFlex Ltd (company no. 17153168), 55 Woodlands Way, Hastings, England, TN34 2FT
Contact: [email protected]
2. Data We Collect
| Category | Data Types | Purpose |
|---|---|---|
| Identity | Full name, date of birth, NMC/HCPC PIN | Account creation, compliance verification |
| Contact | Email, phone number, address | Communications, shift notifications |
| Professional | Qualifications, DBS certificate, training records, work history | Compliance management, shift matching |
| Financial | Bank details, national insurance number | Payment processing, tax compliance |
| Usage | Login times, pages visited, device information | Platform improvement, security |
| Location | Postcode, GPS (clock-in only, with consent) | Shift matching, timesheet verification |
3. Legal Basis for Processing
We process your data under the following lawful bases:
- Contract: Processing necessary to provide our services (shift matching, payments, timesheets)
- Legal Obligation: Compliance with employment law, CQC regulations, HMRC requirements
- Legitimate Interest: Platform security, fraud prevention, service improvement
- Consent: Marketing communications, non-essential cookies, GPS location tracking
4. How We Use Your Data
We use your personal data to provide and improve NurseFlex services, match you with appropriate shifts or professionals, verify compliance documents, process payments and generate invoices, send shift notifications and platform updates, comply with healthcare regulations and employment law, and prevent fraud and maintain platform security.
5. Data Sharing
We share data only with the following parties and only as necessary:
- Healthcare organisations: Professional profiles and compliance status for shift bookings
- Service suppliers: Payment processing, transactional email and electronic signatures where those services are used. The platform integrates with Stripe, Resend and Signzora; an existing agreement may retain its original signing provider. Payroll information is shared with the appointed payroll service where required.
- Regulatory bodies: NMC, CQC, or HMRC when required by law
- Cloud providers: Cloudflare infrastructure for hosting, application services, databases and document storage. This statement does not promise UK-only processing.
We never sell your personal data to third parties.
6. Data Retention
Active account data is retained for the duration of your account plus 6 years (in line with HMRC requirements). Compliance documents are retained for 3 years after expiry. Our financial-record retention period is 7 years, subject to applicable legal requirements and a documented reason for retention. Inactive accounts are subject to retention review; automatic anonymisation after 24 months is not promised.
7. Your Rights
Under UK GDPR, you have the right to:
- Access your personal data (Subject Access Request)
- Rectify inaccurate personal data
- Erase your data ("right to be forgotten"), subject to legal retention requirements
- Restrict processing of your data
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interest
- Withdraw consent at any time where processing is based on consent
To exercise any of these rights, email [email protected]. We will handle your request within the applicable statutory time limit, normally one month; we will explain any lawful extension or need to verify identity.
8. Cookies
NurseFlex uses essential cookies for authentication, security, and platform functionality. With your consent, we also use analytics cookies to understand how users interact with the platform. Use Cookie preferences in the footer to change your choice at any time. Optional analytics and stored campaign attribution are disabled for an essential-only choice.
9. Security
Our platform uses HTTPS, account authentication and role-based access controls. Signed-document evidence is held in private storage. Security controls require continuing review; this policy does not certify compliance with NHS assurance standards or establish that an independent security audit has been completed. Despite these measures, no internet transmission is 100% secure. We encourage users to protect their login credentials.
10. International Transfers
Our cloud and service suppliers may process data in more than one country. A UK website address is not a promise of UK-only storage or processing. Supplier processing locations and the applicable safeguards for restricted international transfers must be assessed for the services used. Contact [email protected] for information about the suppliers and safeguards relevant to your data.
Academy purchases and Flexero Ltd
Flexero Ltd (company no. 16633410), trading as NurseFlex Academy, is the course seller and receives course payments through Stripe. Its registered office is 3rd Floor, 86–90 Paul Street, London, England, EC2A 4NE. Flexero Ltd is responsible as controller for its course orders, learner access, assessments, certificates, refunds and financial records. Nurseflex Ltd remains responsible for its staffing platform records. Relevant learner and course-completion information is shared where needed to provide the requested service or review staffing compliance, with an applicable lawful basis. Payment, hosting and notification suppliers are used as needed for the service.
Course records are used to perform the learning contract, meet applicable legal duties and protect the service under legitimate interests. Optional marketing requires a separate appropriate choice. Financial records are retained for the period required by applicable law; other learner records are retained only as needed for the learning service, certificate verification or a documented legal purpose. Ask us for the retention period applicable to a particular record. For Academy privacy requests contact hello@nurseflex.co.uk and identify the Academy service; the request will be routed to Flexero Ltd. The rights and complaints information in this notice also applies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email and platform notification. The "last updated" date at the top of this page indicates when the policy was last revised.
12. Complaints
If you believe we have not handled your data appropriately, please contact us at [email protected]. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.