CareCompass ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect and use personal data when you use our care home directory and placement enquiry services in the United Kingdom.
Policy version: 2026-06-11
Who we are
CareCompass operates an online directory of CQC-registered care homes in England and a platform for families to submit placement enquiries to care providers. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), CareCompass is the data controller for personal data processed through this website.
Personal data we collect
When you search the directory
- Search queries, filters, and pagination preferences
- Technical data such as IP address, browser type, and device information in server logs
When you submit a placement enquiry
- Your name, email address, and telephone number
- Information about care needs: care type, funding type, urgency, patient postcode, optional age, and free-text notes
- The care home you are enquiring about and the timestamp of your consent
Notes you provide may include information about health or care needs. We ask that you only include information that is relevant and that you are comfortable sharing with the care home. Please do not include special category data (such as detailed medical diagnoses) unless necessary for the enquiry.
Care home operator accounts
- Email address, name, and authentication credentials
- Association with a registered care home (CQC location)
Care home operators
When you unlock a placement enquiry, we process payment data through Stripe. Lead and family contact data is handled as described in our operator terms and is subject to UK GDPR obligations on you as the organisation responding to the enquiry.
Payments
- Payment records when a care home unlocks a lead (processed by Stripe; we do not store full card numbers)
How we use your data and lawful bases
| Purpose | Lawful basis |
|---|---|
| Display search results and care home profiles | Legitimate interests (operating the directory) |
| Process and deliver placement enquiries to care homes | Consent (GDPR checkbox on the placement form) |
| Send email notifications about enquiries and payments | Consent / contract (depending on recipient) |
| Authenticate operators and provide the dashboard | Contract / legitimate interests |
| Process lead unlock payments | Contract |
| Prevent fraud, abuse, and security incidents | Legitimate interests / legal obligation |
| Comply with law and respond to regulatory requests | Legal obligation |
Who we share data with
- Care home operators: placement enquiry details are shared with the relevant registered provider. Contact details may be withheld until the operator completes a paid unlock, as described on the dashboard.
- Processors: Supabase (hosting, database, and authentication), Stripe (payments), Resend (transactional email), and our website hosting provider. Each processor acts under a contract that requires appropriate security and confidentiality.
- Regulators and authorities: where required by law or to protect vital interests.
We do not sell your personal data.
International transfers
Some of our processors may store or process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, or equivalent standard contractual clauses.
Retention
- Placement enquiries: retained while needed to fulfil the enquiry and for up to 24 months thereafter, unless a longer period is required for legal claims or regulatory purposes.
- Payment records: retained for 7 years for accounting, tax, and audit purposes.
- Operator accounts: retained while the account is active and for up to 12 months after closure.
- Server logs: typically retained for up to 90 days.
Your rights
Under UK GDPR, you may have the right to:
- Request access to your personal data
- Request correction of inaccurate data
- Request erasure in certain circumstances
- Request restriction of processing
- Object to processing based on legitimate interests
- Request data portability where applicable
- Withdraw consent at any time (without affecting processing before withdrawal)
To exercise your rights, contact privacy@carecompass.co.uk or see our Contact page. We will respond within one month.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
Cookies
We use cookies and similar technologies as described in our Cookie Policy.
Children
Our services are intended for adults submitting enquiries on behalf of someone who may need care. You must be at least 18 years old to submit a placement request. Contact details must be provided by someone with authority to do so.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be published on this page with an updated date and, where appropriate, a new policy version number. Continued use of the service after changes constitutes acceptance of the updated policy where permitted by law.