Appropriate Policy Document.

What this document is

Under Section 35 of the Data Protection Act 2018, an organisation that processes special-category personal data on the basis of Schedule 1 Part 1 paragraphs 1 or 2, or Schedule 1 Part 2 paragraph 18, must hold and operate an Appropriate Policy Document (APD).

This page is CarerNest's published APD summary. The full internal APD — including retention schedules, escalation routes, and reviewer sign-off — is held on file, and a copy of this APD will be provided on written or oral request to [email protected] (we confirm receipt in writing within 7 days and supply the document within one calendar month thereafter). The response window aligns with Article 12(3) of the UK GDPR subject-access window; the right to a copy of an APD sits on the Section 35 transparency norm, not on Article 15.

What policies we operate

This APD covers the policies we operate under Section 35:

• Consent capture policy (Schedule 1 Part 1, paragraph 1) — covers how we ask for, record, and withdraw explicit consent in the profile wizard and at the verification step. Each capture moment is recorded with what is being consented to, when, and the withdrawal route. See /settings/privacy for in-app withdrawal.
• Health and social-care processing policy (Schedule 1 Part 1, paragraph 2) — applies where a regulated professional (a CQC-registered manager at an agency on our platform) is involved in the care plan. Covers the safeguards we apply: minimum-necessary data, time-limited retention, and an audit log per record (each log entry linked to the named reviewer who made it).
• Safeguarding processing policy (Schedule 1 Part 2, paragraph 18) — covers our handling of flags raised when a carer or family member believes an individual is at risk. Sharing with local-authority safeguarding teams is documented case-by-case.

Review and update

This APD is reviewed annually or whenever a material change is made to the underlying processing. The last review date matches the privacy-notice version on /privacy.

Contact

For questions about this document, contact our Data Protection Officer at [email protected].