1. ABOUT THIS POLICY

1.1 Purpose. This Privacy Policy explains how Jobmerger Support Services Ltd ("Jobmerger", "we", "us", "our") collects, uses, shares and protects personal data in connection with our care management software, which is made available through our web platform and our mobile application (together, the "Platform"), our website at https://jobmerger.com (the "Website"), and our sales, onboarding, billing and support activities.

1.2 Legal framework. We are established in the United Kingdom and our users are based in the United Kingdom. We process personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR"), each as amended, including by the Data (Use and Access) Act 2025.

1.3 Related documents. This policy should be read with our Terms and Conditions, our Mobile App Use Policy and our Cookie Policy. Capitalised terms not defined in this policy, such as "Customer", "Authorised User", "Customer Data" and "Subscription", have the meanings given in our Terms and Conditions.

1.4 Plain language. We have written this policy to be read by care organisations, their staff, the people they support and their families. If any part is unclear, please contact us using the details in Section 2.

2. WHO WE ARE AND HOW TO CONTACT US

2.1 Our details. Jobmerger Support Services Ltd is a company registered in England and Wales under company number 12142973, with its registered office at St. James House, Hollinswood Road, Central Park, Telford, England, TF2 9TZ.

2.2 ICO registration. We are registered with the Information Commissioner's Office ("ICO") under registration number ZB273793

2.3 Contact. For any question about this policy or your personal data, email info@jobmerger.com with "Privacy" in the subject line, or write to us at the address in Section 2.1 marked for the attention of the Privacy Lead. For technical support, email support@jobmerger.com, and for billing and account queries, email accounts@jobmerger.com.

2.4 Data protection officer. Data protection officer: Sandra Declan. Until a data protection officer is named here, privacy enquiries are handled by our Privacy Lead through the contact details in Section 2.3.

3. OUR TWO ROLES: CONTROLLER AND PROCESSOR

3.1 Why this matters. The Platform is used by care providers and other organisations (each a "Customer") to plan, deliver and record care. The law treats us differently depending on whose purposes the data serves, and that decides who you should contact to exercise your rights.

3.2 Where we act as processor. When a Customer uses the Platform to hold care plans, care notes, visit records, medication records, risk assessments, staff rotas and similar records about the people it supports and the staff it employs or engages ("Customer Data"), the Customer decides why and how that data is used and is the controller. We act as its processor and use Customer Data only on the Customer's documented instructions under the data processing terms in our Terms and Conditions. The Customer's own privacy notice governs that processing. Section 21 explains how to exercise your rights in relation to Customer Data.

3.3 Where we act as controller. We are the controller of personal data we use for our own purposes, including Customer account and contract administration, billing and payment, security and fraud prevention of the Platform, product analytics, Website visits, marketing to business contacts, support and complaints, and the data of individuals who subscribe to the Platform directly in their own name, such as a family member who manages care for a relative ("Individual Subscribers").

3.4 Overlap. Some data, such as an Authorised User's log-in details, is used both to provide the service to the Customer and for our own security purposes. In that case we are processor for the Customer's purposes and controller for our own, and this policy describes the controller part.

4. WHO THIS POLICY COVERS

4.1 Individuals. This policy applies to: representatives and administrators of Customers and prospective Customers; Authorised Users such as care workers, nurses, coordinators, managers and office staff; family members, representatives and other people invited by a Customer to view or contribute to a care record; Individual Subscribers; people who visit the Website or contact us; and people whose details appear in Customer Data, to the extent described in Section 3.

4.2 Age. The Platform is offered only to adults aged 18 or over. Section 22 explains how we treat information about children that a Customer may record.

5. THE PERSONAL DATA WE COLLECT

5.1 Account and identity data. Name, job title, employer or organisation, work and personal email address, telephone number, username, password (stored in hashed form), role and permission level, profile photograph where added, and records of the terms and policies you have accepted.

5.2 Care record data. Information that Customers, Authorised Users and Individual Subscribers enter about the people receiving care, including name, date of birth, address, next of kin, NHS number or other identifiers, care needs, care plans, daily notes, medication administration records, allergies, incidents, wellbeing observations, photographs and documents. Much of this is health information, which Section 6 addresses.

5.3 Workforce data. For care staff using the Platform, information such as availability, rotas, visit allocations, check-in and check-out times, training and qualification records where a Customer uploads them, and messages exchanged through the Platform.

5.4 Location data. Precise location from the device's GPS and approximate location from network signals, as described in Section 7.

5.5 Biometric data. Where the relevant feature is enabled, data used to confirm a person's identity from their physical characteristics, as described in Section 8.

5.6 Device data. Device identifiers, device model, operating system and version, app version, mobile network, language and time zone settings, push notification tokens and crash and diagnostic reports.

5.7 Payment and billing data. Billing name and address, invoicing contacts, VAT number, Subscription plan, payment history and transaction references. Card payments are handled by our payment processor. We receive only limited card details, such as card type, last four digits and expiry date, and we do not store full card numbers or security codes.

5.8 Usage data. Log-in times, features used, pages and screens viewed, actions taken, IP address, browser type, referring pages and error logs.

5.9 Communications data. Support tickets, emails, call notes, chat messages, feedback, survey responses and complaint records.

5.10 Marketing data. Your marketing preferences and, for our emails, whether they are opened and which links are clicked.

6. HEALTH AND CARE INFORMATION

6.1 Special category data. Information about a person's physical or mental health, including care needs, diagnoses, medication and wellbeing, is special category data under the UK GDPR and receives a higher level of protection.

6.2 Customer Data. Most health information on the Platform is Customer Data. The Customer is responsible for identifying its lawful basis and special category condition, which for regulated care providers will typically relate to the provision of health or social care. We process that information only to provide the Platform to the Customer.

6.3 Individual Subscribers. Where an Individual Subscriber records health information about themselves or about a person for whom they arrange care, we process it as controller on the basis of explicit consent given in the Platform. An Individual Subscriber who records information about another adult confirms that they have that person's agreement or have legal authority to act for them, such as a lasting power of attorney or a court-appointed deputyship.

6.4 What we do not do. We do not sell health information, use it for advertising, or use identifiable Customer Data to train artificial intelligence models for our own purposes.

7. LOCATION DATA

7.1 Purpose. The mobile app uses device location to verify that care visits take place at the right address and time, to record check-in and check-out, to support route planning and lone worker safety, and to give Customers accurate visit evidence.

7.2 When it is collected. Precise location is collected only when location permission is granted on the device and, unless a Customer has enabled a feature that records location throughout a working shift, only at the moments of check-in, check-out and other actions that require it. The app indicates when location is being used. We do not track Authorised Users outside working hours set by the Customer.

7.3 Who controls it. Location data about care staff is Customer Data. The Customer, as employer or engager, decides whether and how location features are used and must tell its staff about them.

7.4 Your control. You can withdraw location permission in your device settings at any time. Some features, such as electronic visit verification, will then not work, and your organisation may ask you to use an alternative method.

8. BIOMETRIC DATA

8.1 Device unlock. Where you choose to sign in to the app with fingerprint or face recognition built into your device, the matching is carried out by your device's operating system. We receive only a confirmation that authentication succeeded and we never receive or store your fingerprint or face data.

8.2 Identity verification features. Where a Customer enables a feature that verifies a care worker's identity by comparing a photograph or facial image with a reference image, the resulting biometric data is special category data. We process it as the Customer's processor, only for identity verification, and the Customer must establish a lawful basis and a special category condition, carry out a data protection impact assessment and offer a reasonable alternative to staff who do not wish to use it.

8.3 Safeguards. Biometric templates are encrypted, separated from other records, not used for any other purpose and deleted when the person's account is closed or the Customer disables the feature, subject to Section 19.

9. WHERE WE GET PERSONAL DATA

9.1 From you. When you create an account, use the Platform, contact us, attend a demonstration or subscribe.

9.2 From Customers. When a Customer creates accounts for its staff, invites family members or representatives, or enters care record data.

9.3 From devices and technologies. Through the app, the Platform and the Website, including cookies and software development kits as described in Section 13.

9.4 From third parties. From our payment processor (payment status), integration partners that a Customer chooses to connect (Section 23), credit and fraud prevention services when we assess a business customer, and publicly available business sources such as Companies House.

10. HOW WE USE PERSONAL DATA AND OUR LAWFUL BASES

10.1 Our purposes. As controller, we use personal data for the purposes and on the lawful bases below.

10.2 Legitimate interests. Where we rely on legitimate interests, we have balanced our interests against your rights and expectations. You can ask us for more information about that assessment using the details in Section 2.3.

10.3 Customer Data. We do not use Customer Data for any of our own purposes in this table, except to the limited extent permitted by our Terms and Conditions for security, to provide support requested by the Customer, and to produce aggregated statistics from which no individual or Customer can be identified.

11. SPECIAL CATEGORY DATA AND CRIMINAL OFFENCE DATA

11.1 Conditions we rely on. Where we process special category data as controller, we rely on your explicit consent (Individual Subscribers), the establishment, exercise or defence of legal claims, or, where it applies, a condition in Schedule 1 to the Data Protection Act 2018, supported by an appropriate policy document where the law requires one.

11.2 Criminal offence data. A Customer may record the outcome of staff vetting checks, such as Disclosure and Barring Service checks, on the Platform. That data is Customer Data and the Customer is responsible for its lawful use. We do not carry out such checks ourselves.

12. MARKETING

12.1 Business contacts. We may send people at Customers and prospective Customers information about our products, updates and events that is relevant to their role.

12.2 Individual Subscribers. We send marketing emails to Individual Subscribers only where they have consented or, where the law allows, about similar services they have bought from us, with a chance to opt out at the time and in every message.

12.3 Opting out. You can unsubscribe through the link in any marketing email or by contacting us. Service messages about your account, security and changes to our terms are not marketing and will continue.

12.4 No marketing from care records. We never use Customer Data or the details of people receiving care for marketing.

13. COOKIES, SOFTWARE DEVELOPMENT KITS AND SIMILAR TECHNOLOGIES

13.1 Use. The Website and the web Platform use cookies, and the mobile app uses software development kits and device identifiers, to keep you signed in, keep the Platform secure, remember your settings, measure performance and, with your consent, understand how the Website is used and measure our marketing.

13.2 Consent. We ask for your consent before setting cookies or using similar technologies that are not exempt from consent under PECR. You can change your choices at any time through the cookie settings link on the Website or the privacy settings in the app.

13.3 More information. Our Cookie Policy describes each category of technology, what it is used for and how long it lasts.

14. AUTOMATED DECISION-MAKING AND SMART FEATURES

14.1 No solely automated significant decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

14.2 Platform alerts. The Platform may generate prompts, such as alerts for a missed visit, an overdue medication entry or a late check-in, or suggested rota allocations. These are tools to assist the Customer. They do not make decisions, and the Customer's staff decide what action to take.

14.3 Artificial intelligence features. If we introduce features that use artificial intelligence, such as note summarisation or transcription, we will explain in the Platform how they work and what data they use, make them subject to the Customer's choice to enable them, and update this policy before they go live.

15. WHO WE SHARE PERSONAL DATA WITH

15.1 Service providers. Providers who host, secure and support the Platform, process payments, send emails, text messages and push notifications, provide customer support tools and analyse usage, as described in Section 16.

15.2 Customers. Where you are an Authorised User, your organisation can see your account details and the records you create, including location and visit data.

15.3 People you or a Customer choose. Family members, representatives, health professionals or other organisations that a Customer or an Individual Subscriber chooses to give access to a care record, or receive a report from it.

15.4 Professional advisers and insurers. Our lawyers, accountants, auditors and insurers, where necessary and under duties of confidentiality.

15.5 Regulators and authorities. The ICO, HM Revenue and Customs, the police, courts and other public bodies where we are legally required to share data, or where it is necessary to protect someone's vital interests. Where we receive a request concerning Customer Data, we will refer it to the Customer unless the law prevents us from doing so.

15.6 Business transfers. A buyer, investor or successor if we sell, merge or restructure all or part of our business, under confidentiality obligations and subject to this policy.

15.7 No sale. We do not sell personal data.

16. SERVICE PROVIDERS AND SUB-PROCESSORS

16.1 Categories. We use carefully selected providers in the following categories: cloud hosting and storage; database and backup; payment processing; email, text message and push notification delivery; communication and telephony services; mapping and location services; customer support and ticketing; product analytics, crash reporting and performance monitoring; and identity verification where a Customer enables it.

16.2 Contracts. Every provider is bound by a written contract that limits its use of personal data to providing services to us and requires it to protect the data.

16.3 Sub-processor list. We maintain a list of the sub-processors who may process Customer Data, which is available on request from info@jobmerger.com. Customers will be told about changes in accordance with our Terms and Conditions.

17. INTERNATIONAL TRANSFERS

17.1 Where data is stored. We aim to host Customer Data in the United Kingdom or the European Economic Area.

17.2 Transfers outside the United Kingdom. Some service providers, or their support teams, may access or store personal data in other countries. Where personal data is transferred outside the United Kingdom, we make sure it is protected by one of the mechanisms the UK GDPR recognises, such as UK adequacy regulations (which include the UK Extension to the EU-US Data Privacy Framework for certified US organisations), the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission's standard contractual clauses, supported by a transfer risk assessment where required.

17.3 Copies. You can ask us for more information about the safeguards we use for a particular transfer using the details in Section 2.3.

18. SECURITY

18.1 Our measures. We use technical and organisational measures appropriate to the sensitivity of health and care information, including encryption of data in transit and at rest, role-based access controls set by each Customer, multi-factor authentication options, audit logs of access to records, regular backups, vulnerability management, staff confidentiality obligations and need-to-know access for our own personnel.

18.2 Your part. Keep your password and device secure, use the device lock and the app's security settings, sign out of shared devices and tell your organisation and us immediately if you suspect unauthorised access. Our Mobile App Use Policy sets out what to do if a device is lost or stolen.

18.3 Incidents. If a personal data breach occurs, we will act in line with our incident response procedures, notify affected Customers without undue delay where Customer Data is involved, and notify the ICO and affected individuals where the law requires.

18.4 No absolute guarantee. No system is completely secure, but we work continuously to protect the Platform and will tell you if something goes wrong in the way the law requires.

19. HOW LONG WE KEEP PERSONAL DATA

19.1 Customer Data. We keep Customer Data for as long as the Customer instructs. Care providers have their own legal and regulatory duties to keep care records for set periods, and they are responsible for setting those periods. When a Customer's contract ends, we return or delete Customer Data in accordance with our Terms and Conditions.

19.2 Our own records. As controller we keep: account data for the life of the account and up to 12 months after closure; billing and financial records for six years after the end of the financial year to which they relate; support and complaint records for up to three years after the matter closes; security and audit logs for up to 12 months unless needed to investigate an incident; and marketing data until you opt out, after which we keep a suppression record so that we do not contact you again.

19.3 Longer retention. We may keep data for longer where needed to comply with a legal obligation, or to establish, exercise or defend legal claims, and only for as long as that need continues.

19.4 Individual Subscribers. Individual Subscribers can export their records before closing their account. We delete their care records within 90 days after closure, apart from backups, which are overwritten in the normal backup cycle.

20. YOUR RIGHTS

20.1 Your rights. Subject to conditions and exceptions in data protection law, you have the right to: access your personal data; have inaccurate data corrected; have data erased; restrict processing; receive data you have provided in a portable format; object to processing based on legitimate interests; object at any time to direct marketing; and withdraw consent at any time, without affecting processing that took place before withdrawal.

20.2 How to exercise them. Contact us using the details in Section 2.3. We may ask for information to confirm your identity.

20.3 Timing. We will respond within one month of receiving your request, or of receiving any information we need to confirm your identity or clarify the request. If a request is complex, or you make several requests, we may extend this by up to two further months and will tell you why. Our searches will be reasonable and proportionate.

20.4 Cost. We do not charge for responding unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse.

21. RIGHTS IN RELATION TO CARE RECORDS HELD FOR A CUSTOMER

21.1 Contact the care provider. If you are, or act for, a person receiving care, or you are a member of staff, and your request concerns records a Customer holds on the Platform, please contact that Customer directly. It is the controller and is best placed to deal with your request.

21.2 If you contact us. If you send us such a request, we will pass it to the relevant Customer without undue delay where we can identify it, and help the Customer to respond as our contract with it requires. We will not respond to the substance of the request ourselves unless the Customer instructs us to.

22. CHILDREN

22.1 Adults only. Only people aged 18 or over may create an account, use the app or become an Individual Subscriber. We do not knowingly collect personal data directly from children, and if we learn that a person under 18 holds an account we will close it.

22.2 Children in care records. Where a Customer provides care to children, or records information about children in a family, that information is Customer Data. We protect it in the same way as all Customer Data and the Customer is responsible for its lawful use.

23. INTEGRATIONS AND THIRD-PARTY SERVICES

23.1 Integrations chosen by Customers. Customers may connect the Platform to other services, such as payroll, accounting, health record or communication systems. When a Customer enables an integration, data passes between the Platform and that service on the Customer's instructions, and the provider's own terms and privacy notice apply to its handling of that data.

23.2 External links. The Website and the Platform may link to third-party websites. We are not responsible for their privacy practices and encourage you to read their privacy notices.

24. COMPLAINTS

24.1 Complain to us first. If you are unhappy with how we have handled your personal data, please complain to us using the details in Section 2.3 or the privacy contact form on the Website. We will acknowledge your complaint within 30 days, investigate it without undue delay and tell you the outcome.

24.2 The ICO. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, https://ico.org.uk. The ICO generally expects you to raise your concern with us first.

25. CHANGES TO THIS POLICY

25.1 Updates. We will update this policy when our services or the law change. The current version is always available on the Website and in the app, with its effective date at the top.

25.2 Notice of material changes. If we make a change that materially affects how we use your personal data, we will tell you by email or through the Platform before the change takes effect and, where the law requires, ask for your consent.