Privacy Policy

CareConnect Directory (“CareConnect”, “we”, “us”) is a UK directory that helps people find vetted Occupational Therapists and Case Managers, and lets those professionals list their services. The directory is operated by CareConnect Events.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), CareConnect Events is the data controller for the personal data described in this policy.

• Contact: hello@careconnect.events

This policy explains what personal data we collect, why, what we do with it, who we share it with, and the rights you have. It applies to three groups of people:

• Professionals who create an account and list a profile or practice.
• People sending enquiries, including individuals, family members, solicitors, and insurers.
• Visitors who browse the site without an account.

If you are a professional with an account

• Your name, email address, and a password (stored only in an encrypted, hashed form).
• Profile details you choose to publish: phone number, photo, biography, qualifications, specialisms, languages, professional associations, and links to your website or social profiles.
• Professional registration numbers, such as your HCPC or case-management registration number, and any qualification documents you upload for verification.
• Your approximate location: the town, county, and postcode you provide (we convert a postcode into an approximate map location).
• The organisation or practice you are linked to, if any.
• If you buy a paid feature, billing information processed by our payment provider (we do not store full card details).

If you send an enquiry

• Your name, email address, and phone number.
• Your organisation and role, if you give them (for example a solicitor or insurer).
• The location and county you are enquiring about, and what kind of professional or support you are looking for.
• Any details you choose to write in the enquiry. Please note these may include information about a health condition or personal situation. Where they do, that is special category (health) data, and we handle it as described below.

For everyone who visits

• Technical data such as your IP address, browser and device type, and the pages you view.
• Usage and analytics data collected through cookies and similar technologies (see Cookies and analytics).

We use personal data only where the law allows. The main purposes and lawful bases are:

• To run your account and publish your listing (professionals). Lawful basis: performance of a contract with you.
• To verify professional credentials before a profile goes live. Lawful basis: legitimate interests (keeping the directory trustworthy) and, where needed, legal obligation.
• To pass your enquiry to the professional or professionals you choose, and to let them respond. Lawful basis: taking steps at your request before any engagement, and our legitimate interest in operating the directory.
• To send service messages such as enquiry confirmations, responses, and account notifications. Lawful basis: contract and legitimate interests.
• To keep the site secure and improve it using analytics. Lawful basis: consent for non-essential cookies, and legitimate interests for security.
• To meet legal and regulatory obligations, and to establish or defend legal claims. Lawful basis: legal obligation and legitimate interests.

We do not sell your personal data, and we do not use it for unrelated advertising.

Because CareConnect helps people find support after illness or injury, an enquiry may reveal information about someone’s health. This is “special category” data and gets extra protection under UK law.

When you include health or situation details in an enquiry, we rely on your explicit consent to share those details with the professional you have asked us to contact, so that they can decide whether they can help. Please share only what you are comfortable with: you do not need to include sensitive detail to make an enquiry. You can withdraw your consent at any time by contacting us at hello@careconnect.events.

We share personal data only in these circumstances:

• With professionals you enquire about. When you send an enquiry, the details you provide are shared with the professional or professionals you selected (or, for a guided match, with a small number of suitable professionals) so they can respond.
• With service providers who process data on our behalf. These providers act on our instructions under contract and are listed below.
• Where the law requires it, or to protect our rights, users, or the public.
• In connection with a business sale or reorganisation, in which case data would remain protected under terms consistent with this policy.

Our main processors are:

• Supabase: Database, authentication, and file storage hosting. Privacy notice.
• Vercel: Website hosting and privacy-friendly traffic analytics. Privacy notice.
• Resend: Sending account, enquiry, and notification emails. Privacy notice.
• Stripe: Payment processing, if you buy a paid feature. Privacy notice.
• Microsoft Clarity: Understanding how the site is used to improve it. Privacy notice.
• Google Analytics: Aggregate website usage statistics. Privacy notice.
• postcodes.io: Turning a postcode into an approximate map location. Privacy notice.

Some of our service providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on safeguards recognised under UK data protection law, such as the UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more detail about the safeguards that apply.

We keep personal data only for as long as we need it:

• Professional accounts and listings: while your account is active, and for a reasonable period afterwards in case you return or for our records.
• Enquiries: for as long as needed to handle the enquiry and any follow-up, and then for a limited period for record-keeping and to resolve any disputes.
• Verification documents: only as long as needed to confirm a credential, after which they are deleted.
• Analytics data: in line with the retention settings of the analytics tools we use.

When we no longer need personal data, we delete it or anonymise it.

Under UK data protection law you have the right to:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is wrong or incomplete.
• Ask us to delete your data in certain circumstances.
• Ask us to restrict or object to how we use your data.
• Ask us to transfer your data to you or another provider where this applies.
• Withdraw consent at any time, where we rely on consent.

To exercise any of these, email hello@careconnect.events. We will respond within one month. If you are not happy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk, though we would welcome the chance to put things right first.

We use a small number of cookies and similar technologies. Some are essential for the site to work, such as keeping you signed in. Others are analytics cookies that help us understand how the site is used so we can improve it. We use Vercel, Microsoft Clarity, Google Analytics for this.

We ask for your consent before setting non-essential cookies, and you can change your choice at any time. You can also block or delete cookies in your browser settings, though some parts of the site may not work as well.

We take reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, and trusted hosting providers. No online service can be completely secure, but we work to keep your data safe and to respond quickly if anything goes wrong.

CareConnect is intended for professionals and adults making or supporting an enquiry. It is not directed at children, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will remove it.

We may update this policy from time to time. When we make significant changes we will update the date at the top and, where appropriate, let you know. Please check back occasionally.

For anything about this policy or your personal data, contact us at hello@careconnect.events.

For general questions about the directory, see our About page or email hello@careconnect.events.