This privacy policy explains what personal data CareTaskNest collects, why we collect it, the lawful bases we rely on, how long we keep it and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to the CareTaskNest website, free tools, printable templates, guides and the family care planner. If anything is unclear, please contact us.
Who is responsible for your data
CareTaskNest is operated by CareTaskNest ("we", "us"), which is the controller of the personal data described in this policy. You can reach us through the contact form or at noreply@caretasknest.com.
The short version
- The free tools keep what you type in your own browser. It is not sent to our server.
- If you create an account, we store your account details and the care space content you and your family add, so we can provide the planner.
- We do not sell personal data.
- Notes about the person you care for are never sent to analytics or advertising services.
- Optional usage measurement and advertising cookies are only used if you agree, and adverts never appear inside a logged-in care space.
- You can export your data or delete your account at any time in Account settings.
Data we collect
When you use the free tools and templates
The home care cost calculator, caregiver daily log generator, weekly care schedule builder, senior emergency information sheet and home safety checklist run in your browser. What you enter is saved in your browser's local storage on your device and is not sent to us. We cannot see it, and we cannot recover it if you clear your browser data. The same applies to templates you fill in on screen.
When you create an account
- Account details: your name or display name, email address and password. We never store your password itself, only a bcrypt hash of it.
- Preferences: such as your interface language and time zone.
- Care space content: the information you and other members add to a care space, such as the household name, tasks, due dates, repeat rules, notes, calendar entries, visit reports and their visibility settings, and task history (who did what and when).
- Membership and invitations: which care spaces you belong to, your role in each, and the invitations you create or accept.
Care space content may include data about other people, including the relative you care for, and sometimes information about their health, which is special category data under UK GDPR. Please add only what your household genuinely needs to coordinate care, and involve the person concerned where you can.
When you contact us
If you use the contact form or email us, we collect your name, email address and the content of your message, so we can reply.
Technical data
When you visit the site, our server receives standard technical data such as your IP address, browser type, the page requested and the time of the request. We use this to deliver the site, keep it secure and diagnose problems.
Cookies and similar technologies
We use strictly necessary cookies to keep you signed in and remember your choices. With your consent, we also use optional usage measurement and, on public pages only, advertising. Details are in our cookie policy.
Payment data
Online payments are not live, and we do not currently collect payment card details. If we introduce paid plans, we will update this policy before doing so.
Why we use your data and our lawful bases
| Purpose | Lawful basis under UK GDPR |
|---|---|
| Creating your account, signing you in and providing the planner, including showing care space content to the right members and handling invitations | Contract (Article 6(1)(b)) – necessary to provide the service you asked for |
| Storing and displaying health-related notes that members choose to add to a care space | Contract (Article 6(1)(b)). Because health information is special category data, we also need an Article 9 condition: where you add information about your own health, we rely on your explicit consent (Article 9(2)(a)), which you can withdraw by removing it. We process this data only to provide the care space to its members, with the safeguards described below |
| Keeping the service secure, preventing abuse and investigating problems | Legitimate interests (Article 6(1)(f)) – running a safe, reliable service |
| Answering messages sent through the contact form or by email | Legitimate interests – responding to people who contact us |
| Anonymous usage measurement (event counts such as "tool opened") | Consent (Article 6(1)(a)), as required by PECR for non-essential cookies |
| Advertising on public pages through Google AdSense or Adsterra | Consent (Article 6(1)(a)), as required by PECR |
| Sending essential service messages, such as about security or changes to our terms | Contract or legitimate interests |
| Complying with the law and responding to lawful requests | Legal obligation (Article 6(1)(c)) |
Where we rely on legitimate interests, we have considered whether our interests are outweighed by yours. You can ask us for more detail.
Health-related information in a care space is never used for analytics, advertising or profiling. It is visible only to members of that care space according to their role and the visibility you choose for visit reports. If you add health information about another person, please make sure you have a good reason to share it with the people in that care space.
Sharing your data
Within a care space
Content in a care space is visible to members of that care space according to their role. Visit reports can be shared with everyone in the care space or with owners and administrators only. Please think about who you invite and which role you give them.
Service providers (processors)
We use a small number of processors to run CareTaskNest, such as our hosting provider, which operates a server in Europe. Details of the hosting provider will be confirmed by the operator and listed here. Processors may only use personal data on our instructions and under a written contract.
Advertising partners
If you consent to advertising cookies, Google AdSense or Adsterra may be enabled on public pages. These partners may collect device and browsing data through cookies, acting under their own privacy policies. They do not receive your account details or care space content, and adverts are never shown inside the logged-in planner.
Legal reasons
We may disclose data if required by law, or where reasonably necessary to protect the vital interests, rights or safety of any person.
We do not sell personal data.
How long we keep data
- Account data and care space content: for as long as your account exists, until you delete it.
- After account deletion: your account data is removed from our live systems. Backups are kept for 14 days and then overwritten, so deleted account data is fully removed from backups within 30 days.
- Contact messages: for as long as needed to deal with your request and any follow-up, then deleted.
- Technical logs: for a limited period for security and troubleshooting, then deleted.
- Free tool entries: stored only in your browser until you clear them.
If you have questions about content you added to a care space that other people still use, please contact us.
How we protect data
We use appropriate technical and organisational measures to protect personal data, including:
- passwords hashed with bcrypt;
- sessions held in httpOnly, secure cookies;
- encrypted connections (HTTPS) to the site;
- role-based access within care spaces;
- limiting staff access to what is needed to run and support the service.
No online service can guarantee complete security. If a personal data breach occurs, we will notify the ICO and affected people where UK GDPR requires it.
International transfers
Our server is located in Europe. Transfers of personal data from the UK to the European Economic Area are covered by UK adequacy regulations. Some service providers or advertising partners may process data in other countries, including the United States. Where this happens, we rely on safeguards recognised by UK law, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified) or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.
Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- rectification of inaccurate data;
- erasure of your data in certain circumstances;
- restrict our processing in certain circumstances;
- object to processing based on legitimate interests;
- data portability for data you provided to us under contract or consent;
- withdraw consent at any time, without affecting processing that took place before.
Many of these you can exercise yourself: export your data as a JSON file, correct your details or delete your account in Account settings, and change cookie choices at any time via "Cookie settings" in the footer.
For anything else, use the contact form or email noreply@caretasknest.com. We may need to confirm your identity. We will respond within one month, which may be extended in some cases as UK GDPR allows.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Children
CareTaskNest is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has created an account, please contact us and we will delete it.
Changes to this policy
We may update this policy as the service changes. We will change the date at the top of this page, and for significant changes we will let account holders know by email or in the app before they take effect.
Contact
For privacy questions or requests, please use the contact form or email noreply@caretasknest.com. The controller is CareTaskNest.