DPIA pack
Last updated: August 2026
Do you need one?
Almost certainly yes. You will be processing health data about people receiving care, and doing it at scale — both of which are on the ICO's list of processing likely to result in high risk. Adding electronic monitoring of workers, if you switch on clock-in location, is another.
Roles
You are the controller. OnCall Care is your processor, acting on your documented instructions under a data processing agreement. Our sub-processors are listed on the sub-processor page, with what each one does and what data reaches it.
What the product processes
- Staff. Name, contact details, address, employment terms, contracted hours, right-to-work and DBS status and expiry, training and skills with expiry dates, availability, absence including sickness, pay-related data, and clock-in location where enabled.
- People receiving care. Name and preferred name, address, care package details, required skills for their visits, risk flags, key contacts, care notes, and restrictions on which staff may attend.
- Operational. Rota and shift history, cover offers and replies, incidents, handovers, and the audit log of who changed what and when.
Special category data is present: health data about people receiving care, and sickness absence about staff. Criminal offence data is present in the form of DBS status.
Lawful bases you are likely to rely on
These are the usual ones for domiciliary care and are offered as a starting point for your own analysis, not as advice. Staff data: contract, and legal obligation for working time and right-to-work records. Client data: contract and legitimate interests, with Article 9(2)(h) — health or social care — for the health data, and Schedule 1 Part 1 of the Data Protection Act 2018 as the domestic condition. Safeguarding processing has its own condition at Schedule 1 paragraph 18.
Risks and what the product does about them
Our assessment of the processing we carry out on your behalf. Where a control is only partial, it says so.
| Risk | Likelihood | Impact | Mitigation in the product |
|---|---|---|---|
| A carer sees a client record they have no involvement with | Low | High | Row-level security scopes every read to the signed-in user. Carers see the clients they are rostered to; restricted staff links bar named individuals from named clients entirely. |
| One organisation reaches another organisation’s data | Low | Severe | Every customer table carries an organisation id and is filtered by the database against the user’s token. A query missing its organisation returns no rows rather than all rows. Tenancy is covered by automated tests that run on every schema change. |
| A carer is assigned past a working-time or training limit and nobody can account for it later | Medium | High | Assignment runs through the eligibility gates server-side and refuses a blocked assignment unless the block was accepted by name. The override is recorded with the authoriser, the reason and the numbers as they stood, and the carer is told and asked to confirm. Overrides are off by default per category. |
| Special category data (health, sickness absence) is over-retained | Medium | Medium | Retention is configurable per organisation. Partial: retention is set by policy and is not yet enforced by an automated deletion job, so a controller who needs guaranteed erasure at a fixed period should ask us before relying on it. |
| A carer’s location is tracked beyond what is needed | Medium | High | Location is captured only at clock-in and clock-out, as a single point against the visit, and only when the organisation has enabled it. There is no continuous or background tracking, and the app does not request permission for it. |
| A device is lost while signed in | Medium | High | The mobile app requires a PIN on top of sign-in and locks when backgrounded. PINs are stored as bcrypt hashes and never leave the device in plain form. Sessions can be revoked centrally. |
| Personal data is exposed to a third-party service without the controller knowing | Low | High | The full list of sub-processors is published and updated before a new one starts handling data. No analytics or advertising service is present. The matching engine runs inside the database, so ranking a carer for a shift sends nothing anywhere. |
Data subject rights
Requests come to you as controller. We assist: records can be exported, corrected and deleted through the product, and we will help with anything the interface does not cover. Note that some records cannot lawfully be erased on request — working time and holiday pay records must be kept for six years, and since 6 April 2026 failing to keep the holiday records is a criminal offence. That is a limit on erasure, and it is worth writing into your own assessment rather than discovering it during a request.
What we will give you
- A signed data processing agreement, including sub-processor terms.
- A completed supplier security questionnaire, if you use one.
- Written answers on anything in this pack — including where a control is weaker than you need it to be.
Ask at privacy@oncallcare.co.uk.
This page describes controls in the product. It is not legal advice, and your DPIA should be reviewed by someone who knows your organisation.