Data Privacy & GDPR Policy

DATA SHARING AGREEMENT
UK GDPR & Data Protection Act 2018

1. PURPOSE & SCOPE
This Data Sharing Agreement ("Agreement") governs the sharing of personal data between Nursewell Ltd ("the Agency" / "Data Sharing Party") and the Client Facility ("the Receiving Party") for the purpose of supplying temporary healthcare and care staff to the Client Facility.

The parties acknowledge that they may act as independent Data Controllers in respect of the personal data shared under this Agreement, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. CATEGORIES OF DATA SHARED
The Agency may share the following categories of personal data with the Client Facility:
  a) Staff names, photographs, and professional qualifications
  b) Right-to-Work verification status (confirmation only, not document copies)
  c) DBS certificate references and update service status
  d) Mandatory training certificates and compliance records
  e) Professional registration numbers (e.g. NMC PIN)
  f) Shift assignment details (dates, times, location)
  g) Timesheet records signed by the Client Facility

The Client Facility may share the following categories of personal data with the Agency:
  a) Client contact names and details
  b) Service user care requirements relevant to staff assignment
  c) Timesheet approvals and performance feedback
  d) Incident reports involving Agency staff

3. OBLIGATIONS OF THE CLIENT (RECEIVING PARTY)
The Client Facility agrees to:
  a) Process shared personal data only for the purpose of staffing and care delivery
  b) Not share, transfer, or disclose received personal data to any third party without the express written consent of the Agency
  c) Implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction
  d) Retain personal data only for as long as necessary and in accordance with the Client's own data retention policy
  e) Notify the Agency within 24 hours of any suspected or actual personal data breach
  f) Delete or return all shared personal data upon termination of this Agreement
  g) Not use shared personal data for marketing, recruitment, or any purpose other than the provision of temporary staffing services
  h) Ensure that all staff with access to shared data are aware of their confidentiality obligations under UK GDPR

4. OBLIGATIONS OF THE AGENCY (SHARING PARTY)
Nursewell Ltd agrees to:
  a) Share only the minimum personal data necessary for the provision of staffing services
  b) Ensure that all shared data has been obtained lawfully and with appropriate consent
  c) Maintain accurate records of all data shared with the Client Facility
  d) Provide staff with clear information about how their personal data will be shared
  e) Respond to subject access requests and data subject rights queries in a timely manner
  f) Maintain appropriate professional indemnity and data protection insurance
  g) Conduct regular compliance audits to ensure data sharing remains lawful and proportionate

5. DATA SUBJECT RIGHTS
Both parties acknowledge that data subjects (staff and service users) retain their rights under UK GDPR, including the right of access, rectification, erasure, restriction of processing, data portability, and objection.

Any data subject request received by either party relating to shared personal data shall be forwarded to the other party within 5 working days for joint handling.

6. SECURITY MEASURES
Both parties shall implement and maintain appropriate technical and organisational measures including but not limited to:
  a) Encryption of personal data in transit and at rest
  b) Role-based access controls limiting data access to authorised personnel only
  c) Regular security assessments and vulnerability testing
  d) Staff training on data protection obligations
  e) Secure disposal of physical and digital records
  f) Incident response and breach notification procedures

7. TERM & TERMINATION
This Agreement shall commence on the date of signing and shall remain in force for the duration of the business relationship between the parties.

Either party may terminate this Agreement by providing 30 days written notice. Upon termination, the Receiving Party shall return or securely delete all shared personal data within 30 days, subject to any legal retention requirements.

Termination of this Agreement does not affect the confidentiality obligations of either party, which shall survive termination indefinitely.

8. GOVERNING LAW
This Agreement shall be governed by and construed in accordance with the laws of England and Wales. Any disputes arising under this Agreement shall be subject to the exclusive jurisdiction of the courts of England and Wales.