Privacy Policy
Last updated: 11 September 2026
This Privacy Policy explains how personal data is collected, used, stored, shared and protected when you use choosecare.co (the “Site”, “we”, “us”, “our”). ChooseCare is an independent directory and decision guide for regulator-registered care and support services across the United Kingdom. We take a data-minimising approach: we ask for as little personal data as possible, we do not sell it, and we do not use it for advertising or profiling.
We process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Section 5 explains how we treat health data, which is special category data under Article 9 of the UK GDPR.
NO IDEA GROWTH LTD, which manages ChooseCare, is the data controller for the personal data described in this policy. It is a company registered in England and Wales under number 16359289, established in the United Kingdom, and this processing is carried out in the context of that establishment, so the UK GDPR applies under Article 3(1). NO IDEA GROWTH LTD
7 Green Leaf Avenue
London SM6 8HB
United Kingdom Privacy contact: [email protected] (see our contact page).
1. The personal data we collect
Information you give us directly
- Account details. If you create an account we store your name and email address. If you register with a password, we store it only as a salted one-way hash (we never see or keep the plain password). If you sign in with Google, we receive your name, email address and a Google account identifier from Google; we do not receive your Google password.
- Sign-in links. If you use a “magic link” or a password reset, we create a single-use, time-limited token tied to your email address.
- Your shortlist and enquiry tracker. If you are signed in and use the care tracker, we store, against your account, which services you are considering, the status you set, the dates you record (contacted, replied, follow-up), any reply you paste in and any free-text notes you write. See section 5.
- Provider listings, claims and corrections. If you submit a service, claim an existing listing, invite a colleague to manage it, or ask us to correct a listing, we process the business and contact details you supply so we can verify that you are entitled to manage it and act on your request.
- Messages you send us. If you email us we hold your email address, your message and anything you choose to include in it.
- Enquiries you send to a service. If you use the enquiry form on a service’s page or on your compare shortlist, we process your name, email address, any phone number and postcode or area you give, your message, and your IP address and browser details (to stop spam), and keep a copy of the enquiry and whether it was delivered.
“Start here” what happens to your answers
The Start here journey asks about the care setting, the kinds of support needed, how often, how urgently and how it might be funded, plus a town or postcode. This is important, so we are explicit:
- Your answers are sent to our server, used in that single request to work out which kind of service to suggest and to look up matching services near the place you typed, and returned to you on the results page.
- They are not stored in our database, not attached to any account, not used for analytics, and not shared with anyone.
- We do not ask for, and you should not enter, a name, email address, phone number, NHS number or any other identifier. No contact details are required and there is no gate: you get the guidance without giving us anything.
- The answers may briefly appear in ordinary web-server logs as part of the request. Those logs are kept for a short period for security and troubleshooting only.
Information stored only in your own browser
- Saved services. If you use the “Saved” feature without an account, the list is stored in your browser’s local storage on your own device. It is not sent to us and we cannot see it. Clearing your browser data removes it.
Information collected automatically
- Technical and security data. Like all websites, our servers and our security provider (Cloudflare) process your IP address, browser and device information, and request details in order to deliver pages, keep the Site available, and protect it against abuse, scraping and attacks.
- Privacy-friendly analytics. We use a self-hosted Plausible Analytics instance, served from our own domain, to understand aggregate usage (for example, how many people viewed a page). Plausible does not use cookies, does not track you across sites, and does not build a profile of you. Because it stores no information on your device and creates no identifier for you, it does not require consent under PECR.
- Sponsored placement clicks. When a sponsored listing is clicked we record the campaign, the placement, the referring page and a one-way hash of your IP address and browser string. The hash exists only to stop the same click being charged twice; we do not store the IP address itself against the click and we do not use it to identify you.
2. Purposes and lawful bases
| Purpose | Data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Creating and running your account | Name, email, password hash or Google identifier | Contract (Art. 6(1)(b)) |
| Keeping your shortlist and enquiry tracker | Services, statuses, dates, notes | Contract (Art. 6(1)(b)); explicit consent for any health data you enter (Art. 9(2)(a)) |
| Giving guidance in “Start here” | Your answers, used in-request only | Legitimate interests, providing the guidance you asked for (Art. 6(1)(f)); explicit consent for the health-related content of your answers (Art. 9(2)(a)), given by choosing to submit them |
| Verifying listings and ownership claims | Business and contact details you supply | Legitimate interests, keeping the directory accurate and preventing fraudulent claims (Art. 6(1)(f)) |
| Sending an enquiry you ask us to send to a service | Name, email, optional phone and postcode, your message; IP address and browser details for spam prevention | Contract / steps you ask us to take (Art. 6(1)(b)); legitimate interests for spam prevention and a delivery record (Art. 6(1)(f)); explicit consent for any health information you choose to include (Art. 9(2)(a)) |
| Answering messages you send us | Your email and message | Legitimate interests, responding to you (Art. 6(1)(f)) |
| Finding services near a place you type | The town or postcode you enter | Legitimate interests, running the search you asked for (Art. 6(1)(f)). The lookup runs on our own servers against our own place data; no third-party geocoder is involved |
| Security, anti-abuse and anti-scraping | IP address, request data | Legitimate interests, protecting the Site, our users and the public (Art. 6(1)(f)) |
| Billing and fraud-prevention for sponsored placements | Hashed IP and browser string | Legitimate interests, charging advertisers correctly (Art. 6(1)(f)) |
| Aggregate usage measurement | Cookieless, non-identifying page counts | Legitimate interests, improving the Site (Art. 6(1)(f)) |
| Meeting our legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have considered your rights and freedoms and limited what we process accordingly; you can object at any time (see section 9). Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.
3. Cookies and similar technologies (PECR)
We use only strictly necessary cookies, which are exempt from the PECR consent requirement. We do not use advertising, marketing or cross-site tracking cookies, and our analytics are cookieless, so there is no consent banner, because there is nothing to consent to.
| Name | Purpose | Type / duration |
|---|---|---|
| choosecare_v2_session | Keeps your session (for example, keeping you signed in and remembering form state) | Strictly necessary / 2 hours, HttpOnly |
| XSRF-TOKEN | Protects forms against cross-site request forgery. Readable by the page’s own scripts by design | Strictly necessary / 2 hours |
| fl_dp | Confirms a genuine browser session so deep result pages load, an anti-scraping measure. Not used to track you | Strictly necessary / up to 1 day |
| Cloudflare (for example cf_clearance, __cf_bm) | Set by our security provider to tell humans from bots and block attacks | Strictly necessary / short-lived |
| Local storage: saved services | Your shortlist when you are not signed in. Stays on your device | Strictly necessary / until you clear it |
You can block or delete cookies and clear local storage in your browser, but strictly necessary cookies are needed for the Site to work.
4. Automated decision-making and AI
We do not carry out automated decision-making producing legal or similarly significant effects under Article 22, and we do not profile you. The “Start here” result is guidance generated from the answers you have just given; it is not an assessment, and a person always decides what to do next. Some listing content, such as short descriptive summaries, is produced with automated tools; that describes services, not visitors. Regulator-published facts (registration, ratings, inspection dates) are shown as such and linked to the source record.
5. Health and other special category data
- We do not ask you for a diagnosis, a care assessment, medical records or an NHS number, and you should not send them to us.
- Two features can involve health data because you volunteer it: the Start here answers (used in-request and not stored. See section 1) and the free-text notes in the care tracker (stored against your account until you delete them).
- Where we process this data we rely on your explicit consent under Article 9(2)(a), given by choosing to submit or record it. You can withdraw consent by not submitting, by deleting your notes, or by closing your account.
- We do not share it with services, advertisers or anyone else, and we do not use it to profile or target you.
6. Who we share your personal data with
We do not sell your personal data. We share it only with the following recipients:
- Hosting and security (processors). Our hosting provider and Cloudflare (content delivery, security and bot protection), which necessarily process your IP address and request data.
- Email delivery (processors). Account, verification, reset and claim emails are sent through our mail infrastructure and our email delivery provider, and are delivered to our operational inbox, which is a Google (Gmail) mailbox.
- Google Sign-In (independent controller). If you choose to sign in with Google, Google LLC processes that authentication.
- Maps (independent controller). Map tiles on service and result pages are served by the OpenStreetMap Foundation. When a map loads, your IP address and the tiles you request are processed by them. Choosing “Get directions” hands you off to Google Maps, at which point Google’s own privacy policy applies.
- Self-hosted analytics. Plausible Analytics, hosted on our own infrastructure, with no cookies and no personal profiles.
- Services you send an enquiry to (independent controllers). When you use an enquiry form, we send your name, email address, any phone number and postcode you gave, and your message to the service or services you selected: and to nobody else. They reply to you directly, and from then on their own privacy notice applies. We are not paid for enquiries and we do not sell leads.
- Services you contact yourself. If you telephone, email or visit a service’s own website from a listing, you are dealing with that organisation directly and its privacy notice applies.
- Legal and safety. Authorities or advisers where we are required or permitted to disclose data by law, or to protect our rights, our users or the public.
7. International transfers
ChooseCare is operated from the United Kingdom, but the Site is hosted on servers in the United States. Personal data you give us is therefore transferred outside the UK.
The UK has not made an adequacy decision covering the United States generally. We rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the UK IDTA) with our processors, together with a transfer risk assessment and the technical measures in section 10, encryption in transit, access control and data minimisation. Cloudflare, Google and the OpenStreetMap Foundation may also process data in the United States and other countries. You can ask us for more detail about the safeguards using the contact details in section 12.
8. How long we keep your personal data
- Account data: kept while your account is active, and deleted within a reasonable period after you ask us to close it (subject to any legal retention we must observe).
- Care tracker entries and notes: kept until you delete them or close your account.
- “Start here” answers: not retained beyond the request.
- Claims and listing submissions: kept for up to 24 months so we can handle disputes about who controls a listing.
- Enquiries sent to services: our copy is kept for up to 12 months so we can confirm delivery and deal with complaints or abuse, then deleted.
- Sign-in and reset tokens: single-use and short-lived.
- Sponsored-click records: hashed, kept for billing and fraud-prevention.
- Security and server logs: kept for a short period for security and troubleshooting.
- Analytics: aggregated and not tied to an identifiable person.
9. Your rights
Under the UK GDPR you have the right to be informed; of access; to rectification; to erasure; to restrict processing; to data portability; to object (including to processing based on legitimate interests); and to withdraw consent at any time. You also have the right not to be subject to a solely automated decision with legal or similarly significant effects. We do not make such decisions.
To exercise any right, contact us using the details in section 12. We will respond within one month, and will tell you if we need to extend that (by up to two further months) for a complex request. There is normally no fee.
10. How we protect your personal data
We use appropriate technical and organisational measures, including encryption in transit (HTTPS/TLS), one-way hashing of passwords, access controls, a web application firewall and bot protection, browser security headers, and the principle of collecting only what we need. No method of transmission or storage is completely secure, but we work to protect your data and to detect and address incidents promptly. Where a personal data breach is likely to result in a risk to your rights and freedoms we will report it to the ICO within 72 hours, and will tell you directly where the risk is high.
11. Children
The Site is intended for adults, people arranging care for themselves or for someone else, and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has given us personal data without the involvement of a parent or guardian, contact us and we will delete it.
12. Contact and complaints
For any data protection question, or to exercise a right, contact [email protected] or write to us at NO IDEA GROWTH LTD, 7 Green Leaf Avenue, London, SM6 8HB, United Kingdom. See Contact for our response times.
Please contact us first so we can try to put things right. We will acknowledge a complaint within 5 working days. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority: ico.org.uk/make-a-complaint, helpline 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
13. Third-party websites
Listings and other pages link to external websites, including services’ own sites and regulator records at the CQC, the Care Inspectorate, Care Inspectorate Wales and the RQIA. We are not responsible for their content or privacy practices; please read their notices.
14. Changes to this policy
We may update this policy to reflect changes to the Site or the law. We will change the “Last updated” date above and, for significant changes, take reasonable steps to make you aware.