Privacy Policy

Rostera is a workforce-management application for UK home-care and supported-living providers. It helps care staff view their rota, clock in and out of visits, and complete digital care records, and helps managers run rotas, timesheets, payroll and staff records.

Rostera is provided to care organisations (“your employer” or the “care provider”). For most personal data processed through the app, the care provider that employs or engages you is the data controller and Rostera acts as a data processor on their behalf, under a written data-processing agreement. This policy explains, in plain terms, what data the app handles and why.

• Identity & contact details — your name, email address and phone number, used to create and secure your account and to send you work notifications.
• Employment & rota data — your role, assigned branch/site, shifts, clock-in history, leave requests and balances, and (where your employer records them) compliance details such as DBS or professional-registration expiry dates and pay information for payslips.
• Location data — when you tap Clock In or Clock Out, the app reads your device’s GPS location at that moment to confirm you are within the agreed area of the visit location. This is a safeguarding and timesheet-accuracy requirement of care work. The app does not track your location in the background or at any other time.
• Care records you enter — notes, observations and checks you record about the people you support. This may include health and care information and is processed strictly on behalf of, and under the instructions of, the care provider.
• Device & technical data — a push-notification token for your device (so we can deliver shift alerts), and basic technical information needed to operate and secure the service.

Under UK GDPR we rely on the following legal bases:

• Performance of a contract / legitimate interests of your employer — to run rotas, verify attendance via clock-in, process leave and pay, and operate the service you use for work.
• Legal obligation — to support your employer’s record-keeping, safeguarding and regulatory duties (for example, CQC requirements).
• Consent — device location permission and push notifications are enabled through your device’s own permission prompts, which you can change at any time in your device settings.

Location is used only at the instant you clock in or out, to calculate the distance between your device and the visit’s registered location. If you are within the permitted radius, your clock-in is recorded; if not, you are shown how far away you are. We do not collect a continuous location history and the app requests location only while it is in use.

We do not sell your personal data. Data is accessible to your employer (the care provider) and to authorised Rostera staff and sub-processors who help us run the service — for example, our cloud hosting, database, email and push-notification providers. These providers act under contract and only process data as needed to deliver the service.

We retain personal data for as long as your employer’s account is active and as their data-processing agreement and legal obligations require. When an account or record is deleted, we remove or anonymise the associated data within a reasonable period, except where we must retain it to meet a legal obligation.

Data is encrypted in transit using standard HTTPS/TLS. Access is restricted by role, accounts are protected by passwords (and email verification), and tenant data is isolated so each care provider can only access its own organisation’s information.

Under UK GDPR you have the right to access, correct, delete or restrict the processing of your personal data, and to object to certain processing. As most data is controlled by your employer, please raise such requests with them in the first instance; we will support them in responding. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Rostera is a workplace tool intended for use by adults and is not directed at children.

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above.

For any privacy question about the Rostera app, contact us at admin@rostera.co.uk. For data held about you by your employer, please also contact your employer’s data-protection lead.