Privacy Policy

Last updated: 26 September 2026 · Effective immediately

Summary: We collect what we need to connect dental nurses with practices, check that nurses are safe to work, pay people and keep the records the law requires. We never sell your data. Usage analytics is off unless you switch it on. You can delete your account at any time; section 7 explains what the law makes us keep.

1. Who We Are (Data Controller)

STANDYBY LTD, trading as Standby Dental ("we", "us", "our"), is the data controller for personal data processed through the Standby Dental app, web app and website (the "Service"). We are a private limited company registered in England & Wales, company number 17123434, registered office 9 Wilson Avenue, Keyworth, Nottingham NG12 5SY. We are registered with the Information Commissioner's Office, registration reference ZC234564.

Contact for anything in this policy: info@standbydental.com, or write to the registered office.

2. Information We Collect

Information you give us

Account information: name, email address, phone number, role (nurse or practice), password (stored by Google Firebase Authentication, never visible to us).
Professional information (nurses): GDC registration number and register status, qualifications, years of experience, skills and specialties, availability, travel radius and shift preferences.
Vetting documents (nurses):
- Enhanced DBS certificate details and a copy of the certificate (criminal-offence data);
- Hepatitis B immunisation evidence, such as a vaccination record or antibody test result (health data);
- proof of identity and right to work, such as a passport, visa or share code;
- professional indemnity insurance details and certificate;
- CPD and Basic Life Support (BLS) certificates.
Practice information: practice name, address, CQC registration, practice software, and the name, email and phone number of the person who manages the account.
Practice applications: if you apply through the form on our website we receive the practice name, your name, email, phone, location and your message.
Payment information: nurses' bank details for payouts and practices' card details are entered into and held by Stripe; we see only the last digits and payment status.
Profile photo (optional), messages between nurses and practices, support requests, and timesheets (hours, breaks, approvals).

Information collected automatically

Location when a practice confirms arrival (practices, optional): if a practice taps “Confirm nurse arrived” on a shift, we record that device's position at that moment. Nurses are no longer asked to check in or out with GPS; attendance is recorded by the post-shift timesheet.
Approximate location on the live map (nurses, optional): only if you switch on “Available now”, we read your position once and store it deliberately blurred by about 150 metres, so nearby practices can see roughly where available nurses are. It is never tracked in the background, and you can switch it off at any time.
Availability and standby locations (nurses, optional): if you add a location to an availability slot or to standby cover, we use it to find shifts near that place.
Push-notification token so we can send you shift updates.
Crash reports (Android and iOS app): device model, operating-system and app version, and the error that occurred.
Security tokens (Firebase App Check) that prove requests come from our genuine app.
Usage analytics — only if you switch it on (Settings → Privacy → Usage Analytics): which screens and features are used. No account id is attached.

3. What We Use It For, and Our Lawful Basis

Each purpose below has one lawful basis under Article 6 UK GDPR. Where special-category or criminal-offence data is involved, the additional condition is shown too.

Purpose	Data used	Lawful basis
Create and run your account; post, find, book and manage shifts; messaging	Account, professional and practice information, messages	Contract (Art 6(1)(b))
Consider a practice application sent through our website	Application form details	Steps before entering a contract (Art 6(1)(b))
Check a nurse's GDC registration, identity, right to work, indemnity and training before they can accept shifts	GDC number, ID and right-to-work documents, indemnity, CPD/BLS	Legitimate interests (Art 6(1)(f)): practices can only safely and lawfully use checked professionals, and patients must be protected
Check Hepatitis B immunisation status	Immunisation evidence (health data)	Legitimate interests (Art 6(1)(f)) plus Art 9(2)(b) with DPA 2018 Sch 1 Pt 1 para 1 (obligations in connection with employment) and Art 9(2)(g) with Sch 1 Pt 2 para 18 (safeguarding of individuals at risk)
Check Enhanced DBS status	DBS certificate details (criminal-offence data)	Legitimate interests (Art 6(1)(f)) plus Art 10 with DPA 2018 Sch 1 Pt 1 para 1 and Pt 2 para 18
Show nurses who have switched on “Available now” on practices' live map, and use availability or standby locations to find nearby shifts	Blurred location, name, photo, skills, check status	Consent (Art 6(1)(a)): switched on by the nurse, and off again at any time
Record attendance at a shift (post-shift timesheet, optional practice arrival confirmation) and resolve disputes about it	Timesheets; location at arrival confirmation where a practice uses it	Contract (Art 6(1)(b)) and legitimate interests (Art 6(1)(f))
Order and suggest shifts and nurses (see section 4)	Distance, availability, skills, preferences, shift history	Legitimate interests (Art 6(1)(f))
Take payments, pay nurses, issue invoices	Payment and bank details (held by Stripe), shift and timesheet records	Contract (Art 6(1)(b))
Keep accounting and tax records	Invoices, payout and shift records	Legal obligation (Art 6(1)(c)): Companies Act 2006 s.386–388, Taxes Management Act 1970 and VAT record-keeping rules
Service messages about your shifts, payments and account (push, in-app, email)	Contact details, push token	Contract (Art 6(1)(b))
Keep the Service secure, prevent fraud, fix crashes	Security tokens, crash reports, account activity	Legitimate interests (Art 6(1)(f))
Answer support requests	Your message and account details	Contract (Art 6(1)(b))
Usage analytics to improve the Service	Screens and features used, no account id	Consent (Art 6(1)(a)), switched on by you in Settings
Establish, exercise or defend legal claims	Records relevant to the claim	Legitimate interests (Art 6(1)(f)); Art 9(2)(f) for any health data

Who sees vetting documents: our verification team, to check them. Practices see whether each check is complete, not the documents themselves, unless you choose to share a document with them in the app. We keep an appropriate policy document and a data protection impact assessment covering vetting, location data and matching.

Marketing: we do not currently send marketing messages. The emails and notifications we send are about shifts, payments and your account. If we ever introduce marketing we will ask first, and every message will include a simple way to unsubscribe.

4. How Shift Matching and Ranking Work

Nurses' shift feed: shows open shifts within the travel radius you set. Shifts are ordered by how well they fit you: distance, pay rate, how urgent the shift is, whether you have worked at that practice before, and the preferences you chose.
Suggested nurses for practices: nurses are ordered by availability on the shift date, skills and specialties, experience, distance, whether they have worked at the practice before, and whether their checks are complete. These are suggestions; the practice decides whom to book.
Standby cover: if a confirmed nurse cancels at short notice, the shift is offered to up to 20 nurses who have opted in to standby cover. They are ordered half by distance and half by a reliability score. The score starts at 80 out of 100 and goes up by 2 for each completed shift and by 5 for each standby shift accepted. Cancelling a shift does not lower it. The first nurse to accept is booked.
Ratings and reviews are coming soon and are not used for any ordering while they are switched off.

None of this is a decision made solely by automated means that has a legal or similarly significant effect on you: whether you can accept shifts depends on your documents being checked by a person on our team, and practices choose whom to book. If you think an ordering or score about you is wrong, email info@standbydental.com and a person will review it.

5. Who We Share Data With

We never sell your personal data. We share it only with:

Google (Firebase and Google Cloud) — our processor for hosting, database, file storage, sign-in, cloud functions, push notifications, crash reporting and (if you opt in) analytics, under the Google Cloud Data Processing Addendum.
Stripe — processes card payments and payouts. Stripe is an independent controller for the identity, payment and anti-fraud data it must keep as a regulated payment provider, and our processor for the rest, under the Stripe Services Agreement and Data Processing Agreement.
Apple and Google — deliver push notifications to your device, as processors.
Our support-assistant provider — when you use the in-app help assistant, the text you type is sent to an AI language-model provider to generate the reply, as our processor. Please do not include patient details or other sensitive information.
Ideal Postcodes — UK postcode lookup when a practice enters its address; only the postcode is sent.
The General Dental Council's public register — we look up the registration number you give us; we send the GDC nothing else.
The other party to a booking — nurses see the practice's name, address and contact details for a booked shift; practices see a nurse's name, photo and check status.
Verified practices using the live map — see the name, photo, skills, check status and blurred location of nurses who have switched on “Available now”.
HMRC, regulators, courts and the police — only where the law requires it.

We have no joint-controller arrangements.

6. Where Your Data Is Stored (International Transfers)

Our database and file storage are hosted by Google in the United States, and some of our server functions run in the United States and some in London. Stripe and our support-assistant provider also process data in the United States.

Where a US recipient is certified under the UK Extension to the EU–US Data Privacy Framework, the transfer relies on the UK–US data bridge. Otherwise it relies on the UK International Data Transfer Addendum to the EU standard contractual clauses in that provider's data processing terms. Email us for a copy of the safeguards that apply.

7. How Long We Keep Data

Data	How long
Account and profile	While your account is open; erased within 30 days of deleting your account
Vetting documents (DBS, Hepatitis B, ID, right to work, indemnity, CPD/BLS)	While your account is open, so checks stay current and any practice you share with can see them; erased automatically, with their files, when your account is deleted
Invoices, payment and payout records, completed shifts and timesheets	6 years after the end of the financial year they relate to, then erased. After you delete your account they are kept in restricted form: they still identify who was paid and for what, and are used only for tax, accounting and legal claims
GPS position at arrival confirmation (and historic nurse check-ins before October 2026)	90 days, then removed automatically; only the confirmed / not-confirmed result stays on the shift
Blurred live-map location	Removed automatically 24 hours after you were last active (and hidden from the map at the end of the day you switched it on)
Availability and standby locations	Removed automatically once the day has passed
Messages, notifications and support requests	While your account is open (you can delete notifications at any time); erased when your account is deleted
Practice applications from our website	Deleted automatically 12 months after they were sent
Crash reports	90 days
Usage analytics (only if you opted in)	No longer than 14 months

Our own backups and our providers' backups roll off on their normal cycle after the periods above.

8. Your Rights

Under UK GDPR you can ask us to:

give you a copy of your data (access), or give it to you in a machine-readable format (portability);
correct inaccurate data;
erase your data (subject to the records in section 7 that the law makes us keep);
restrict how we use it, or object to processing based on legitimate interests;
have a person review any score or ordering described in section 4;
withdraw consent at any time (for analytics: Settings → Privacy).

Use Settings → GDPR & Data in the app, or email info@standbydental.com. We reply within one month.

9. Security

Encryption in transit (TLS) and at rest.
Access rules on every database collection, tested automatically; vetting documents are readable only by you, our verification team and practices you choose to share with.
Firebase App Check to block traffic that does not come from our genuine app.
Card and bank details handled by Stripe (PCI-DSS Level 1); we never hold full card or account numbers.

10. Children

The Service is for professionals aged 18 or over. We do not knowingly collect data from anyone under 18.

11. Cookies and Device Storage

Where	What	Purpose	Consent needed?
This website (standbydental.co.uk)	Nothing. No cookies, no local storage, no analytics or tracking. Fonts load from Google Fonts, which receives your IP address to deliver the font file.	—	No
Web app and mobile app	Sign-in session (Firebase Authentication), security token (App Check), your app settings such as theme	Keep you signed in, protect the Service, remember choices you made	No — strictly necessary
Web app and mobile app	Google Analytics for Firebase identifiers and cookies	Usage statistics	Yes — off until you switch on Settings → Privacy → Usage Analytics. Nothing is loaded or stored until then.

We use no advertising cookies and no third-party ad tracking.

12. Changes to This Policy

We will tell you about material changes in the app or by email before they take effect.

13. Contact and Complaints

Email: info@standbydental.com
Post: STANDYBY LTD, 9 Wilson Avenue, Keyworth, Nottingham NG12 5SY
In the app: Settings → GDPR & Data

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.