Privacy Policy

1. Who we are

CareDeck Ltd ("CareDeck", "we", "us", "our") is a company registered in England and Wales. We provide care management and CQC compliance software to UK care homes. Our Data Protection contact is dpo@caredeck.co.uk.

2. What data we collect

We collect the following categories of personal data:

• Account data — name, email address, role, and employer when you register.
• Resident data — care plan content, health records, and other information entered by care home staff. This is processed on behalf of the care home as data controller.
• Usage data — log files, session identifiers, and anonymised feature usage analytics to improve the platform.
• Communications — emails and support messages you send to us.

3. How we use your data

• To provide and improve the CareDeck platform.
• To send transactional emails (account confirmations, password resets, important notices).
• To respond to support and sales enquiries.
• To comply with our legal obligations.

4. Legal basis for processing

We process personal data under the following legal bases (UK GDPR Article 6, and Article 9 where special category data is involved):

• Contract — to fulfil our service agreement with your care home.
• Legitimate interests — platform security, fraud prevention, and product improvement.
• Legal obligation — where required by applicable law.

5. Data storage and residency

All personal data is stored on UK-based servers. We do not transfer personal data outside the United Kingdom.

6. Data retention

We retain account data for as long as your subscription is active, plus six years thereafter (Companies Act requirements). Resident data is retained for the period agreed in your data processing agreement and deleted on request after contract termination.

7. Your rights

Under UK GDPR you have the right to: access your data; rectify inaccurate data; erase your data (subject to legal obligations); restrict processing; data portability; and object to processing. To exercise any right, contact dpo@caredeck.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Third-party processors

We use a small number of third-party sub-processors (e.g. payment processing via Stripe, email delivery via Resend, file storage via Cloudinary). All sub-processors are contractually bound to process data only on our documented instructions and to maintain appropriate security measures. A full list is available on request.

9. Cookies

See our Cookie Policy for full details of the cookies we use and how to control them.

10. Changes to this policy

We will notify you of material changes by email or via an in-app notice at least 14 days before they take effect. The date at the top of this page reflects the most recent update.

11. Contact

For any privacy-related queries, contact our Data Protection Officer at dpo@caredeck.co.uk.