Skip to content

Privacy Policy

Last updated: 21 October 2026

1. Who we are

CareRecorda is a CQC compliance management platform operated by [to be confirmed].

For questions about this policy or your data, contact us at privacy@carerecorda.co.uk.

2. What data we collect

We collect the following when you use CareRecorda:

  • Account data — your email address and password (stored securely via Supabase Auth).
  • Organisation details — your care home name, CQC location ID, manager name, local authority, and other details you enter during setup.
  • Compliance records — data you enter into trackers, including staff names, certificate expiry dates, NMC pin numbers, residents' initials and action plan details.
  • Usage data — page visits and actions within the platform, collected automatically by our hosting provider (Vercel).

CareRecorda records how your home meets its compliance duties. It is not a care record system: don't use it for residents' care plans, clinical notes or medication records. Compliance records hold residents' initials, not names. The Residents list holds residents' names, dates of birth, room, funding source and admission and discharge dates. Only Owners, Managers and Seniors can see it. When AI features are switched on, the app replaces the resident and staff names it holds with initials or a role before anything is sent, and never sends a resident's date of birth. A name typed into a free-text box may not be caught (one the app doesn't hold, or one that is also an everyday word, such as June or Rose), which is why staff are asked to write initials only. Some registers hold health and capacity information about residents (for example DoLS and capacity decisions), and some staff records hold health information about staff. We don't collect NHS numbers.

3. How we use your data

  • To provide and maintain your CareRecorda account.
  • To run the AI features when someone in your home uses them (see section 5 for exactly what each one sends).
  • To send you weekly compliance alert emails when certificates, NMC pins, DoLS authorisations, or action plans need attention.
  • To manage your account, billing, and team members.
  • To respond to support requests.

Our legal basis for processing is contract (to deliver the service you subscribed to) and legitimate interests (compliance alerts and service improvement).

4. Data storage and security

Your data is stored in the European Union (Ireland, AWS eu-west-1 region) via Supabase. All data is encrypted in transit (TLS) and at rest.

We use row-level security on the database so that each care home can only access its own data. Access is restricted to authorised team members you invite.

5. Third parties we share data with

Supabase

Database and authentication provider. Data stored in EU (Ireland). Privacy policy.

Anthropic (United States)

Our AI provider. It's only used when someone in your home uses one of the AI features below, and nothing is sent to it otherwise. Your home can switch all of them off in Settings.

  • The Assistant (Owners and Managers). Sends the question, your home's details from Settings, and the records it looks up to answer: your registers, your Actions and your Residents list. Its Residents list is sent as initials only: no names, rooms or dates of birth. People you list in Settings are sent by their role, never their name or phone number. It can't read staff records: staff files, training, qualifications, supervision, NMC PINs, recruitment, probation, staff adjustments, staff health assessments, HR cases, or incidents of work-related staff illness.
  • Think it through, on an incident (Owners and Managers). Sends that incident's details, including the resident's initials and what was written about it, and the dates and types of related incidents. It doesn't send who the incident was reported to, and it isn't available for work-related staff illness.
  • PIR and monthly report drafts (Owners and Managers). Send dates, types, statuses and counts from your registers, your own evidence-page answers, and the app's alerts, which can include residents' initials. No incident descriptions.
  • Draft from our records, on an evidence page. Sends the question, your home's name, a few details from Settings (your safeguarding lead and registered manager by role, not by name), some counts, and for Strengthen this, the answer you've already written.

Before anything is sent, names the app holds are taken out of what people have written: a resident's name becomes their initials, a resident's date of birth is removed, a member of staff becomes "a member of staff" and someone listed in Settings becomes their role. A name typed into a free-text box may not be caught: one the app doesn't hold, such as a relative's or a GP's, or one that is also an everyday word, such as June or Rose, written on its own or in lower case. That is why staff are asked to write initials only.

What was asked and what came back is kept in your workspace until your account is deleted. Privacy policy.

Resend

Email delivery provider used to send weekly compliance alert emails. Your email address and alert content are processed by Resend. Privacy policy.

Vercel

Hosting and infrastructure provider. Processes request logs and usage data. Privacy policy.

Stripe (planned)

Payment processing. Billing information is handled directly by Stripe and is not stored by us. Privacy policy.

We do not sell your data to third parties.

6. Data retention

We retain your data for as long as your subscription is active. If you cancel and request deletion, we will delete your account and associated data within 30 days, except where we are required to retain records by law.

7. Your rights under UK GDPR

You have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate data.
  • Erasure — ask us to delete your data ("right to be forgotten").
  • Portability — receive your data in a machine-readable format.
  • Restriction — ask us to limit how we process your data.
  • Objection — object to processing based on legitimate interests.

To exercise any of these rights, email us at privacy@carerecorda.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use session cookies only — these are essential for keeping you logged in and are not used for tracking or advertising. We do not use third-party analytics cookies.

9. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email. The "last updated" date at the top of this page reflects the most recent revision.