Privacy Policy

Last updated: 1 July 2026

1. Who we are

CareHomeDesk is operated by CareHomeDesk Ltd, a company registered in England and Wales (Company No. 17376664), registered office 15 Parker Road, Colchester, Essex, CO4 5BE. CareHomeDesk Ltd is not currently VAT registered. We provide a SaaS compliance and operations platform for UK care homes. In this policy "we", "us" and "our" refer to CareHomeDesk Ltd. We are the data controller for personal data processed through our website and platform.

Contact: privacy@carehomedesk.co.uk

2. What data we collect

We collect the following categories of personal data:

• Account data — name, work email address, job title, and care home name provided when you register or are invited by your organisation.
• Usage data — pages visited, features used, session timestamps, and actions taken within the platform, collected automatically.
• Communications data — messages you send via our Ask feature, support requests, and any correspondence with us.
• Technical data — IP address, browser type, device identifiers, and log data collected via our infrastructure.
• Payment data — billing contact details. Card numbers are processed directly by our payment provider and are not stored by us.

We do not knowingly collect special category data. If your use of the platform involves entering resident information, you do so as a data controller and we act as your data processor under a separate Data Processing Agreement.

2a. Photographs and file uploads

Ask. If you upload a photograph to Ask, it is sent to Anthropic's API as part of your question and processed there to generate a response. Do not upload photographs containing residents, medical information, resident records, or any other confidential or personal information you do not have permission to share. See our Terms of Use for the full upload policy.

Fire Door Checker. Photographs taken within the Fire Door Checker tool are held only on your own device and are never transmitted to our servers or to any third party. They are used solely to build a PDF report generated in your browser. We do not receive, store, or have access to these photographs.

3. How we use your data

We process personal data for the following purposes and legal bases:

• Contract performance — to provide, maintain, and support your access to CareHomeDesk.
• Legitimate interests — to improve our product, detect fraud, ensure platform security, and send product updates relevant to your role.
• Legal obligation — to comply with our obligations under UK law, including responding to lawful requests from regulatory or law enforcement authorities.
• Consent — to send marketing communications where you have opted in. You may withdraw consent at any time.

4. Cookies

We use strictly necessary cookies to keep you signed in and to maintain session state. We do not currently use analytics or tracking cookies. See our Cookie Policy for full details.

5. Who we share data with

We do not sell your personal data. We share data only with:

• Supabase — database and authentication infrastructure, hosted in the EU (Frankfurt).
• Vercel — website and application hosting.
• Stripe — payment processing.
• Anthropic — powering the Ask feature, including photograph analysis where you choose to upload an image. Prompts and images sent to Ask are processed by Anthropic's API to generate a response. See Anthropic's own data handling terms at anthropic.com for how they handle this data.
• Professional advisers — legal, accounting, or insurance advisers, under confidentiality obligations.
• Regulators and authorities — where required by law.

All sub-processors are bound by appropriate data processing agreements and provide sufficient guarantees of compliance with UK GDPR.

6. International transfers

We store your data primarily within the UK and EU. Where data is transferred outside these regions we rely on UK International Data Transfer Agreements (IDTAs) or equivalent adequacy mechanisms.

7. How long we intend to keep your data

These are the retention periods we intend to apply. We are not yet able to confirm these are enforced by an automated process in every case; until that is in place, requests for earlier deletion will be handled manually on request.

• Account data — we intend to retain this for the duration of your subscription plus 12 months following termination, unless you request earlier deletion.
• Usage and technical data — we intend to retain this for up to 24 months.
• Financial records — retained for 7 years as required by UK tax law.

8. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your data where there is no longer a lawful basis for processing.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests, including profiling.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email privacy@carehomedesk.co.uk. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Data security

We use industry-standard security measures including TLS encryption in transit, encryption at rest, role-based access controls, and regular security reviews. Access to personal data is restricted to authorised personnel on a need-to-know basis.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or via an in-app notice at least 14 days before taking effect.

11. Contact us

For any privacy-related queries, contact our Data Protection lead at privacy@carehomedesk.co.uk or write to: CareHomeDesk Ltd, Data Protection, 15 Parker Road, Colchester, Essex, CO4 5BE, Company No. 17376664, registered in England and Wales.