Privacy Policy

Care Unveil Ltd, trading as CareUnveil (“CareUnveil”, “we”, “our” or “us”), is committed to protecting your privacy and handling personal data responsibly.

This Privacy Policy explains how we collect, use, store and protect personal information when you:

• visit our website;
• request a demonstration;
• contact us;
• use the CareUnveil platform or mobile application; or
• otherwise interact with our services.

We aim to process personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable data protection laws.

The role CareUnveil performs depends on how personal information is collected and used.

When we collect information directly through our website, sales enquiries, account administration, security processes or business communications, Care Unveil Ltd may act as the data controller.

When a care provider uses CareUnveil to record and manage information about residents, service users, staff members, family members, authorised representatives or care delivery, the care provider will usually act as the data controller and CareUnveil will act as its data processor.

In those circumstances, the relevant care provider determines why the personal information is processed and is responsible for responding to requests from residents, service users, staff members, family members and other data subjects.

Information you provide directly

We may collect information including:

• your name;
• email address;
• telephone number;
• organisation name;
• job title;
• messages submitted through contact forms;
• demo or sales enquiry details; and
• communications you send to us.

Account and user information

When an organisation uses CareUnveil, we may process:

• staff names and contact details;
• user account information;
• roles and permissions;
• authentication and login information, including information used for multi factor authentication;
• account activity; and
• audit and security logs.

Family members and authorised representatives

Where a care provider uses CareUnveil's family or representative access features, we may process information such as:

• name;
• email address and contact information;
• relationship to a resident or service user;
• account information;
• access permissions; and
• information about access to approved records or features.

The care provider controls whether access is granted and what information is made available, subject to the functionality of the CareUnveil service.

Care and service user information

Our customers may use the CareUnveil platform to store and manage information such as:

• resident or service user details;
• care notes and daily records;
• incident and accident reports;
• assessments and care plans;
• medication related records;
• health and wellbeing information;
• care visits and related records;
• location information associated with care visits where location enabled features are used;
• attachments and supporting documents; and
• audit histories.

This information may include special category personal data, including health information. It is entered into the platform by our customers and remains under their control.

Location information

Some CareUnveil features may use or record location information, for example where an authorised user uses location enabled functionality in connection with a care visit.

Where location information is processed on behalf of a care provider, the care provider is responsible for determining the purpose and lawful basis for that processing. Device permissions may also control whether location information can be accessed by the application.

Technical information

When you use our website or services, we may automatically collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• pages visited;
• dates and times of access;
• application logs;
• diagnostic information; and
• security information.

We may use personal information to:

• provide and operate our services;
• create and manage user accounts;
• authenticate users and control access;
• provide multi factor authentication and other account security features;
• support care visit and location enabled features where configured by our customers;
• respond to enquiries and demo requests;
• provide customer support and onboarding;
• maintain the security of our services;
• investigate errors and technical issues;
• improve the performance and usability of CareUnveil;
• communicate service related information;
• prevent fraud, misuse and unauthorised access;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal claims.

Where CareUnveil acts as a data controller, we may rely on one or more of the following lawful bases:

• Contract: where processing is necessary to provide our services or take steps at your request before entering into a contract.
• Legitimate interests: where processing is necessary for our legitimate business interests and those interests are not overridden by your rights.
• Consent: where you have given us clear permission for a particular purpose.
• Legal obligation: where processing is necessary for us to comply with the law.

Where CareUnveil acts as a data processor, the relevant customer is responsible for identifying the lawful basis and any additional condition required for processing special category data.

We may use cookies and similar technologies to operate and secure our website, remember preferences and understand how our website is used.

Where analytics services are enabled, information processed may include:

• pages visited;
• browser and device information;
• approximate location;
• referral source;
• time spent on pages; and
• general website interaction information.

We may also use security and anti abuse technologies, such as Google reCAPTCHA, to help protect forms and services from spam, automated activity and misuse. These services may process technical information about your browser, device and interactions for security purposes.

Where consent is required by law, non essential cookies and similar technologies will only be used after you have provided consent. You can also control cookies through your browser settings and any cookie controls we make available.

We do not sell personal information.

We may share or make information available to carefully selected third party service providers where necessary to operate, secure and support CareUnveil. These may include:

• cloud infrastructure, database and hosting providers;
• email and communication service providers;
• authentication and multi factor authentication providers;
• website analytics providers where analytics are enabled;
• security, anti abuse and monitoring providers;
• technical support providers;
• professional advisers; and
• regulators, law enforcement bodies or public authorities where disclosure is required or permitted by law.

Where a service provider processes personal information on our behalf, it is only permitted to process that information for the agreed purpose and must protect it appropriately.

We may also disclose information as part of a business sale, merger, restructuring or transfer, subject to appropriate confidentiality and data protection safeguards.

Some of the service providers we use may process personal information outside the United Kingdom.

Where personal information is transferred outside the United Kingdom, we take steps to ensure that appropriate safeguards are in place as required by applicable data protection law. Depending on the circumstances, these may include UK adequacy regulations, approved contractual protections or other lawful transfer mechanisms.

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction.

These measures may include:

• encrypted connections using HTTPS;
• authenticated user access;
• multi factor authentication where enabled or required;
• role based permissions;
• audit and activity logging;
• secure cloud infrastructure;
• access restrictions;
• security monitoring;
• backup and recovery measures where applicable; and
• regular software and security updates.

No electronic transmission or storage system can be guaranteed to be completely secure. However, we regularly review our safeguards and work to reduce security risks.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or processed.

When determining appropriate retention periods, we may consider:

• how long the information is required to provide our services;
• contractual requirements and customer instructions;
• applicable legal and regulatory requirements;
• security, fraud prevention and audit requirements;
• the need to resolve disputes or complaints;
• the establishment, exercise or defence of legal claims; and
• the nature and sensitivity of the information.

Different categories of information may therefore be retained for different periods.

Our customers are responsible for determining appropriate retention periods for care records and other information for which they are the data controller within the CareUnveil platform.

When a customer account or contract ends, information will be handled in accordance with our contractual arrangements, customer instructions, legal obligations and applicable retention and deletion procedures.

Some information may remain temporarily within secure backups after deletion from active systems until those backups are overwritten or expire in accordance with our backup and retention procedures.

Depending on the circumstances and applicable law, you may have the right to:

• request access to your personal information;
• request correction of inaccurate information;
• request deletion of your information;
• request restriction of processing;
• object to processing;
• request data portability;
• withdraw consent where processing relies on consent; and
• complain to a data protection authority.

These rights are not absolute and may be limited in certain circumstances.

Where your information has been entered into CareUnveil by a care provider, employer or other customer, you should normally contact that organisation first. As the data controller, it is usually responsible for responding to your request.

Where CareUnveil acts as the processor, we will provide reasonable assistance to the relevant customer in responding to data protection requests in accordance with our contractual and legal obligations.

The CareUnveil public website is primarily intended for care organisations and professionals and is not directed at children.

CareUnveil may process information relating to a child or young person where that information is entered into or managed through the service by an authorised care provider or other customer.

In those circumstances, the relevant customer will usually act as the data controller and is responsible for ensuring that the processing is lawful and appropriate.

Our website may contain links to third party websites or services. We do not control those websites and are not responsible for their privacy practices.

We recommend reviewing the privacy information of any third party service before providing personal information to it.

We may update this Privacy Policy from time to time to reflect changes to our services, legal obligations, security practices or data handling activities.

The latest version will be published on this page with the date it was last updated.

If you have questions about this Privacy Policy, your personal information, how CareUnveil processes personal information, or if you would like to exercise your data protection rights, please contact Care Unveil Ltd using our contact form.

You also have the right to raise a concern with the Information Commissioner's Office (ICO) if you believe your personal information has been handled unlawfully. We would appreciate the opportunity to address your concerns first, where appropriate.