Privacy Policy

1. Who we are

Care360 is care management software for UK care providers, operated by RB Stackworks Ltd, a company registered in England and Wales (company number 17485375), registered office Suite RA01, 195-197 Wood Street, London, E17 3NU. We are registered with the Information Commissioner's Office under reference ZC260553.

In this policy "we", "us" and "Care360" mean that company. You can reach us about anything in this policy at hello@care360.cloud.

2. The two different roles we play

This is the most important thing to understand about how we handle data, and it determines who is responsible for what.

• We are a controller for the personal data of people who visit this website, request a demo, or contact us. We decide why and how that data is used, and this policy explains it in Part A. We are also the controller for the training sign-offs we collect from care staff and for our records of dealings with providers, such as licence requests (Part A, "Training sign-offs and dealings with providers").
• We are a processor for the care records and staff data inside the Care360 application. The care provider who subscribes to Care360 is the controller of that data. They decide what is recorded and why; we hold and process it on their documented instructions. Part B explains what that means in practice.

If you are a person supported by a care provider that uses Care360, or a member of their staff, and you want to exercise your data protection rights over your care or employment records, your request should go to that provider, not to us. They are the controller. We will support them in responding. A training sign-off is the exception: while we hold it, ask us.

Part A. When you use this website or contact us

What we collect

Our lawful basis

For responding to a demo request or enquiry we rely on legitimate interests (UK GDPR Article 6(1)(f)): you have asked us about a business product and it is in both our interests that we reply. You can object to this at any time and we will stop.

For keeping the website secure and operational we also rely on legitimate interests. Where we are required to keep records for tax or legal reasons we rely on legal obligation (Article 6(1)(c)).

Training sign-offs and dealings with providers

When care staff confirm their Care360 training through a link we send them, we record their name, the email they give, their job role, their drawn signature, when they signed, a copy of what they signed (which names their employer) and a description of their device, and we email them a copy as a receipt. We do this to give their care provider evidence that its staff completed their Care360 training, relying on legitimate interests (Article 6(1)(f)). We keep the record only until we have given it to the care provider, and then we delete it from our systems; our email provider keeps its delivery log for a limited period.

We also keep records of our dealings with providers: for example, when a provider's manager asks for more staff licences, the request and the name or email of the person who asked, and the address we sent an organisation's connection details to. We keep these to manage our contract with the provider, relying on legitimate interests, as part of the customer relationship described below.

Please do not include information about the people you support in the demo form. We do not need it, and the form is not the right place for health or care information.

Cookies and tracking

This website sets no cookies and runs no analytics, advertising or tracking scripts. We do not profile you and we do not share your browsing behaviour with anyone.

This site makes no requests to any third party. Typefaces, images and styles are all served from care360.cloud itself. Loading a page here does not tell Google, an advertising network, or anyone else that you visited, and there is no consent banner because there is nothing to consent to. The Care360 application and apps are different: they load their typefaces from Google, as section 3 explains.

If we introduce analytics in future we will update this policy before we do, and we will ask for your consent where the law requires it.

How long we keep it

Demo enquiries are kept for 24 months from your last contact with us, then deleted, unless you become a customer, in which case the data moves into the customer relationship and is kept for the duration of the contract and for six years afterwards for legal and accounting purposes. Server logs are kept for a short operational period only.

Part B. Care records inside the Care360 application

When a care provider subscribes to Care360, their staff record information about the people they support. That includes special category data under Article 9 of the UK GDPR, because health and care information is more sensitive and attracts extra protection.

The care provider is the controller. They decide what is recorded, why, and for how long, and they are responsible for having a lawful basis and an Article 9 condition for it. We act only on their instructions, set out in a written data processing agreement that meets the requirements of Article 28, with one exception it names: Apple's push notification service, which Apple provides only on its own standard terms (see section 3).

What the application holds

• Profile details of people receiving care, as each provider chooses to fill them in: name, date of birth, photograph, house and room, admission and review dates, NHS and RiO numbers, contact number, nationality status, next of kin, the names and contact details of their GP, psychiatrist and mental health team, diagnosis, mental health status, height and weight, mobility, falls risk, sensory aids, smoking, allergies and dietary requirements. Many of these are health data, and dietary requirements can reveal religious belief
• Records about people receiving care: daily notes, incidents, handovers, physical health, medication administration, professional meetings, risk, telephone contact and related categories, along with photographs where the provider chooses to use them
• Records about staff: name, work contact details, role, house assignments, shifts, clock in and clock out times and pay related information
• The names and addresses of the provider's houses
• Financial records held on behalf of the people supported, including petty cash entries and receipt images
• Documents such as care plans and policies, with a record of who viewed or downloaded each one and who confirmed reading it. A confirmation includes the person's drawn signature. Each view, download and confirmation also records a description of the device and browser used, known as its user agent (for example the type of phone or computer, its system version and the browser)
• Support requests sent with Contact support (see below)

How we protect it

• Access is scoped and enforced in the database. Support workers can reach only the houses and people they are assigned to. The rule is applied at the data layer through row level security, not only in the interface.
• Sign in normally needs no password. Staff sign in with a one time code sent to their work email, so they have no password to share, reuse or leak. A small number of accounts, such as our demonstration account for app store reviewers, use a password instead.
• Records are immutable once submitted. They cannot be edited or deleted through the application by anyone, including administrators. Corrections are made as new entries, or as a void with a written reason where the original stays visible.
• Every entry is attributed and timestamped, including whether it was written up late.
• Photographs and receipts are held in private storage and are reachable only through short lived signed links, never by a public address.
• Staff accounts can be revoked without deleting the person, so access ends immediately while historical records remain attributable, which the provider needs for their own audit trail.
• Documents are generated on our servers, with the permission check applied there, so restricted records are not sent to a browser that is not entitled to them.

Retention of care records

Retention is the provider's decision, because the legal duty is theirs. Adult social care records are generally retained in line with the Records Management Code of Practice, and providers should set their retention schedule against it and against their obligations under CQC Regulation 17. We hold records for as long as the provider instructs us to, and we delete or return them on termination as set out in our terms.

Contact support

The Contact support button in the application sends a request to the Care360 support team. The request includes what you choose and write (what it is about, how urgent it is, a summary and a description), any screenshot you attach, the screen you were on, your name, role and sign-in email address, your organisation's code, and a description of your device and browser. A request can contain anything you type or show in a screenshot, so please leave out details of the people you support unless we need them to help you.

The request is stored in your provider's records, with any screenshot in private storage. It is then emailed, with the screenshot attached, to our support mailbox through our email provider (see section 3). We reply to the email address you signed in with.

Part C. The Care360.Cloud apps for iPhone, iPad and Android

The mobile apps are a way to open the Care360 application on a phone or tablet. Care records are not stored in the app. They stay on our servers and are handled exactly as described in Part B.

What the app keeps on your device

• Your organisation details. The first time you open the app, you enter or scan an organisation code and access token from your care provider. The app checks them with our server, then keeps the code, the token and your provider's web address on your device so it can reconnect. They are replaced when you connect to a different organisation, and removed when you uninstall the app.
• Your sign-in. While you are signed in, the app keeps your sign-in on your device so that you don't have to sign in every time you open it. (The Care360 website is different: it signs you out when you close its tab or the browser, or after an hour without use.) Signing out removes it. So does switching to a different organisation in the app, which signs you out of the one you leave.
• Your PIN, if you set one. The PIN that locks the app is stored only on your device, as a one-way scrambled value. It is never sent to us.
• Your unlock choice. Whether you chose to unlock the app with Face ID, Touch ID or your fingerprint is kept on your device. Your face or fingerprint is never stored by the app or sent to us (see below).

Camera, photos and downloads

• The app uses the camera or your photo library only when you choose to photograph or attach something, such as a petty cash receipt or a profile photo, or to scan your organisation's QR code when you connect. A photo you attach is uploaded to your provider's records and held as described in Part B. A QR code is read on your device: the image is not kept or sent anywhere, and the app keeps only the organisation code and token it contains. You can withdraw camera and photo access at any time in your device settings.
• Documents you export, such as timesheets, are saved to your device or passed to the share sheet so you can save them where you choose. Once saved, that copy is on your device and under your provider's device policies.

Face ID, Touch ID and fingerprint unlock

If you choose to, you can unlock the app with Face ID, Touch ID or your fingerprint instead of your PIN. Your phone checks your face or fingerprint itself and tells the app only whether it was you. The app never receives your face or fingerprint data, and nothing about it is sent to us or to your provider. You can turn this off at any time in the app's App settings, and your PIN always works.

Your shifts in your phone's calendar

If you tap "Add to my calendar" on My rota, the app asks for access to your calendar, then copies your own upcoming shifts into a calendar called "Care360 shifts" on your device: the date, the start and end times, the type of shift and the name of the house. Nothing about the people you support is included. Each time you tap it again, the app updates those shifts, adding new ones and removing cancelled ones. The app reads back only the events it created, so that it can update them. It does not read or change any other calendar or event, and nothing from your calendar is sent to us.

On an iPhone or iPad that uses iCloud calendars, the "Care360 shifts" calendar is kept in iCloud and appears on your other Apple devices, under your own arrangement with Apple. On Android it stays on your phone.

To remove the shifts, choose "Remove Care360 shifts from my calendar" in App settings, or delete the "Care360 shifts" calendar in your calendar app. Uninstalling the app does not remove them. You can withdraw calendar access at any time in your device settings.

Notifications

If you allow notifications, the app registers your device so that you receive rota changes and reminders before your shifts. A device identifier created by the app and the push address issued for your device are stored with your account in your provider's records. They are removed when you sign out of the app.

Switching to a different organisation in the app signs you out of the one you leave and gives your device a new push address, so that organisation can no longer send notifications to it. If you switch from App settings, your registration is also removed from that provider's records. If you switch from the app's menu, or by connecting to another organisation's code, the old address can stay in their records, but it no longer works.

Your registration can also stay in your provider's records if:

• you sign out while your device has no connection. The app can't reach your provider's records to remove it, so notifications for you can still arrive on that device. Sign in and out again once you're connected;
• you uninstall the app without signing out. It is no longer used once Google's notification service reports that the app has gone from your device.

Notifications are delivered through Google's Firebase Cloud Messaging on Android, iPhone and iPad. On an iPhone or iPad, Google passes each notification on to Apple's Push Notification service, which delivers it to your device (see section 3). A notification can include the type, time and house of a shift, but nothing about the people you support. You can turn notifications off at any time in your device settings.

App settings

App settings shows the app's version, whether notifications are on and the organisation you are connected to, and lets you change the options above. It uses what is already on your device and collects nothing new, except a request you choose to send us from it with Contact support or Delete my account.

No advertising or tracking

The apps contain no advertising. We run no analytics of how you use the apps, and no tracking: we do not track you across other apps or websites, and we do not sell personal data.

Google's messaging component, which delivers notifications, is built into the apps. It sends Google an identifier for the app on your device and device details (such as model, language, time zone and system version), which Google uses to run and measure that service.

Deleting your Care360.Cloud account

This applies to the Care360.Cloud apps and the Care360 application, published by RB Stackworks Ltd. Staff accounts are created and removed by each care provider's administrators, so a deletion request is carried out by your provider.

To request deletion of your account:

1. In the app: Menu > App settings > Delete my account. This sends your request to Care360 support, who pass it to your provider.
2. Or ask your care provider's administrator to remove you. They can do it straight away from the Staff page in the application.
3. Or email hello@care360.cloud from your work email address with the subject "Account deletion request", naming your care provider. We pass the request to your provider, who is the controller of these records, and we respond within one month.

What is deleted, and what is kept:

• Deleted: your ability to sign in and your access to houses and the people supported. If there is nothing that has to be kept (no care records you wrote, no care plans or policies you signed, and no other records such as medicines or petty cash entries you made), your account and staff profile are deleted too.
• Kept: care records you wrote, care plans and policies you signed, and other records you made such as medicines and petty cash entries, which must stay attributable to you, and the deactivated staff profile they are attributed to, which can no longer sign in. Support requests you sent, including a deletion request, are kept as a record of what was asked and done. Your provider decides how long care records are kept, in line with the Records Management Code of Practice (see Retention of care records above). We hold them for as long as the provider instructs and delete or return them when the provider's contract with us ends, as set out in our terms.
• On your device: uninstalling the app removes everything it stored there, except shifts you added to your calendar, which stay until you remove them (see "Your shifts in your phone's calendar").

3. Who else processes data, and where

We use a small number of suppliers to run the service. Except where this section says otherwise, each is bound by a contract that meets Article 28, and none of them may use the data for their own purposes.

Where care records are held

Care records are held in the United Kingdom. The database and file storage for the application, and the hosting origin, are in London. Care records are not stored outside the UK.

Some data does leave the UK, and we would rather state it plainly than leave you to find it. Transactional email is delivered through infrastructure in Ireland. That covers sign in codes, welcome emails, notification emails and support requests, so the recipient's email address and the content of the message pass through, and our email provider keeps a delivery log for a limited period. We put no care records in the emails we send. A support request is the exception you control: it carries whatever its author writes or attaches (see Contact support in Part B).

Notifications to the apps are delivered through Google's Firebase Cloud Messaging, which runs on Google's global network and can process data in the United States. That covers the device's push address, the text of each notification, which can include the type, time and house of a shift, and a reference to the shift it is about, but nothing about the people supported. Google acts as our processor under its Firebase data processing terms. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), which the UK government has recognised as providing adequate protection for transfers to certified US organisations.

On an iPhone or iPad, Google passes each notification to Apple's Push Notification service, which runs on Apple's global network and can process data in the United States. Apple receives the address Apple issued for your device, the notification text and a reference to the shift it is about. Apple provides this service to every app developer on its own standard terms, not under a data processing contract with us. Under those terms Apple does not access or disclose the content of notifications unless it believes that is needed to comply with the law, enforce its terms, deal with security, fraud or technical problems, or protect people's rights or safety. It may also collect technical information about how we use the service, to improve its products and to check that we keep to its terms. Apple Inc. is not certified under the Data Privacy Framework. Apple's privacy policy says that its international transfers of personal data collected in the UK are governed by Standard Contractual Clauses.

The Care360 application and apps load their typefaces from Google Fonts. When your device opens the application it downloads them from Google, which receives your device's IP address and browser details and the address of the Care360 site, as with any web request. Nothing you enter in the application is sent. Google handles these requests under its own terms, not as our processor. Google LLC is certified under the UK-US data bridge described above.

Ireland is in the European Economic Area, which the UK government has designated as providing an adequate level of data protection. Transfers to it are therefore permitted under the UK GDPR without additional safeguards. Apart from Apple's notification service, described above, where we transfer personal data to a country without adequacy, we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment.

We also run a demonstration and testing environment, at app.care360.cloud, hosted in Ireland. It holds no care records about real people: the people supported in it are fictional, and live records are never copied into it. Its staff accounts are our own team's test accounts and the accounts we give app store reviewers.

The same Ireland hosting runs our platform service. It holds the directory of organisations that use Care360: each organisation's name, code, web address and access token, which the apps check when you connect to your provider. It also passes support requests and staff welcome emails from providers' own systems to our email provider, without keeping them.

It also holds our own records, for which we are the controller: the training sign-offs we collect from care staff and our records of dealings with providers, such as licence requests. Part A ("Training sign-offs and dealings with providers") says what they hold, why, and how long we keep them.

4. Your rights

Under the UK GDPR you have the right to:

1. be told how your data is used, which is what this policy is for
2. ask for a copy of the personal data we hold about you
3. have inaccurate data corrected
4. ask for data to be erased, where there is no overriding reason to keep it
5. ask us to restrict how we use it while a concern is resolved
6. object to processing that relies on legitimate interests
7. ask for your data in a portable format, where the right applies
8. withdraw consent at any time, where we relied on consent

To exercise any of these in relation to your dealings with us, email hello@care360.cloud. We will respond within one month. For care or employment records inside the application, contact the care provider that holds them, as they are the controller.

5. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at any time, at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

6. Security incidents

If a personal data breach occurs that affects a provider's data, we will notify that provider without undue delay so they can meet their own duty to report to the ICO within 72 hours where the breach is reportable, and to inform affected people where the risk is high.

7. Changes to this policy

We will update this page when our processing changes, and we will change the date at the top. Where a change materially affects customers we will tell them directly rather than relying on you to notice.

8. Contact

Questions about this policy, or about how we handle data, go to hello@care360.cloud. Data protection enquiries from customers can also be raised through your usual contact with us.