Privacy Policy

CareCompetent is operated by Care With Intelligence Holdings Limited, a company registered in England and Wales under company number 15513514, whose registered office is at 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ (“we”, “us”, “our”).

We are the data controller for the personal data described in this policy. You can reach us about privacy at chris@carewithintelligence.com.

As a controller, we collect and process:

• Account and identity data — your name, work email address, password (stored only in hashed form by our authentication provider), and the role assigned to you.
• Organisation data— your organisation’s name, CQC location ID (if you provide it), address and branding.
• Billing data — subscription plan, billing status and history. Card details are collected and stored directly by our payment provider (Stripe); we do not see or store full card numbers.
• Usage and technical data — log data, device and browser information, IP address, and pages or features used, which we use to run, secure and improve the Service.
• Communications — messages you send us (for example support requests) and our correspondence with you.
• Acceptance records — a record that you accepted our Terms, this policy and our Data Processing Agreement, including the versions accepted, the date and time, your account email and identifier, and technical metadata (IP address and browser user-agent). We keep this to evidence the agreement between us.

Most of this data comes from you directly. Some account data may be provided by a colleague in your organisation — for example, an administrator who sets up a user account for you. Usage and technical data is generated automatically as you use the Service.

We use personal data for the following purposes and lawful bases:

• To provide the Service and administer your account — lawful basis: performance of our contract with you.
• To take payment and manage subscriptions — lawful basis: performance of our contract; and compliance with our legal obligations (for example, tax and accounting).
• To secure, maintain, troubleshoot and improve the Service, and to keep records of acceptance — lawful basis: our legitimate interests in running a secure, reliable and viable service and in being able to evidence our agreements.
• To communicate with you about the Service, including service and security notices — lawful basis: performance of our contract and our legitimate interests.
• To send occasional product updates or marketing (only where appropriate) — lawful basis: our legitimate interests in promoting the Service to business customers, or your consent where required. You can opt out at any time.
• To comply with the law and to establish, exercise or defend legal claims — lawful basis: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you can object as described below.

Providing your account and billing data is necessary to create an account and use the Service; if you do not provide it, we will not be able to provide the Service to you. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

Marketing communications.We use Kit (kit.com) to manage our marketing email list. If we send you occasional product updates, onboarding tips or CQC-relevant guidance, Kit processes your email address and name for that purpose; every email includes a one-click unsubscribe, and Kit’s own privacy notice applies in addition to ours.

We do not seek to collect special-category data (such as health data) about our account holders in our role as controller. Where your organisation uploads data about your staff or the people you care for — which may include health-related or other special-category data — you are the controller for that data and we process it only as your processor under the Data Processing Agreement. You are responsible for having a lawful basis and any required Article 9 condition for that data.

We do not sell your personal data. We share it only with service providers who help us run CareCompetent, and only as needed. Our key providers (sub-processors) are:

• Google Cloud / Firebase — hosting, database, authentication and file storage.
• Stripe — payment processing and subscription billing.
• Anthropic and Google — artificial- intelligence processing used to generate drafts, mappings and narrative content.
• Resend — delivery of transactional and notification emails.

The role and processing region of each of these providers is set out in Annex 3 of our Data Processing Agreement, which we keep up to date.

We may also disclose personal data where required by law, to enforce our agreements, to protect our rights, property or safety, or in connection with a corporate transaction such as a merger or acquisition.

Your account data is hosted on Google Cloud infrastructure in the European Economic Area. Some of our sub-processors — including our payment provider, our AI providers and our email provider — may process personal data outside the UK and EEA, including in the United States. The processing region for each provider is listed in Annex 3 of our Data Processing Agreement.

Where personal data is transferred outside the UK, we rely on an appropriate safeguard recognised under UK data-protection law — such as UK adequacy regulations, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — so that your data continues to be protected. You can ask us for more detail using the contact details above.

We keep personal data only as long as necessary for the purposes set out above. Account and organisation data is kept for the life of your account and then deleted or anonymised, subject to the read-only export window described in our Terms. Billing records are kept for as long as required by tax and accounting law (generally six years). Acceptance records are kept for as long as necessary to evidence the agreement, and typically for a period after it ends.

Under UK data-protection law you have the right to: access a copy of your personal data; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to certain processing; data portability; and, where we rely on consent, to withdraw that consent at any time. These rights are not absolute and some have conditions or exceptions.

To exercise any of these rights, contact us at chris@carewithintelligence.com. We will respond within the time limits set by law. If your request relates to data we hold as a processor on behalf of an organisation, we will direct you to, or assist, that organisation as the controller.

We use only the cookies and local storage necessary to operate the Service — principally to keep you signed in and to keep your session secure. These are strictly necessary for the Service to work. We do not use advertising cookies. If we introduce optional analytics or similar technologies in future, we will ask for your consent where the law requires it.

The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18 in our role as controller.

We may update this policy from time to time. The current version is always available here, with a version number and effective date. Where changes are material we will take reasonable steps to bring them to your attention.

If you have a concern about how we handle your personal data, please contact us first and we will try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113.