Privacy policy
This policy explains what personal data CareStead collects, why, and how it is protected — for care home staff accounts, organisation admins, and family portal users.
CareStead (“we”, “us”) provides software for care home record keeping. For staff account data (name, email, role, login activity), CareStead is the data controller. For resident and clinical records entered into the platform, your care home is the data controller and CareStead acts as a data processor on its instructions, under our Data Processing Agreement.
What we collect
| Data | Purpose |
|---|---|
| Staff name, email, role | Authentication, authorisation, and audit trail |
| Organisation and facility details | Setting up and delivering the service, billing |
| Resident and clinical records | Processed only on instruction of your care home (controller) |
| Family portal access | Processed only on instruction of your care home (controller) |
| Usage analytics | Product improvement — never includes clinical content |
Legal basis
- Contract: to provide the service you or your employer signed up for.
- Legitimate interests: security, fraud prevention, and non-clinical product analytics.
- Controller’s basis: your care home determines the lawful basis for processing resident health data.
Special category (health) data
Health and care data is processed strictly on the written instructions of the care home controller, as set out in our Data Processing Agreement. It is never used for marketing, sold, or shared with advertisers.
Retention
Data is retained for the life of your subscription plus an export window on termination, as agreed in your DPA. Backups roll off on a 30-day rolling basis.
Sub-processors
We use a small number of vetted sub-processors (hosting, payments, analytics, error monitoring, email, and support chat). See the full, current list on our sub-processors page.
International transfers
CareStead hosts data in the UK/EU. We do not transfer personal data outside the UK/EEA without an adequacy decision or appropriate safeguards (such as the UK International Data Transfer Addendum).
Cookies
Our marketing site uses minimal, non-tracking cookies. See our cookie policy for details.
Your rights
Staff accounts: contact us at privacy@carestead.co.uk to access, correct, or delete your account data.
Residents and family members: please contact your care home directly, as they are the data controller for resident records and can action requests under their own procedures.
Complaints
If you have concerns about how we handle personal data, contact us first at privacy@carestead.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk.
Changes to this policy
We review this policy as our service and compliance programme grow, and will post material changes here with an updated date. Continued use of CareStead after a change means you accept the revised policy.
Contact
Questions about this policy: privacy@carestead.co.uk. General enquiries: see our contact page.