Data Processing Terms

1. Who is in charge

The Customer is in charge of the records it keeps in Careframe — including staff records and children’s records (in data protection terms, the “controller”). Careframe looks after them for the Customer (the “processor”) and uses them only as the Customer’s instructions allow: using Careframe as it is designed, the settings the Customer chooses, and these terms.

2. What Careframe does, and for how long

• What — providing the Careframe platform to the Customer: storing its records, showing them to the people it allows, sending the emails its use sets off, and making the downloads it asks for.
• Why — so the Customer can run its homes, manage staff, support children’s care, deliver training and prepare for inspection.
• For how long — for as long as the Customer uses Careframe, and then until the records are deleted as section 9 sets out.

3. Whose information, and what kind

• The people the records are about — the Customer’s staff and workers, applicants, the children and young people in its care, their families and the professionals around them, and anyone else the Customer chooses to record.
• What kind — contact and identity details, employment, vetting and training records, rotas and timesheets, compliance records, care and safeguarding records, daily logs and incident records. This includes sensitive information such as health, criminal-record check details and information about children.

4. What Careframe does for the Customer

• Use the records only on the Customer’s instructions, unless the law requires otherwise (in which case we tell the Customer first where we are allowed to).
• Make sure everyone at Careframe who can reach the records keeps them confidential.
• Keep the security measures in section 6 in place.
• Help the Customer answer people who ask for a copy of their information, keep the records secure, deal with anything going wrong (section 8), and carry out impact assessments (a written check of the risks) if it chooses to.
• Use other companies only as section 5 sets out, and tell the Customer before a new one starts.
• At the end, let the Customer download everything and then delete it, as section 9 sets out.
• Give the Customer the information it reasonably needs to check we keep these terms, and allow reasonable audits.

5. Other companies we use

The Customer gives permission in advance for Careframe to use the suppliers listed on our Sub-processors page — our hosting, database and email providers among them. Each has written terms with us that protect the records at least as well as these terms, and we remain responsible for what they do. We email the Customer’s Director at least 30 days before a new supplier starts handling the Customer’s records, so the Customer can raise a reasonable objection.

6. Security measures

• Encryption when information travels and where it is stored.
• Each person sees only what the Customer allows them to.
• Two-step sign-in, available to everyone and recommended for the people who can see the most.
• Files served only through links that expire after 60 seconds, made after the permission check.
• A record of who did what, including every download, which nobody using Careframe can change.
• Careframe staff open a Customer’s records only when the Customer has turned on support access, and every look is shown to the Customer’s Director.
• Hosting in the European Union (Frankfurt, Germany) with established providers.
• Regular checks of these measures.

These describe how we work. We hold no security certification and do not claim one.

7. Where the records are held

The Customer’s records — the database and every uploaded file — are stored in the European Union, in Frankfurt, Germany, and the app runs there too. The UK treats information held in the EU as protected in the same way as in the UK. Emails are sent through Resend in the United States, under the UK’s approved arrangement for US companies (the UK Extension to the EU–US Data Privacy Framework). Error reports go to Sentry’s European Union region. Any other handling outside the UK happens only under an arrangement the UK approves, named for each supplier on the Sub-processors page.

8. If something goes wrong

If records the Customer keeps in Careframe are lost or seen by someone who should not see them, we tell the Customer without delay, and in any case within 48 hours of confirming it, with what we know, and give the Customer everything it needs to decide who else to tell. We keep a written plan for this and a record of every case.

9. When the Customer leaves

The Customer’s Director or an Admin can download everything the Customer holds — every child’s record, every staff file, every uploaded file, and every spreadsheet (messages include the conversations the person downloading is in; each member of staff can download their own) — at any time, including before leaving. When the Customer’s Director asks us in writing to close the account, the Customer has 30 days to download everything and can cancel the closure in that time. After 30 days we delete all of the Customer’s records and files, and the logins of its people who use Careframe at no other company. We keep one record that the account existed and was closed: a fingerprint of its name, the dates, and how many records of each kind were deleted, with no names.

Our backups are made by hand for now; a closed Customer’s records in a backup go when that backup is deleted. If a backup taken before the deletion is ever restored, we close the account again before Careframe reopens. If the law requires us to keep any of the records, we keep only that, only for as long as required.

10. How long records are kept

While the Customer uses Careframe, we apply these periods, unless the Customer chooses otherwise where Careframe lets it:

• Children's records — never deleted by Careframe while the company uses Careframe; each carries a clock (75 years from the child's date of birth, or 15 years for home records) and when it runs out the home decides. If the company closes, they are deleted with everything else after the 30 days it has to download them.
• Leavers' staff files — 6 years after leaving, then a manager can erase the vetting details (check numbers, identity documents, bank details, National Insurance number and health answers) and keep the employment record.
• Applicants who are not hired — 12 months, unless the company chooses another period (someone still being considered is kept until 90 days after they were last looked at).
• Messages — 2 years, unless the company chooses another period.
• The audit log — 6 years, then kept without the IP address, browser details or the record of what was changed.
• Logs of who opened a child's record, inspector visits, Careframe staff access and support-access permissions — 2 years.
• Failed sign-in records — 1 year.
• Notifications — 12 months.
• Payroll spreadsheets kept with each payroll export — 6 years.
• Half-written forms — 7 days after the last change.
• Inspection bundles — 24 hours.
• Everything else a company holds — while the company uses Careframe; deleted 30 days after the Director's written request to close the company.

11. Relationship to other terms

These Data Processing Terms supplement our Terms of Service and should be read with our Privacy Policy. A signed version of these terms, with the supplier list and our security measures attached, is available for customers who need one — contact us to arrange it.

12. Contact

For any questions about these terms or to ask for the signed version, contact us at hello@careframe.co.uk.