Privacy Policy

1. Whose records, and who is in charge of them

How we handle information depends on whose it is:

• The records a home keeps in Careframe — about its staff, the children in its care and the people around them. The home is in charge of these records (in data protection terms, the “controller”). Careframe looks after them for the home (the “processor”) and uses them only as the home’s use of Careframe and our Data Processing terms allow.
• Careframe’s own records — about the people who have a Careframe login, the security of signing in, people who get in touch with us, and visits to our website. Careframe is in charge of these. This policy is mainly about them.

2. What we collect for ourselves

• Account and contact details — name, email address, phone number, job title, and the organisation you work for.
• Billing contact — the email address your organisation gives us for billing. We do not take payments through Careframe yet, and will update this policy before we do.
• Messages to us — anything you send when you ask a question, request a demo or report a problem.
• Sign-in and technical details — when you signed in, your device and browser type and your IP address, used to keep Careframe secure and working; and a count of page visits made without cookies.

We do not collect health or other sensitive information, or information about children, for ourselves. That is only ever in a home’s own records (section 4).

3. Why we use it

• To provide Careframe — to set up and run your account.
• To keep it secure and improve it — to answer questions, stop misuse, and see which pages are used, in ways you would reasonably expect.
• Where we have to by law — for example our own accounting records.

We do not send marketing messages and do not use optional cookies, so we do not ask for your consent to either.

4. Sensitive information and children's records

Homes use Careframe for sensitive information, including health details and information about children. That information is only in a home’s own records. The home decides why it records it and is responsible for it; Careframe keeps it safe, uses it only as the home’s instructions allow, and helps the home when someone asks for a copy of their information.

5. Who else handles it

We do not sell personal information. We share it only where we need to:

• Our suppliers — the companies that host Careframe, store its database and files, and send its emails. Each works only on our instructions under written terms. They are listed, with where each handles data, on our Sub-processors page.
• Advisers and authorities — where the law requires it, or to deal with a legal claim.

6. Where it is held

Careframe’s database and every uploaded file are stored in the European Union, in Frankfurt, Germany, and the app runs there too. The UK treats information held in the EU as protected in the same way as in the UK. Emails are sent through Resend in the United States, under the UK’s approved arrangement for US companies (the UK Extension to the EU–US Data Privacy Framework). Error reports go to Sentry’s European Union region. Where any other supplier handles information outside the UK, the arrangement it uses is named on our Sub-processors page.

7. How long we keep it

Account details are kept while your organisation uses Careframe, and deleted with the rest of its information 30 days after its Director asks us in writing to close the account (the logins of people who use Careframe at no other company go too). Messages to us are kept only as long as we need them to answer and follow up.

Within a home’s records, unless the home chooses otherwise where it can:

• Children's records — never deleted by Careframe while the company uses Careframe; each carries a clock (75 years from the child's date of birth, or 15 years for home records) and when it runs out the home decides. If the company closes, they are deleted with everything else after the 30 days it has to download them.
• Leavers' staff files — 6 years after leaving, then a manager can erase the vetting details (check numbers, identity documents, bank details, National Insurance number and health answers) and keep the employment record.
• Applicants who are not hired — 12 months, unless the company chooses another period (someone still being considered is kept until 90 days after they were last looked at).
• Messages — 2 years, unless the company chooses another period.
• The audit log — 6 years, then kept without the IP address, browser details or the record of what was changed.
• Logs of who opened a child's record, inspector visits, Careframe staff access and support-access permissions — 2 years.
• Failed sign-in records — 1 year.
• Notifications — 12 months.
• Payroll spreadsheets kept with each payroll export — 6 years.
• Half-written forms — 7 days after the last change.
• Inspection bundles — 24 hours.
• Everything else a company holds — while the company uses Careframe; deleted 30 days after the Director's written request to close the company.

8. How we protect it

• Encryption when information travels and where it is stored.
• Each person sees only what their home allows them to.
• Two-step sign-in, available to everyone and recommended for the people who can see the most.
• A record of who did what, which nobody using Careframe can change.
• Hosting in the European Union (Frankfurt, Germany) with established providers.
• Regular checks of these measures as Careframe grows.

No system can be completely secure, but we keep our safeguards in step with how sensitive the information is. We hold no security certification and do not claim one.

9. If something goes wrong

We keep a written plan for dealing with information being lost or seen by the wrong person, and a record of every case. If it affects our own records and puts people at risk, we tell the Information Commissioner’s Office (ICO) within 72 hours of finding out where we can, and tell the people affected where the risk is high. If it affects a home’s records, we tell the home without delay, and within 48 hours of confirming it, and give the home everything it needs to decide who else to tell.

10. Your rights

You can ask us for a copy of the information we hold about you, to correct it, to delete it in some cases, to stop or limit how we use it, or to have it given to you in a form you can take elsewhere.

For Careframe’s own records about you, email hello@careframe.co.uk. If your request is about a home’s records (for example a staff file or a child’s record), please ask that home, which is in charge of them; we will help it answer.

You can also complain to the ICO at ico.org.uk, though we would welcome the chance to put things right first.

11. Cookies

We use only essential cookies, and count page visits without cookies. For details, see our Cookie Policy.

12. Changes to this policy

We may update this policy from time to time. If we make a meaningful change, we will update the date above and, where appropriate, let you know.

This version is dated 7 October 2026. What changed: 7 October 2026 — how long we keep things, where data is held and which suppliers handle it are now stated exactly; what happens to your data when you leave is set out; nothing is charged yet, so no payment company is named; the cookie policy lists only the cookies we use; 6 October 2026 — first published version, with the company's registration in progress and the sub-processor list added.

13. Contact

If you have any questions about this policy or how we handle personal data, contact us at hello@careframe.co.uk.