Privacy policy

Care is operated by iBuzz Ltd (company number 13378925), registered in England. This policy explains what personal information we hold when you use Care, why we hold it, and the rights you have over it. If you have questions, email hello@gocare.uk.

Who we are

iBuzz Ltd is the data controller for the personal data you provide when creating an account and managing your organisation's profile. For personal data you add about your staff and the people you support, you remain the data controller and we act as your data processor, handling that data only on your instructions.

What we collect

• Account details: your email address, used to sign you in and send service-related messages such as magic-link emails and important notices.
• Organisation details: the name, CQC location ID and service type of your registered service, entered during setup.
• Compliance records: documents you upload (policies, care plans, audits, photos of paper records), structured records you capture in the app (incidents, safeguarding concerns, complaints, routine audit forms, staff register entries, notes), and the analysis results we generate from those documents.
• Staff data: names, DBS check dates, supervision dates, appraisal dates and training dates you enter on the team register. This data is entered by you and relates to your employees.
• Technical logs: server-side logs of requests made to our infrastructure, retained briefly for security and debugging. We do not use advertising trackers, analytics cookies or third-party tracking scripts.

Legal basis for processing

We process your account and organisation data on the basis of our contract with you (to provide the Care service). We process compliance records and staff data on the basis of your instructions as data controller, under a data processing relationship. Where we send you service communications, we rely on legitimate interests.

How we use your data

We use your data solely to provide and improve Care. This includes reading your uploaded documents to map them against the CQC's quality statements, calculating your readiness score, flagging gaps and overdue records, and sending service emails such as sign-in links. We do not sell your data, share it with advertisers, or use it to build profiles for any purpose other than running the service.

Sub-processors

We use a small number of carefully selected service providers to operate Care:

• Supabase — database hosting, file storage and authentication. Data is stored in the EU. Supabase is SOC 2 Type II certified.
• Anthropic — document reading and analysis. Uploaded documents and their text content are sent to Anthropic's API to extract compliance-relevant information. Anthropic does not use API inputs to train its models.
• Resend — transactional email delivery (sign-in links and service notices).

Each sub-processor is bound by data processing agreements and their own security commitments. We do not transfer personal data outside the UK or EEA except where covered by appropriate safeguards (Anthropic and Resend operate under standard contractual clauses).

Your staff's data

When you enter data about your staff (names, DBS dates, training records and similar), you are the data controller for that data. We process it only to provide the features you use — displaying the team register, flagging overdue dates and including staffing evidence in your readiness score. A data processing agreement covering this relationship is available on request at hello@gocare.uk.

Security

All data is encrypted in transit (TLS) and at rest. Access to your records is protected by row-level security policies — each account can only access its own data. Uploaded files are stored in a private bucket with signed, time-limited URLs. We do not store passwords; sign-in uses email magic links only.

Retention

Your records remain available for as long as you have an active account. If you close your account, we will delete your personal data within 90 days, unless we are required to retain it for longer by law. You can request deletion at any time by emailing hello@gocare.uk and we will action it within 30 days.

Cookies

Care uses only a single session cookie to keep you signed in. We do not use advertising cookies, analytics cookies or any third-party tracking. No cookie consent banner is shown because no non-essential cookies are set.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, correct inaccurate data, request erasure, restrict or object to processing, and receive your data in a portable format. To exercise any of these rights, email hello@gocare.uk. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

Changes to this policy

We may update this policy as the service develops. If we make material changes we will notify you by email or with a notice in the app before the changes take effect.