Privacy policy

Care is operated by iBuzz Ltd (company number 13378925), registered in England. This policy explains what personal information we hold when you use Care, why we hold it, and the rights you have over it. If you have questions, email hello@gocare.uk.

Who we are

iBuzz Ltd is the data controller for the personal data you provide when creating an account and managing your organisation's profile. For personal data you add about your staff and the people you support, you remain the data controller and we act as your data processor, handling that data only on your instructions.

What we collect

• Account details: your email address, used to sign you in and send service-related messages such as magic-link emails and important notices.
• Organisation details: the name, CQC location ID and service type of your registered service, entered during setup.
• Compliance records: documents you upload (policies, care plans, audits, photos of paper records), structured records you capture in the app (incidents, safeguarding concerns, complaints, routine audit forms, staff register entries, notes), and the analysis results we generate from those documents. Documents you upload may contain personal data about the people you support, including health information and other special category data under UK GDPR. You remain the data controller for that data; we process it only to provide the analysis and readiness scoring features you use.
• Staff data: names, DBS check dates, supervision dates, appraisal dates and training dates you enter on the team register. This data is entered by you and relates to your employees.
• Technical logs: server-side logs of requests made to our infrastructure, retained briefly for security and debugging. We do not use advertising trackers, analytics cookies or third-party tracking scripts.

Legal basis for processing

We process your account and organisation data on the basis of our contract with you (to provide the Care service). We process compliance records and staff data on the basis of your instructions as data controller, under a data processing relationship. Where we send you service communications, we rely on legitimate interests.

How we use your data

We use your data solely to provide and improve Care. This includes reading your uploaded documents to map them against the CQC's quality statements, calculating your readiness score, flagging gaps and overdue records, and sending service emails such as sign-in links. We do not sell your data, share it with advertisers, or use it to build profiles for any purpose other than running the service.

Sub-processors

We use a small number of carefully selected service providers to operate Care:

• Supabase — database hosting, file storage and authentication. Data is stored in the EU. Supabase is SOC 2 Type II certified.
• Anthropic (USA) — document reading and analysis. When you upload a document, its content — which may include personal data and special category data about the people you support — is sent to Anthropic's API, which operates in the United States, to extract compliance-relevant information and identify gaps against CQC quality statements. Anthropic does not use API inputs to train its models and does not retain document content after processing. This transfer is covered by standard contractual clauses (SCCs) under UK GDPR.
• Zoho (USA / EU) — email delivery for service communications including sign-in links and account notices. Zoho is certified under the EU-US Data Privacy Framework and operates under standard contractual clauses for UK transfers.

Each sub-processor is bound by data processing agreements and their own security commitments. Transfers of personal data outside the UK are made only where appropriate safeguards are in place, as described above.

Special category data

Care plans, incident records, safeguarding notes and similar documents you upload may contain health information or other special category data about the people you support. As the data controller for that data, you are responsible for ensuring you have a lawful basis for sharing it with us for analysis purposes. Our legal basis for processing it on your behalf is the performance of a task in the substantial public interest (UK GDPR Article 9(2)(g)) in the context of health and social care, supported by our data processing relationship with you. If you have questions about this, email hello@gocare.uk.

Automated processing

Care uses automated tools to read and analyse the documents you upload and to calculate a readiness score. These tools do not make legally binding decisions about your service or your CQC registration — all outputs are informational and should be reviewed by you before being relied upon. The score and gap analysis reflect only what can be inferred from the evidence you have provided; they do not represent a formal assessment by the CQC or any other body.

Your staff's data

When you enter data about your staff (names, DBS dates, training records and similar), you are the data controller for that data. We process it only to provide the features you use — displaying the team register, flagging overdue dates and including staffing evidence in your readiness score. A data processing agreement covering this relationship is available on request at hello@gocare.uk.

Security

All data is encrypted in transit (TLS) and at rest. Access to your records is protected by row-level security policies — each account can only access its own data. Uploaded files are stored in a private bucket with signed, time-limited URLs. We do not store passwords; sign-in uses email magic links only.

Retention

Your records remain available for as long as you have an active account. If you close your account, we will delete your personal data within 90 days, unless we are required to retain it for longer by law. You can request deletion at any time by emailing hello@gocare.uk and we will action it within 30 days.

Cookies

Care uses only a single session cookie to keep you signed in. We do not use advertising cookies, analytics cookies or any third-party tracking. No cookie consent banner is shown because no non-essential cookies are set.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, correct inaccurate data, request erasure, restrict or object to processing, and receive your data in a portable format. To exercise any of these rights, email hello@gocare.uk. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

Changes to this policy

We may update this policy as the service develops. If we make material changes we will notify you by email or with a notice in the app before the changes take effect.