CareCrest Privacy Policy

Karitec Limited · Last updated: 21 December 2025

1. Introduction

This Privacy Policy explains how CareCrest ("we", "us", or "our") collects, uses, and protects your personal information when you use our care home management application. We are committed to protecting your privacy and complying with applicable data protection laws, including the UK GDPR, the UK Data Protection Act 2018, and the Health Insurance Portability and Accountability Act (HIPAA) where applicable.

2. Data Controller

For the purposes of data protection law, the data controller for your organisation's data is your organisation itself. We act as a data processor on behalf of your organisation.

3. Information We Collect

Personal information:

• User account details (name, email, role)
• Authentication credentials
• Organisation and house information

Resident information:

• Names and demographics
• Health records (vital signs, medications, care logs)
• Incident reports and body map data
• Appointment and medical history
• Financial information (petty cash)

Staff information:

• Employment details
• Shift and attendance records
• Leave requests
• Training and certification records

Usage data:

• Device information
• Log files and analytics
• Performance data

4. How We Use Your Information

• Provide and maintain the service
• Manage care home operations
• Ensure resident safety and care quality
• Generate reports and analytics
• Communicate with users
• Comply with legal obligations
• Improve our services

5. Legal Basis for Processing (GDPR)

• Contractual necessity: to fulfil our contract with your organisation
• Legal obligation: to comply with healthcare regulations
• Legitimate interests: to improve our services and prevent fraud
• Consent: for optional features and communications

6. Data Sharing and Disclosure

We do not sell your personal data. We may share data with:

• Service providers: Firebase/Google Cloud (hosting), analytics providers
• Healthcare authorities: when required by law
• Regulators: CQC, ICO, or other regulatory bodies
• Legal requirements: court orders or legal proceedings

All third parties are required to maintain appropriate data security measures.

7. Data Security

• Encryption in transit (TLS/SSL)
• Encryption at rest
• Role-based access control
• Regular security audits
• Secure authentication (Firebase Auth)
• Audit logging for sensitive operations

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes outlined in this policy, comply with legal obligations (minimum 7 years for healthcare records in the UK), and resolve disputes and enforce agreements. Deleted data is permanently removed within 30 days unless legal retention applies.

9. Your Rights (GDPR)

• Access: request a copy of your personal data
• Rectification: correct inaccurate data
• Erasure: request deletion of your data (right to be forgotten)
• Restriction: limit how we use your data
• Portability: receive your data in a structured format
• Object: object to data processing
• Withdraw consent: at any time

To exercise these rights, contact your organisation administrator or email info@karitec.co.uk.

10. Data Protection Officer & ICO Registration

Data Protection Officer: Mr Oluyemi Ikumawoyi
Email: info@karitec.co.uk
Address: 6A Sipson Road, West Drayton, UB7 9DP, United Kingdom

ICO Registration Reference: ZC115678
Registered Organisation: Karitec Limited
Registration expires: 3 April 2027
Verify at ico.org.uk

11. Cookies and Tracking

We use minimal cookies for authentication session management, app functionality, and anonymous analytics (Firebase Analytics). You can disable analytics in your device settings.

12. International Data Transfers

Your data is stored on Google Cloud servers. For EU/UK users, data is stored in EU regions. We ensure appropriate safeguards are in place for any international transfers.

13. Children's Privacy

This app is not intended for use by individuals under 18. We do not knowingly collect data from children.

14. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes via email or in-app notification. Continued use of the service after changes constitutes acceptance.

15. Complaints

If you have concerns about how we handle your data, you can lodge a complaint with:

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• EU: your local supervisory authority
• US: Department of Health and Human Services (HHS) for HIPAA complaints

16. Contact Us

Email: info@karitec.co.uk
Phone: +44 7415 097384
Address: 6A Sipson Road, West Drayton, UB7 9DP, United Kingdom