Privacy policy

Care Anchor Compliance Ltd (“we”, “us”, “our”) provides CQC compliance documents and a software platform, by subscription, for home care agencies in England. We are registered in England and Wales, company number 17500700, and our registered office is Unit 82a James Carter Road, Bury St Edmunds, IP28 7DE. We are registered with the Information Commissioner’s Office (ICO), registration number ZC266764. This policy explains what personal data we collect, why, and how it is used across our website and platform.

Questions about this policy or your data can be sent to our data protection lead at info@careanchorcompliance.co.uk.

Registration and demo requests: if you register your agency or ask for a demo, we use the details you give us to contact you, arrange a demo and set up your account. That is your name, your agency, your email address and phone number and any message; when you register, also your role, how many branches your agency has and where it is with CQC registration; and when you ask for a demo, the best time to call you. With a demo request we also keep the kind of site that brought you to ours, such as LinkedIn or a search engine, unless you chose Decline on our cookie message. We delete registration and demo requests 12 months after we receive them.

Account and agency data: names, email addresses, roles, and agency details when your account is set up, when office staff give their staff a login on the Team page, or when you manage staff, clients, or rotas within the platform.

Care and compliance records: where an agency uses the platform to log visits, medication administration, incidents, and compliance evidence, this may include special category data (such as health information) about the people receiving care. This data is entered and controlled by the subscribing agency, who acts as data controller for it; we process it on their behalf as a data processor.

Office set-up review photos: if your agency asks for an office set-up review, the photos your office staff add of your office, used only to carry out the review. We ask you not to photograph people, codes, keys or anything showing names or care details. Only your office staff and Care Anchor Compliance can see the photos, and we delete them 90 days after your report is sent, or 90 days after they are added if you do not ask for a review.

Document library records: agencies read their documents in the platform, and each page shows the name of the person reading it. When someone reads, prints or makes a copy of a document, we record who it was, which document and when, and for a copy, who it was for. When office staff change their agency’s details, we record the change and who made it. When a member of staff confirms they have read a policy or procedure, we record who it was, which version and when, so their agency can show CQC who has read what. We use these records to protect our documents, which are licensed to each agency, and to show an agency who has printed, copied or read them.

Family Portal data: names and contact details of family members or representatives invited to view updates about a person in their care.

Payment data: we do not store card details. Subscription payments are handled directly by Stripe, our payment processor. We keep a record of whether an agency’s subscription is paid up. If a payment fails, we keep the date and Stripe’s link to pay the invoice, and we email the agency’s office staff and ourselves; when it is paid, we record the date.

Help and problem reports: the Help button in the platform answers questions with an AI assistant (Anthropic’s Claude models). To answer, we send your question, the page you are on, whether you are office staff, and your agency’s name, plan and payment position to Anthropic. We do not keep your questions, only a count of how many each person asks a day, for 30 days, to keep the assistant’s costs in check. If you send a problem report, we keep what you write, any conversation with the assistant that you include, the page you were on, your browser type and your name and email address, and we use them to fix the problem and to tell you when it is fixed. We use AI tools, also from Anthropic, to help find and fix faults, so they may read your report. Please do not include the names or health details of the people you support. We delete problem reports 12 months after they are made.

Service emails: when the platform emails you, for example an alert, a copy of a problem report or a payment notice, we keep a record of who it went to, its subject and whether our email provider accepted it, so we can trace an email that goes missing. We delete these records 30 days after the email is sent.

Website usage: we count visits to the pages of our public website, and the kind of site each visit came from, such as LinkedIn, Facebook or a search engine, so we can see which pages and posts are useful. We do this without cookies, nothing is stored on your device, and we do not record your IP address or anything else that could identify you. Only we use the counts. We do not count your visits if you choose Decline on our cookie message, if your browser asks websites not to track you, or while you are signed in to the platform. Our web host keeps standard server logs, including IP addresses, to keep the site secure and working.

We use personal data to:

• Provide and maintain the platform and your account
• Process subscription payments
• Send service emails (e.g. compliance alerts, password resets, payment confirmations) via Resend
• Respond to enquiries, demo requests and registration requests
• Count visits to our public website, without identifying anyone, to improve it
• Answer questions about using the platform, and find and fix problems you report or that our checks find
• Maintain security, audit trails, and prevent misuse
• Meet our own legal and regulatory obligations

Under UK GDPR we rely on:

• Contract: to provide the platform and your account, and to take payments, under our agreement with your agency.
• Steps before a contract and legitimate interests: to respond to registration and demo requests and other enquiries, at your request.
• Legitimate interests: to keep the platform secure, keep audit trails and prevent misuse, and to count visits to our website, without identifying anyone, so we can improve it.
• Legal obligation: to keep the records the law requires of us, such as financial records.

For care records we process on an agency’s behalf, the agency decides the lawful basis, and the condition for processing health information, as data controller.

We use a small number of trusted service providers (sub-processors) to run the platform:

• Supabase: database, authentication, and file storage
• Stripe: payment processing
• Resend: transactional email delivery
• Anthropic: AI processing for the Help assistant and AI Tools in the platform, and the tools we use to find and fix faults
• Netlify: website and application hosting

We do not sell personal data. We only share data with these providers to the extent needed to deliver the service, under their own data protection terms.

Some of these providers are based in the United States, so personal data may be transferred outside the UK. Where it is, it is protected by the safeguards UK data protection law requires, such as the UK–US data bridge or the UK International Data Transfer Addendum, under each provider’s data protection terms.

When you first visit, we ask you to choose OK or Decline. You can change your choice at any time from Cookie settings at the bottom of every page.

We only use essential storage, which the law allows without consent because the site cannot work without it. We do not use advertising or tracking cookies, so we store nothing optional, whichever you choose. We do count visits to our pages, without cookies and without identifying anyone, which the law allows for a website’s own statistics as long as we tell you and you can say no: choose Decline and we stop counting your visits. If we ever add anything optional that stores information on your device, it will only be used for people who chose OK, and we will update this policy first.

Our fonts are hosted on our own website, so loading a page does not send your details to anyone else. When you make a payment, Stripe’s own pages may set cookies, under Stripe’s privacy policy.

We retain account and compliance data for as long as an agency’s subscription is active, and for a reasonable period afterwards to meet care sector record-keeping obligations and legal requirements. Agencies can request deletion of their data subject to those obligations by contacting us. Registration requests are deleted 12 months after we receive them, office set-up review photos 90 days after the report is sent, problem reports 12 months after they are made, and records of service emails 30 days after they are sent.

Under UK GDPR, you have the right to request access to, correction of, or deletion of your personal data, to object to or restrict certain processing, and to data portability. Where an agency is the data controller for care records (see “Data we collect” above), requests about those records should usually go to the agency directly.

If you are unhappy with how we have handled your personal data, please tell us first at info@careanchorcompliance.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

We may update this policy from time to time as the platform evolves. We’ll update the date at the top of this page when we do.