Legal
Privacy Policy
This explains what personal information Care Companion collects, why, and what rights you have over it — including the health and care information at the centre of what this service does.
Who we are
Care Companion is provided by Salford Home Care, of [registered business address — to be added], the "data controller" responsible for the personal information described in this policy. If you have any question about this policy or how your information is used, contact us via the Contact Us page. Our registration with the Information Commissioner's Office (ICO), the UK's data protection regulator, is ZC200591 (registered as Mrs Laura Birkett). Last updated: 19 July 2026.
What information we collect
Depending on your role in a circle (Care Companion's term for the private workspace built around one person's care), we collect: • Everyone: your name and email address, and records of which circles you belong to and in what role. • Family members arranging care: the service user's name, date of birth, address, contact details, who arranged their care, and — where relevant — family members' own names and relationship to the service user. • Health and care information (see the next section for how we handle this): diagnoses and health conditions, medication and allergies, mental capacity and Deprivation of Liberty Safeguards (DoLS) status, likes/dislikes/life history entered to help a carer provide personal care, and day-to-day visit logs and care notes recorded by carers. • Carers: your name, business address and contact details, enhanced DBS certificate number and check date, insurance details, bank details for invoicing, qualifications, and the rates you set for each client. • Anyone contacting us: if you use the Contact Us form or the Find a Local Carer enquiry form, we collect your name, email, phone number (if given), and your message.
Health and care information (special category data)
Much of the information in a care plan — diagnoses, medication, capacity status, and care notes — is "special category data" under UK GDPR, given extra protection because of how sensitive it is. We only process it because you (or the person managing a service user's account on their behalf) give explicit consent when setting up a circle and completing a care plan, so this information can be shared with the specific carers and family members you choose to give access to. You can withdraw this consent at any time by contacting us, though this will likely mean the care coordination features of the service can no longer work for that circle. Access to this information is enforced technically, not just by policy: it is only ever visible to people who are members of that specific circle, according to their role — a carer sees what they need to provide care; a family member sees the full picture; nobody outside the circle can see it at all.
DBS and criminal record information
If you're a carer, we hold your enhanced DBS certificate number and the date it was checked, so that families can see you have an up-to-date check and, if you opt into the public directory, so that basic eligibility can be confirmed automatically. This is criminal offence data under UK GDPR, and we process it on the basis of safeguarding vulnerable adults who rely on this service, with your consent as a carer entering that information yourself. We never display your DBS certificate number to anyone outside your own account, or to families — only whether your check is on file and current.
How we use your information
We use your information to: • Run the coordination service you've signed up for — matching carers and families, building care plans, scheduling visits, and generating timesheets and invoices from the same records (necessary to provide the service you've asked for) • Keep the platform safe — for example, warning a family_admin if a carer they've booked has since marked themselves unavailable, or maintaining an audit log of sensitive actions like an administrator accessing another account (our legitimate interest in running a secure, trustworthy service) • Meet our own legal and accounting obligations — for example, retaining invoices and timesheets carers need for their own tax records (a legal obligation) • Respond to messages sent through the Contact Us form or the Find a Local Carer directory (necessary to deal with your enquiry) We do not use your information for advertising, and we do not sell it to anyone.
Who we share information with
Within a circle, information is shared only with the specific people in that circle, scoped to their role — enforced by our database's own access rules, not just how the screens are designed. We also use a small number of service providers to run Care Companion, who process information on our behalf under their own data processing terms: • Supabase — our database, authentication, and file storage provider • Google Cloud Platform — hosts the application itself • Resend — sends transactional emails (invites, notifications) None of these providers use your information for their own purposes, and we don't share your information with anyone else, except where we're required to by law.
International data transfers
Care Companion is hosted on Google Cloud in the EU (Belgium). [Supabase's hosting region for our database — to be confirmed and added here.] Where any of our service providers store or process information outside the UK, we rely on the legal safeguards available for international transfers, such as the UK's data protection adequacy regulations or standard contractual clauses, to keep your information protected.
How long we keep your information
While your circle is active, we keep the information described above for as long as you're using the service. If a family no longer needs Care Companion — for example, because care has ended — we don't automatically delete anything, since some carers still need timesheet, invoice, and contract records for their own accounting and tax obligations. If you'd like a service user's personal and medical information permanently deleted, contact us and we'll remove it, while keeping only what a carer is legally required to retain for their own accounting (which never includes health or care plan information).
Keeping your information secure
Access to information is controlled at the database level according to each person's role in a circle, not just hidden in the interface — the same rule that decides what you see on screen is what actually stops anyone else from reading it. Administrative access that bypasses these rules is limited to a small number of specific, documented situations (such as helping with account support), and is itself logged. No method of storing or transmitting information is completely secure, and we can't guarantee absolute security, but we take reasonable technical and organisational steps to protect what you share with us.
Your rights
Under UK GDPR, you have the right to: • Ask what information we hold about you, and get a copy of it (right of access) • Ask us to correct inaccurate information (right to rectification) • Ask us to delete your information, subject to the limits described above around carers' own accounting records (right to erasure) • Ask us to restrict how we use your information, or object to certain uses (rights to restriction and objection) • Ask for your information in a portable format, where technically feasible (right to data portability) • Withdraw consent at any time, where we rely on consent (this won't affect anything we did before you withdrew it) To exercise any of these rights, contact us via the Contact Us page. If you're not satisfied with how we've handled your information, you also have the right to complain to the Information Commissioner's Office (ico.org.uk).
Cookies
We only use cookies that are strictly necessary to run the service — to keep you signed in securely. We don't use any advertising or analytics cookies, and we don't need your consent for the cookies we do use, since they're essential to the service working at all.
Children
Care Companion is intended for use by adults arranging or providing care. We don't knowingly collect information directly from children, though a service user's family members recorded as part of a care plan may sometimes include people under 18 — that information is provided by the adult managing the account, not collected from the child directly.
Changes to this policy
We may update this policy from time to time, for example as the service changes or the law requires. We'll update the date at the top of this page when we do, and if a change is significant, we'll aim to let account holders know directly.