How CareSolve handles personal information across the web application, the CareSolve Carer app, and the family and client portals.
CareSolve is a care management platform used by UK home care providers. This policy explains what personal information we handle, why we handle it, and what rights you have. It covers the CareSolve web application at caresolve.co.uk, the CareSolve Carer mobile app, and the family and client portals.
CareSolve is operated by CareSolve Ltd, a company registered in England and Wales. Our full registered company details are available on request from the contact address at the end of this policy.
The role we play under UK data protection law depends on whose information is involved, and this determines who you should contact about it.
The categories below reflect what the platform actually stores. Not every provider uses every module, so not all of it will apply to a given account.
The CareSolve Carer app is issued by a care provider to its own care workers. It is not a consumer app and cannot be used without an account created by an employer. It handles some device data that the web application does not.
Care records include health information, which UK GDPR treats as special category data requiring extra protection. Where we act as a processor, the care provider is responsible for identifying its lawful basis and its Article 9 condition, which for care delivery is typically the provision of health or social care under Article 9(2)(h).
Where we act as a controller, we rely on the performance of our contract with the provider to deliver and administer the service, our legitimate interests in keeping the service secure and in supporting our customers, and compliance with our own legal obligations.
The application runs in Vercel's London (lhr1) region. Our database and uploaded documents are held with Supabase, and transactional email is handled by Microsoft 365.
Some of the providers we use may process information outside the UK. Where that happens, the transfer is governed by the data protection terms of our agreement with that provider, which incorporate the transfer safeguards required by UK data protection law. You can ask us for details of the arrangements that apply to a particular provider.
The platform includes configurable retention rules, so a care provider can set how long each category of record is kept in line with its own regulatory obligations. Adult social care records generally have to be retained for a significant period after care ends, and providers should set their rules accordingly.
Where we are the controller, we keep account and billing records for as long as the provider's account is open, and afterwards for as long as we need them to meet our legal, accounting, and tax obligations. Security and audit logs are kept for as long as they remain useful for investigating security incidents and for meeting those same obligations.
When a provider closes its account, we delete or return its data, other than anything we are required to retain by law. We are happy to confirm the specific periods that apply to your account on request.
Security measures in the platform include the following. No system can be guaranteed completely secure, but these are the controls the product is built around.
Under UK data protection law you have the right to ask for a copy of your personal information, to have inaccurate information corrected, to ask for erasure or restriction in certain circumstances, to object to processing based on legitimate interests, and to receive certain information in a portable form.
If your information is held in a care provider's account — which is the case for people receiving care, their families, and care staff — please contact that provider directly. They control those records and decide how requests are handled. We will support them in responding.
For information we hold as a controller, contact us using the details below. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to resolve matters first.
The CareSolve applications are intended for use by care provider staff and authorised family contacts, and are not directed at children. Where a care provider delivers services to a person under 18, records about that person are processed on the provider's instructions and under its own safeguarding policies.
We may update this policy as the platform develops. The effective date at the top of this page shows when it last changed, and we will tell account administrators about material changes.
For privacy questions, to exercise your rights over information we hold as a controller, or to request our registered company details, email privacy@caresolve.co.uk.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put things right first.