Privacy notice
Draft, pending legal review. Items marked [LAWYER REVIEW] are placeholders and must be completed by a qualified adviser before this notice is relied on. Last updated: 25 October 2026.
Who we are
Kindrota is software for UK care homes. Legal entity name, registered address, company number and ICO registration number: [LAWYER REVIEW]. Contact: [LAWYER REVIEW: privacy contact email].
Data protection officer
DPO or privacy lead: [LAWYER REVIEW: name or role, email, postal address]. Your care home's own DPO handles requests about care records it controls.
Our role
For records about residents, staff and families, the care home (the provider) is the controller and Kindrota is the processor acting on its written instructions under UK GDPR Article 28. If your question is about care records, contact your care home first. For our own website and account data we are the controller [LAWYER REVIEW].
What we process
- Account data: name, work email, role, password hash, two-factor secret, sign-in audit.
- Care records the provider enters: residents' identity, care notes, incidents, and, where switched on, medicines and care plans. These include health data (special category).
- Staff compliance records: right to work, DBS and training status.
- An audit trail of who viewed or changed a record, stored as IDs only.
We don't sell data, use advertising trackers, or run third-party analytics.
Lawful bases
The provider decides its lawful bases. Typically: UK GDPR Art 6(1)(c) legal obligation (Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 17), 6(1)(b) contract, 6(1)(e) or (f); and for health data Art 9(2)(h) with Data Protection Act 2018 Sch 1 Part 1 para 2. [LAWYER REVIEW]
Where data is stored
| Service | Purpose | Region |
|---|---|---|
| Supabase | Database and authentication | London (eu-west-2) |
| Vercel | Hosting and server functions | Functions in London (lhr1); global edge network for routing |
Email. No email processor is switched on today: the live service sends no email (mailer setting none). Planned: Resend, for invitations and password resets only (reference IDs and sign-in links, no care details). With Resend's EU sending region, emails are dispatched from Ireland, but Resend stores account data, email metadata and logs in the United States (Resend: Choosing a region; sub-processors, all US: resend.com/legal/subprocessors). The transfer basis would be the UK SCCs (EU SCCs with the UK Addendum) in Resend's DPA, plus a transfer risk assessment. We will update this notice before switching it on. [LAWYER REVIEW]
These companies are US-headquartered, so support access may be a restricted transfer. We rely on the safeguards in each provider's data processing agreement (UK Extension to the EU–US Data Privacy Framework or the UK Addendum / IDTA). [LAWYER REVIEW]
How long we keep it
Care records follow the retention schedule the provider sets, based on the NHS England Records Management Code of Practice 2023. Periods (for example, adult social care records after care ends; staff records after employment ends): [LAWYER REVIEW: confirm each period]. Account data: [LAWYER REVIEW: period after an account closes].
Is providing data required?
Staff need an account to use Kindrota; this is part of their employment. Providers are required by law to keep accurate care records (Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 17), so residents' care information is a statutory requirement for the provider. What happens if data isn't provided: [LAWYER REVIEW].
Consent
Where the provider relies on consent (for example, family updates), you can withdraw consent at any time by telling the care home; this doesn't affect processing before withdrawal. [LAWYER REVIEW]
Your rights
You can ask for access, correction, restriction, objection, portability and erasure. Some care records must be kept by law, so erasure may be refused while a legal duty applies. Signed-in users can request account deletion from Account > Delete my account in the app; the request goes to your care home's manager or data protection officer, who must act on it. You can also email [LAWYER REVIEW: privacy contact email].
Complaints
You can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Security
Encryption in transit (TLS). Supabase encrypts customer data at rest with AES-256 (supabase.com/security). Two-factor sign-in, role-based access, and a hash-chained audit trail: each entry includes the hash of the one before, so changes to past entries are detectable, and the service checks the chain on its readiness check. The phone app caches the app shell only and never stores care data on the device.