__COMPANY_NAME__ ("we", "us") operates the RegIntel Rota platform used by domiciliary care providers to schedule visits, evidence compliance, and communicate with their workforce.

For most service-user and staff data, we act as a data processor on behalf of the care provider that purchased the platform (your employer or care agency). The provider is the controller and you should contact them first for requests about your data. Our contact details for processor-level questions: dpo@__DOMAIN__.

About service users (the people receiving care)

• Name, address, postcode, contact details, date of birth.
• Care plan: tasks, time windows, medication schedule, mobility level, risks, preferences.
• Visit records: time arrived / left, what was done, exceptions, photos of notes or environment, body-map markings, voice notes (when used).
• Special category data under UK GDPR Art 9: health information including medication, mobility, behavioural and safeguarding flags.

About staff (carers, nurses, coordinators, managers)

• Name, contact details, role, payroll ID, branch, team membership.
• Right-to-Work and DBS check status and expiry dates.
• Visa type and weekly-hour cap (where applicable).
• Training currency and qualifications.
• Working hours, locations during shifts, mileage, late or missed visits.
• Special category data under UK GDPR Art 9: where you've shared health data for reasonable adjustments or sickness recording.

For service-user data we rely on the following:

• Art 6(1)(b) — performance of a contract for care.
• Art 9(2)(h) — provision of health and social care, with the further conditions in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.
• Art 6(1)(c) / Art 9(2)(b) — compliance with legal obligations under the Health and Social Care Act 2008 and the regulations made under it (CQC).

For staff data we rely on:

• Art 6(1)(b) — performance of the employment contract.
• Art 6(1)(c) / Art 9(2)(b) — legal obligations including immigration, DBS, working time, payroll, safeguarding.
• Art 6(1)(f) — legitimate interests in running a safe, compliant rota.

The platform shares limited data with the following sub-processors. The full live list lives in docs/legal/SUBPROCESSORS.md:

• Clerk — authentication.
• Cloudflare R2 / AWS S3 — encrypted file uploads (where configured).
• Google Maps — distance and travel-time calculation between visits.
• GOV.UK Notify — SMS and email notifications (where configured).
• __HOSTING_PROVIDER__ — application and database hosting.

We do not sell personal data. Where data is shared with a regulator (e.g. CQC inspection packs), it is done in response to a statutory obligation or a documented information request from the controller.

We follow the retention schedule set out in docs/legal/RETENTION_POLICY.md. Headline figures:

• Adult social-care records: 8 years after the end of care (NHSx Records Management Code).
• Payroll and HMRC records: 7 years.
• Right-to-Work evidence: 2 years after employment ends.
• Audit and compliance logs: 8 years minimum, hash-chained for integrity.
• Authentication session records: rolling 90 days.

Application data is stored in the United Kingdom / European Economic Area. Backups are encrypted at rest. We do not transfer personal data outside the UK / EEA except where the receiving country has an adequacy decision or a UK IDTA / SCCs are in place.

Under UK GDPR you have the right to:

• Request a copy of your data ("subject access").
• Correct data that's inaccurate.
• Erase data that we no longer need (subject to retention obligations above).
• Restrict or object to processing.
• Data portability for data we process under contract or consent.
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise a right, email dpo@__DOMAIN__. We will acknowledge within 5 working days and respond within 30 calendar days. Our internal process for handling these requests is documented in docs/runbooks/gdpr-subject-request.md.

The compliance rules engine produces decisions (e.g. flagging a visa-cap breach or a missing DBS) that affect rota assignments. These decisions are reviewed by a human (a coordinator or manager) before they affect employment. We do not carry out solely-automated decision-making with legal or similarly significant effects under UK GDPR Art 22.

We will note material changes here and, where the change affects your rights, write to you. The current version's date is at the top of this page.