Privacy and Data Protection (GDPR) Statement

Last updated: [date to be inserted on publication]

This statement explains how we collect and use your personal data, the lawful bases we rely on under UK data protection law (the UK GDPR and the Data Protection Act 2018), and your rights. It covers our website and all of our tools: the Care Funding Guide (including our assistant Seacole), Care Journey, Life Timeline, and The Caring App. Some tools are still in development. The sections about them apply from the moment we launch them and you start using them.

Who we are and how to contact us

The services are provided by [legal entity name] Ltd, a company registered in England and Wales under company number [company number], with its registered office at [registered office address] (“we”, “us”, “our”). When you use our website and tools, we are the data controller for your personal data, which means we decide how and why it is used.

You can reach us about anything in this statement, including any request about your data, at privacy@thecaring.app. We are registered with the Information Commissioner's Office (ICO) under registration number [to be added once issued].

The personal data we collect

We collect only what we need to run the service:

Your email address, when you sign in. We use a magic-link sign-in, so you do not set a password.
A record of which of our tools you have used. When you open one of our connected tools while signed in, we store your email, an identifier for the tool, and the dates you first and last used it. We do not record what you did inside the tool.
What you type into our assistant, Seacole, when you use the Care Funding Guide. Please do not enter names or other details that identify you or the person you care for. Seacole does not need them.
What you choose to save in Care Journey. You can use Care Journey without saving anything. If you choose to save your plan, we store your progress, which plan to show you, and the outward part of your postcode (for example “SW1A”), linked to your email. See the Care Journey section below for how we handle anything sensitive.
What you add to Life Timeline, if you use it. This may include life-story text, memories, photos, and voice recordings that you choose to save. See the Life Timeline section below.
What you share in The Caring App, if you use it to coordinate care. This may include updates, notes, tasks, schedules, and files you share with your care circle. See The Caring App section below.

We do not ask for financial account numbers, government identifiers (such as National Insurance numbers), or formal health records.

Data about other people

Some of our tools let you record information that relates to other people, such as the person you care for or members of your care circle. Where you do this, please share only what is necessary, and please follow the guidance in each tool. In particular, please describe a care situation without including details that identify a vulnerable person where they are not needed. Where you share information about another person, you are responsible for having a proper basis to do so, and we act on your instructions to store and display it to the people you choose. We explain the safeguards for sensitive information in the tool-specific sections below.

How we use your data and our lawful basis

We use your data for the following purposes:

To sign you in and keep your account secure. Lawful basis: our legitimate interests in providing a working, secure sign-in.
To give you the care funding guidance you ask for through Seacole. Lawful basis: our legitimate interests in giving you the information you have asked for. Seacole provides general information, not financial or legal advice.
To run your account across our connected tools and show you the tools you have used. Lawful basis: our legitimate interests in providing your account and helping you return to the tools you have chosen. See “Your account across our tools” below.
To give you your Care Journey plan and remember your progress, if you choose to save it. Lawful basis: your consent, and your explicit consent for any health-related information. You can withdraw this at any time.
To store and display what you save in Life Timeline and share in The Caring App, including with the people you choose. Lawful basis: your consent, and your explicit consent for any health-related or other sensitive information. You can withdraw this at any time.

Where we rely on legitimate interests, we have weighed our interest in providing these features against your rights, and we limit the data to the minimum needed. You can object to this processing at any time using the contact details above. Where we rely on consent, withdrawing it does not affect anything we did before you withdrew it.

Your account across our tools

When you sign in on our website and open one of our connected tools (such as the Care Funding Guide), we securely confirm your email to that tool so you are signed in without entering a second code. If you do not already have an account for that tool, opening it creates one for you, using your email. This only happens when you deliberately open a tool; we never create tool accounts silently or in bulk.

We keep a simple record of which tools you have used, made up of your email, the tool, and when you used it, so your account can show them to you. We do not record what you typed or anything else about what you did. We use this only to sign you in and to show you your own tools. We never use it for profiling, advertising, or marketing, and we never sell your data.

Because our tools are linked by your email address, if you ask us to delete your data we remove it across all of our connected tools. See “Your rights” below.

Care Funding Guide and Seacole

When you use the Care Funding Guide, you can ask Seacole questions and it gives you general information about care funding. The messages you type are sent to our AI provider to generate a response. Please describe your situation without entering names or other details that identify you or the person you care for. Seacole does not need them. See “Who we share your data with” and “Sending data outside the UK” below for how these messages are processed.

Care Journey

If you use Care Journey, we help you work out what to do as a carer and give you a personalised plan. You can use it without saving anything. If you choose to save your plan to your account, we store your progress, the plan to show you, and your outward postcode, linked to your email, so we can give it back to you next time.

Please describe your situation without naming or identifying the person you care for. We do not need their details. Some of what you tell us, for example a health condition, is sensitive (special category) information. We only save sensitive information if you give your explicit consent, and you can withdraw that consent and delete your saved plan at any time. We use this only to give you your plan and your progress, never for advertising or profiling.

Lawful basis: your consent, including explicit consent for any health-related information.

Life Timeline

Life Timeline helps you capture and keep memories and life-story information, which may include text, photos, and voice recordings. You choose what to add and what, if anything, to save. We store what you save, linked to your account, so we can give it back to you and show it to anyone you choose to share it with.

Life Timeline may include sensitive (special category) information, such as details about health, or information about other people, including people who have died. We only save this information with your explicit consent, we store it securely, and we use it only to provide the tool to you and the people you choose. We do not use it for advertising or profiling. You can edit or delete your Life Timeline content, and withdraw your consent, at any time.

Lawful basis: your consent, including explicit consent for any special category information.

The Caring App (care coordination)

The Caring App lets a care circle, such as family, friends, and neighbours, coordinate care for a loved one. Depending on the features you use, this may include updates, notes, tasks, schedules, and files that you share with the people in your circle. Information shared in a care circle can include sensitive (special category) information, such as details about someone's health.

We store this information securely and show it only to the members of the relevant care circle, as directed by the people using it. The person who sets up or manages a circle is responsible for who is invited and for sharing only what is necessary. We only save special category information with explicit consent, and we use the information only to provide the coordination tool. We do not use it for advertising or profiling. You can leave a circle, and edit or delete content you have added, and we explain how to do this within the tool.

Lawful basis: your consent, including explicit consent for any special category information.

Who we share your data with

We use a small number of trusted providers to run the service, and we have or are putting in place a data processing agreement with each. They act on our instructions and may not use your data for their own purposes.

Supabase stores your account data, your tool-usage record, and your saved data. This is hosted in the UK and EU (the Care Funding Guide uses London; our main account data uses Ireland).
Anthropic (the Claude API) processes the messages you type into Seacole, to generate responses. Anthropic processes this in the United States. Anthropic does not use your data to train its models and does not sell it.
Vercel hosts and delivers our website.

We never sell your personal data, and we do not share it for anyone else's advertising.

Sending data outside the UK

Most of your data stays in the UK and EU. When you use Seacole, the messages you type are sent to Anthropic for processing in the United States, which is outside the UK. We make this transfer lawful using UK-approved safeguards: the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, set out in our agreement with Anthropic. We have assessed the risks of this transfer and minimise the data involved, which is why we ask you not to include identifying details in Seacole.

How long we keep your data

Account and email: while your account is active. If you do not use your account for 24 months, we delete it and the data linked to it.
Tool-usage record: while your account is active. It is deleted when your account is deleted, and in any case after 24 months of inactivity.
Sign-in hand-off codes: these are temporary. They can only be used once, expire within about a minute and a half, and are deleted promptly after use, so they are not kept as a usage log.
Seacole conversation data: kept for [retention period to be confirmed] and then deleted.
Care Journey saved data: while your account is active, deleted on your request or when you close your account, and in any case after 12 months of inactivity.
Life Timeline and The Caring App content: while your account is active, deleted on your request or when you close your account.

Your rights

Under UK data protection law you have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to object to or restrict how we use it, to data portability, and to withdraw consent where we rely on it. Withdrawing consent does not affect anything we did before you withdrew it.

To exercise any of these rights, contact us at privacy@thecaring.app. We will respond within one month.

If you ask us to delete your data, we remove it across all of our connected tools, which are linked by your email address. This includes your sign-in account, your tool-usage record, any Care Funding Guide data we hold, and any Care Journey, Life Timeline, and Caring App data you saved. A Subject Access Request is handled the same way: we gather your data from every connected tool, again by your email.

If you are unhappy with how we have handled your data, you can complain to the ICO at ico.org.uk, although we would welcome the chance to put things right first.

Cookies

We use only the cookies and similar storage that are strictly necessary to run the website and keep you signed in. These do not require your consent and are not used to track you. We do not use advertising cookies, and we do not sell your data. If we introduce analytics or any non-essential cookies in future, we will ask for your consent first and update this statement.

Changes to this statement

If we make significant changes to this statement, we will update the date above and, where appropriate, let you know.