Privacy Notice (UK GDPR Articles 13 & 14)

1. Data Controller vs. Data Processor Roles (A-01 / A-04)

• Care Home Resident, Clinical, Next-of-Kin & Staff Care Data (CantraCare as Data Processor): Each CQC-registered Care Home organisation (“Tenant”) is the Data Controllerfor the personal data and special-category health data of its residents, relatives/Powers of Attorney, and care staff. CantraCare processes this data strictly on the Care Home's documented instructions under our UK GDPR Article 28 Data Processing Agreement (DPA).
• Platform Account, Billing & Security Telemetry Data (CantraCare as Data Controller): CantraCare acts as an independent Data Controller for tenant onboarding contacts, commercial billing records, platform security audit logs, and support communications.

2. Categories of Personal Data We Process

• Resident Identity & Admission Data: Full name, date of birth, NHS number (encrypted at rest using AES-256-GCM), room/bed allocation, emergency contacts, Lasting Power of Attorney (LPA) and Court of Protection records, and funding details.
• Special Category Health & Care Records (UK GDPR Art 9): Diagnoses, allergies, DNACPR/ReSPECT status, NEWS2 physiological observations, Medication Administration Records (eMAR), clinical body maps, care plans, risk assessments, daily care notes, and CQC statutory incident notifications.
• Workforce & HR Compliance Data: Staff name, role, NI number (encrypted), DBS certificate number and check status (encrypted), right-to-work verification, training/qualification matrices, shift rotas, and clinical handover notes.
• Security & Audit Telemetry: IP address, user agent, authentication timestamps, MFA verification status, and tamper-evident HMAC-SHA256 audit log entries. Optional geolocation on page views is disabled by default and only captured where a Care Home Controller explicitly enables location-verified clinical access.

3. Lawful Bases for Processing (UK GDPR Articles 6 & 9)

4. Sub-Processors & International Data Transfers (H-02)

CantraCare hosts primary databases and clinical object storage in the United Kingdom (Google Cloud `europe-west2` London). We use the following vetted sub-processors:

• Google Cloud Platform (UK - `europe-west2` London): Encrypted database hosting and Google Cloud Storage for resident clinical documents and profile photos.
• Amazon Web Services (AWS SNS - `eu-west-2` London): SMS delivery for clinical alerts and authentication codes.
• Resend Inc.: Transactional email delivery (MFA recovery OTPs, staff invitations, billing notifications) governed by UK Addendum to EU SCCs.
• Google Firebase Cloud Messaging (FCM): Push notifications to authorised clinical mobile devices (resident names are pseudonymised to initials + short identifier in push payloads).
• Razorpay Software Pvt. Ltd.: SaaS subscription billing for Care Home tenants (no resident health data is ever shared with Razorpay).

Where authorised engineering support or sub-processors operate outside the UK, transfers are safeguarded by the UK International Data Transfer Agreement (IDTA) and a documented Transfer Risk Assessment (TRA) in accordance with UK GDPR Article 46 and s.85 of the Data (Use and Access) Act 2025.

5. Data Retention Schedule (NHS Records Management Code of Practice)

• Adult Social Care Resident Records: Retained for 8 years following discharge or death in accordance with the NHS England Records Management Code of Practice for Health and Adult Social Care, then securely purged or anonymised unless subject to an active legal/safeguarding hold.
• Staff HR & DBS Compliance Summary Records: Retained for 6 years after termination of employment (DBS certificate numbers are stored encrypted for CQC inspection evidence).
• Clinical & Security Audit Logs: Retained in tamper-evident HMAC-SHA256 chains for 8 years to satisfy CQC Regulation 17 and DSPT forensic audit requirements.
• Authentication Tokens & OTPs: Access tokens expire after 15 minutes; refresh tokens after 7 days; password/MFA reset OTPs expire after 10 minutes.

6. Your Data Protection Rights & DUAA s.103 Complaints Procedure

Under UK GDPR Articles 15–22, individuals have the right of Access (Subject Access Request / SAR), Rectification, Erasure (subject to statutory CQC clinical retention exemptions under Art 17(3)(b)/(c)), Restriction of Processing, Data Portability, and Objection.

How to exercise your rights: Care Home residents, relatives, and care staff should submit requests directly to their Care Home Manager (who can generate a complete machine-readable JSON or printable PDF SAR dossier directly within CantraCare). You may also contact our DPO at dpo@cantracare.co.uk.