Privacy Policy — Compliance Workspace

1. Who we are

Compliance Workspace is a CQC compliance management platform operated by [COMPANY NAME], a company registered in England and Wales.

For questions about this policy or your data, contact us at privacy@[domain].co.uk.

2. What data we collect

We collect the following when you use Compliance Workspace:

Account data — your email address and password (stored securely via Supabase Auth).
Organisation details — your care home name, CQC location ID, manager name, local authority, and other details you enter during setup.
Compliance records — data you enter into trackers, including staff names, certificate expiry dates, NMC pin numbers, resident initials (not full names), and action plan details.
Usage data — page visits and actions within the platform, collected automatically by our hosting provider (Vercel).

We do not collect full resident names, NHS numbers, care plan details, or any other special category health data.

3. How we use your data

To provide and maintain your compliance workspace.
To generate and personalise your evidence pages using AI (your home details are sent to Anthropic's API for this purpose — see section 5).
To send you weekly compliance alert emails when certificates, NMC pins, DoLS authorisations, or action plans need attention.
To manage your account, billing, and team members.
To respond to support requests.

Our legal basis for processing is contract (to deliver the service you subscribed to) and legitimate interests (compliance alerts and service improvement).

4. Data storage and security

Your data is stored in the European Union (Ireland, AWS eu-west-1 region) via Supabase. All data is encrypted in transit (TLS) and at rest.

We use row-level security on the database so that each care home can only access its own data. Access is restricted to authorised team members you invite.

5. Third parties we share data with

Supabase

Database and authentication provider. Data stored in EU (Ireland). Privacy policy.

Anthropic

AI provider used to generate your evidence pages during onboarding. Your home details (name, manager, operating information) are sent to Anthropic's API for this purpose. No resident data is sent. Anthropic is US-based; data transfer is covered by standard contractual clauses. Privacy policy.

Resend

Email delivery provider used to send weekly compliance alert emails. Your email address and alert content are processed by Resend. Privacy policy.

Vercel

Hosting and infrastructure provider. Processes request logs and usage data. Privacy policy.

Stripe (planned)

Payment processing. Billing information is handled directly by Stripe and is not stored by us. Privacy policy.

We do not sell your data to third parties.

6. Data retention

We retain your data for as long as your subscription is active. If you cancel and request deletion, we will delete your account and associated data within 30 days, except where we are required to retain records by law.

7. Your rights under UK GDPR

You have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — ask us to delete your data ("right to be forgotten").
Portability — receive your data in a machine-readable format.
Restriction — ask us to limit how we process your data.
Objection — object to processing based on legitimate interests.

To exercise any of these rights, email us at privacy@[domain].co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use session cookies only — these are essential for keeping you logged in and are not used for tracking or advertising. We do not use third-party analytics cookies.

9. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email. The "last updated" date at the top of this page reflects the most recent revision.