Privacy policy

CareRostr is run by Ellis Evans, a sole trader based in the Vale of Glamorgan, Wales, trading as CareRostr. For the purposes of UK data protection law, Ellis Evans is the controller of the personal information described in this policy, which means he decides how and why it is used and is responsible for protecting it.

You can contact us about anything in this policy at hello@carerostr.com. Because we are a small business, we have not appointed a Data Protection Officer and are not required to. Ellis Evans is personally responsible for data protection.

This policy covers personal information we collect when you:

• visit carerostr.com;
• apply for early access or otherwise contact us through the website;
• email us, or exchange emails with us after getting in touch; and
• sign in to CareRostr through this website.

It does not cover the information that care agencies store inside the CareRostr service about their clients and staff. That works differently, and is explained in section 11.

When you apply for early access. The form asks for your name, the name of your agency, your email address and, if you choose to give them, your phone number, the number of carers you employ and anything else you'd like to tell us.

When you email us. Your email address, your name if you include it, and whatever you write, along with any later correspondence.

When you visit the website. Like almost every website, our hosting provider automatically records technical information about each request, such as your IP address, browser type, the page requested and the date and time. When you submit the form, your IP address is also held briefly in memory to stop the form being abused by automated spam. It is not stored anywhere when that check is done.

When you sign in. If you have been invited to use CareRostr, our sign in provider processes your name, email address, sign in activity and the security information needed to keep your account safe.

Please don't send us health information. We don't need, and don't ask for, information about anyone's health or care through the website or by email. Please don't include details of your clients or staff in the form or in emails to us. If you do, we will delete them.

We don't collect information about you from other sources, except publicly available information about your agency (such as your website or regulator listing) where it helps us respond to your enquiry.

UK data protection law only allows us to use personal information where we have a valid reason, known as a lawful basis. Here is what we do and the basis we rely on for each.

Where we rely on legitimate interests, we have considered your interests and rights and are satisfied they are not overridden by ours. You can ask us for more detail on that assessment, and you have the right to object (see section 10).

Marketing. We will not add you to a newsletter or mailing list without asking you first. Any follow up email about CareRostr will include a simple way to tell us to stop, and if you do, we will.

No automated decisions. We don't make decisions about you by automated means, and we don't profile you.

We never sell your data. We don't sell, rent or trade personal information, and we don't share it with anyone for their own marketing.

We use a small number of trusted providers to run the website and handle email. They act as our processors: they may only use your information to provide their service to us, under contracts that require them to keep it secure and confidential.

• Vercel Inc. hosts the website and processes the technical request information described in section 3.
• Resend delivers form submissions to our inbox and sends our emails.
• Our email providers, which route and store emails sent to hello@carerostr.com.
• Clerk Inc. provides secure sign in for invited users.

We may also disclose information where the law requires it, for example to a court, regulator or the police; to professional advisers such as lawyers or accountants, who owe us a duty of confidentiality; or, if CareRostr is ever sold, restructured or incorporated as a company, to the business that takes it on, which would have to treat your information in line with this policy.

Some of our providers are based in, or use servers in, the United States and other countries outside the UK. Where personal information is transferred outside the UK, we make sure it is protected to the standard UK law requires, by relying on one of the following:

• UK adequacy regulations, which recognise that a country (or, for the United States, a provider certified under the UK Extension to the EU-US Data Privacy Framework) protects personal information adequately; or
• the International Data Transfer Agreement or Addendum approved by the UK Information Commissioner, together with any additional safeguards needed.

Email us if you'd like more information about the safeguards for a particular provider.

• Enquiries and early access applications that don't lead to you becoming a customer are kept for 24 months from our last contact with you, then deleted. CareRostr is not yet generally available, so this gives us time to come back to you when it is.
• If your agency becomes a customer, we keep business contact details and correspondence for as long as we work together, and for up to six years afterwards, in line with UK limitation periods and tax record requirements.
• Website request logs are kept by our hosting provider for a short period, normally no more than 30 days.
• If you ask us to stop contacting you, we keep a minimal record of your email address and that request, solely so we don't contact you again.

You can ask us to delete your information sooner at any time.

We take security seriously, as you would expect from a business that builds software for care providers. All connections to the website are encrypted, access to personal information is limited to the people who need it, and our accounts are protected with strong passwords and multi factor authentication. Our providers are established companies with their own security programmes.

No system is completely secure. If a breach affecting your personal information happens, we will deal with it promptly and tell you and the Information Commissioner where the law requires us to.

Cookies are small files a website stores on your device. We only use cookies that are strictly necessary. These are set by Clerk, our sign in provider, to let invited users sign in securely and stay signed in (for example cookies named __session and __client_uat). Because they are essential to a service you request, the law does not require us to ask for your consent to them.

We do not use analytics, advertising, social media or tracking cookies. If we ever want to, we will update this policy and ask for your consent before setting them.

You can block or delete cookies in your browser settings. The website will still work, but you won't be able to sign in.

Under UK data protection law you have the right to:

• access the personal information we hold about you and get a copy;
• correct information that is wrong or incomplete;
• have it deleted, where we no longer have a good reason to keep it;
• restrict how we use it, for example while a complaint is looked into;
• object to us using it on the basis of legitimate interests, and to any direct marketing, which we will always stop;
• data portability, meaning a copy of information you gave us in a commonly used electronic format, where the law allows; and
• withdraw consent at any time, where we rely on it.

To use any of these rights, email hello@carerostr.com. It's free, and we will respond within one month. If your request is complex we may need up to two further months, and we'll tell you if so. We may need to confirm your identity before acting on a request.

When a care agency uses CareRostr, it stores information about its clients and staff in the service, which can include health and care records. For that information, the agency is the controller and CareRostr acts as its processor, handling the information only on the agency's instructions and under a written contract.

If you are a client, family member or member of staff of an agency that uses CareRostr, please contact that agency about your information and your rights. If you contact us, we will pass your request to them.

Children. This website and CareRostr are intended for businesses and their staff. They are not aimed at anyone under 18, and we don't knowingly collect information from children.

Other websites. If we link to another website, its own privacy policy applies, not this one.

Do you have to give us your information? No. You don't have to fill in the form or contact us. If you choose not to give us your name, agency and email address, we simply won't be able to reply to an application.

We will update this policy when our practices change, for example when CareRostr becomes a company or launches more widely. The date at the top shows when it was last changed. If a change significantly affects how we use information you have already given us, we will tell you directly before it takes effect.

If you have a question or concern about how we handle your information, please email hello@carerostr.com first. We'd like the chance to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or by calling 0303 123 1113.