Privacy Notice

This notice explains how Careviel handles personal data across our website, the Careviel HR and Careviel Care platforms, and the Careviel Staff and Careviel Care mobile apps. It also sets out your rights under the UK GDPR and the Data Protection Act 2018.

1. Who we are & our two roles

Careviel is operated by Bespoke Infotech and Creatives Ltd ("Careviel", "we", "us"). Careviel provides care-management and HR software to UK health and social care providers.

We act in two different roles depending on the data, and this determines who is responsible for it:

If your personal data was entered into Careviel by your employer or care provider (for example, you are a member of staff or a person receiving care), that organisation is the controller — please contact them first to exercise your rights (see section 9). We will help them respond.

2. The data we collect

Account & billing (we are the controller)

• Your name, work email, phone number and organisation details.
• Subscription and payment information. Direct Debit payments are handled by GoCardless — we do not store your full bank details; we hold a payment reference and mandate status only.
• Support messages and correspondence.

Workforce & HR data (we are the processor)

• Staff names, contact details, roles, rotas, timesheets and pay information.
• Right-to-work, visa/sponsorship, DBS/background-check and training records where the provider records them.

Care data — including special category health data (we are the processor)

• Service-user details, care plans, visit notes, tasks and electronic medication records (eMAR).
• This can include health and other special category information, which the law protects more strictly (see section 4).

Data created by the mobile apps

• Location — captured only at the moment of clock-in/out to verify you are at the assigned site or visit ("geofenced" clock-in). We do not track your location in the background.
• Camera & photos — photos you choose to attach to care notes, eMAR evidence or documents.
• Push-notification token — a device identifier from Apple (APNs) or Google (FCM) so we can send you shift, visit and broadcast alerts.
• Biometrics — if you enable Face ID / Touch ID / fingerprint unlock, this is handled entirely by your device's secure hardware (Apple Keychain / Android Keystore). Careviel never receives, sees or stores your biometric data.

Technical & usage data

• IP address, device and app version, and security logs needed to keep the service safe and working.

3. How the mobile apps use your device

The Careviel Staff and Careviel Care apps request device permissions only for the features above, and always ask before first use:

• Location — geofenced clock-in/out only; not used in the background.
• Camera / photo library — only when you add a photo to a record.
• Notifications — for shift, visit and message alerts (you can turn these off in your device settings).
• Face ID / biometrics — on-device unlock only, as described above.

4. How and why we use data (legal bases)

As a controller (account, billing, support, website), our legal bases under UK GDPR Article 6 are:

• Contract — to provide and administer your subscription.
• Legitimate interests — to secure, support and improve the service (balanced against your rights).
• Legal obligation — to meet accounting, tax and other legal duties.
• Consent — for optional marketing, which you can withdraw at any time.

As a processor, we process workforce and care data only on the care provider's instructions and under a data-processing agreement. Where that data includes special-category (health) data, the provider relies on a condition under UK GDPR Article 9 — typically the provision of health or social care (Article 9(2)(h)) — and we process it solely to deliver the service to them.

5. Who we share data with (sub-processors)

We do not sell personal data. We share it only with service providers who help us run Careviel, under contract and only as needed:

We may also disclose data where required by law or to protect our legal rights.

6. Where your data is stored

Careviel is hosted in the United Kingdom. Some sub-processors (for example push-notification gateways) may process limited data outside the UK; where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement.

7. How we protect data

• Encryption in transit (HTTPS/TLS everywhere) and encryption at rest for sensitive fields and backups.
• Each subscriber's data is held in its own isolated database.
• Access controls, strong authentication (including optional two-factor and biometric unlock) and a tamper-evident audit log.
• Encryption keys are held separately from the data they protect.

8. How long we keep data

Account and billing records are kept for the life of your subscription and for as long afterwards as the law requires (for example, tax records for six years). Care and HR data is retained according to the provider's instructions and their own retention obligations; when a subscription ends we return or securely delete it on the provider's instruction.

9. Your rights

Under UK GDPR you have the right to:

• Be informed about how your data is used (this notice).
• Access a copy of your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten") in certain circumstances.
• Restrict or object to processing in certain circumstances.
• Data portability — receive your data in a portable format.
• Rights relating to automated decision-making — Careviel does not make decisions with legal or similarly significant effects about you by automated means.
• Withdraw consent at any time where we rely on consent.

You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113 — though we'd welcome the chance to help first.

10. Information for subscribers (our customers)

When you subscribe to Careviel and enter workforce or care data, you are the data controller and Careviel is your processor. Our processing terms give you, among other things:

• A commitment that we process personal data only on your documented instructions.
• Confidentiality obligations on our staff and appropriate security measures (section 7).
• The current list of sub-processors (section 5) and advance notice of changes, so you may object.
• Assistance responding to data-subject requests and, where required, data protection impact assessments.
• Notification without undue delay if we become aware of a personal-data breach affecting your data.
• Return or secure deletion of your data at the end of the contract.

As a controller you remain responsible for having a lawful basis to collect the data you enter, for your own privacy notices to your staff and service users, and for responding to their requests. A full Data Processing Agreement is available on request at privacy@careviel.com.

11. Cookies

Our website and apps use only the cookies and local storage strictly necessary to sign you in and keep your session secure. We do not use advertising or third-party tracking cookies.

12. Children

Careviel is a workplace tool for care organisations and is not directed at children. Where a care provider records data about a young person receiving care, that provider is the controller and is responsible for the appropriate lawful basis and consents.

13. Changes & how to contact us

We may update this notice from time to time; the "last updated" date above shows the latest version, and we will tell subscribers about material changes.