This policy explains what CareCalls does with your personal information — what we collect, why, who we share it with, how long we keep it and what you can ask us to do about it.
This is the only privacy policy that applies to our service. If you find a copy of it anywhere else, this version is the current one.
We keep this policy under regular review. If you have a question or concern, contact us at support@carecalls.io.
1. Who We Are
CareCalls — CareCalls Limited, registered in England and Wales with company number 06884886 — is the controller of the personal information described in this policy.
Where we provide the service through an Organisation, such as a local authority or a care provider, that Organisation is responsible for the information it collects and passes to us, and we are responsible for what we do with it in delivering the service. Organisations we work with are given a separate data processing agreement setting out these roles.
2. Contacting Us
You can contact us by telephone, email or post.
- Telephone: 0330 058 8244
- Email: support@carecalls.io
- Post: CareCalls Limited, CARECALLS LIMITED, 483 Green Lanes, London, N13 4BS
2.1. Privacy contact
The person responsible for data protection at CareCalls is Max Pownall. You can reach him at support@carecalls.io, or by post at the address above marked "Privacy contact".
3. Who This Policy Covers
People come into contact with us in a number of ways, and the number of people connected to a single service can be one or many. A care professional may learn about us and tell a family member, who sets up the service for a parent, who nominates a neighbour to be alerted.
We group people as follows:
- Interested party — anyone enquiring about the service who has not set one up.
- Creator — the person who sets up a service and provides the information needed to deliver it.
- Receiver — the person who receives the reminders and check-ins. The Receiver may also be the Creator.
- Stakeholder — a person supporting the Receiver whose details have been added, and who may receive alerts, reports or access to manage the service.
- Agent — a member of staff at an Organisation who has been given access to manage services or view reports.
4. How We Collect Information
Most of the information we hold is given to us directly, because:
- you have set up or manage a service;
- someone has added your details so that you can receive reminders, check-ins or alerts;
- you contacted us by email, telephone, our website contact form or live chat;
- you requested a demonstration of the service;
- you used our funding checker;
- you requested an information pack from our share page;
- you subscribed to our newsletter, or attended or registered for an event;
- you applied for a job with us;
- you represent an Organisation we work with; or
- you made an information request to us.
We also generate information as the service runs — records of calls, messages and emails sent, whether they were answered, sign-in attempts, and changes made to a service.
Occasionally we contact organisations using publicly available business contact details. We always ask before sending further correspondence.
5. Providing Somebody Else's Details
Setting up our Services usually means providing contact details belonging to other people — the Receiver, and any Stakeholders who are to receive alerts, reports or access to the Account.
You must have the permission of the owner of every phone number and email address you provide before you enter it. This applies whether you are setting up the Services for a family member, for a client, or for anyone else.
This matters for practical reasons as well as legal ones. Contact details that are wrong, out of date, or given without permission can result in:
- personal information about the Receiver reaching somebody who should not have it;
- a person who has no connection to the Receiver being contacted repeatedly; and
- a person who holds a reassigned or mistyped number being able to use our inbound telephone service to change or stop the Services.
If you are told that someone no longer wishes to be contacted, you must remove their details from the Account. Anyone whose details have been added can also remove themselves, or ask us to remove them, without going through the person who added them.
When a service is set up, we send an introductory message to each mobile number and email address added, explaining who added them, what they will receive, and how to change or remove their details. We do not send an introductory message to landline numbers, because they cannot receive text messages.
6. What We Collect and Why
| Category | What it includes | Why we process it | Our lawful basis |
|---|---|---|---|
| Enquiry information | Name, email, telephone number, and what you asked about | To answer your enquiry and tell you about the service | Legitimate interests — responding to people who contact us |
| Service information | Names, telephone numbers, email addresses, relationships between people, schedules, message content, service settings | To deliver the reminders, check-ins and alerts you have configured | Performance of our contract with you; for Receivers and Stakeholders whose details were provided by someone else, our legitimate interests in delivering a service requested for their benefit |
| Usage information | Records of calls, messages and emails, whether they were answered, sign-in attempts, changes made to a service, which Agent set a service up and how (for example in person or by telephone), and — where a text message contains a link that we shorten for delivery — when that link was clicked | To operate and troubleshoot the service, and to show you what has happened on the account | Performance of our contract; legitimate interests in operating a reliable service |
| Recordings and transcriptions | Recorded messages, recordings of delivery calls, transcriptions of spoken responses, recordings of customer service calls | To deliver personalised messages, confirm what happened on a call, investigate problems and train our team | Performance of our contract; legitimate interests in verifying and improving delivery |
| Payment information | Name, billing address, card or Direct Debit details | To take payment for the service | Performance of our contract; legal obligation for accounting records |
| Website information | IP address, device and browser information, pages visited | To operate and secure our website and understand how it is used | Legitimate interests in security; consent for analytics — see our Cookie Policy |
Payment details are entered directly into our payment provider's systems and are not stored in our own databases. Where Direct Debit details are given by telephone or by post, they are entered into our payment provider's systems and the original is destroyed.
6.1. Health information
Our service is not clinical. We do not ask for health information and none is needed to use the service.
Because you choose the content of the messages, you may include health information — the name of a medication, for example — and a Receiver may mention something about their health when responding to a check-in. Where that happens we handle the information with the same care as everything else we hold, but we do not review, interpret or act on it, and we do not treat it as a health record.
7. Recordings
We record in three situations:
Messages you record for delivery as part of the service.
Delivery calls, and the spoken responses given to them, so that we can confirm what happened, investigate problems and improve the service.
Customer service calls, so that we have a record of what was discussed.
Recordings are stored securely and access is limited to staff who need it. Retention is set out in clause 11.. If you would prefer that delivery calls to a particular Receiver are not recorded, contact us at support@carecalls.io.
8. How We Contact You, and How to Stop It
We use several channels both to deliver the service and to provide support. This table sets out how each is used, how you come to be contacted on it, and how to stop.
| Channel | Used for | Where | How you are opted in | How to opt out |
|---|---|---|---|---|
| Text message | Reminders and check-ins, alerts, reports | United Kingdom | When a service is set up or edited — online, by telephone or by email — using a mobile number provided by you or by the person setting up the service. We do not send marketing by text message. Links in text messages may be shortened so they fit within the message; where that happens, our messaging provider records when a shortened link is clicked. | Reply STOP to any message; call back the number the service is delivered from; sign in and remove your details; or email support@carecalls.io |
| Telephone call | Reminders and check-ins, alerts, reports, customer service | United Kingdom, United States | As above, using a telephone number provided by you or by the person setting up the service. When you call us, your number is stored so we can find previous enquiries. We do not make marketing calls. | Call back the number the service is delivered from and follow the options; sign in and remove your details; or email support@carecalls.io |
| Alerts, reports, account notices, customer service, marketing | United Kingdom, United States | As above. We only send marketing email where you have given us permission. When you email us, your address is stored so we can find previous enquiries. | Service email includes a link to sign in and change or remove your details. Marketing email includes an unsubscribe link. | |
| Live chat | Customer service | United Kingdom, United States | We do not collect identifying information when you start a chat. We may ask for contact details if we need to continue the conversation afterwards. | Not applicable |
You can stop receiving messages from us at any time, by any of the following routes:
- Reply STOP to any text message we send. We will stop sending text messages to that number and will show a notice on the Account so that the person managing the Services knows the number can no longer be used.
- Call us back on the number the Services are delivered from, and follow the options to deactivate.
- Sign in to the Account and remove or change your details.
- Email us at support@carecalls.io, or call 0330 058 8244.
Text messages also support the standard keywords STOP, STOPALL, UNSUBSCRIBE, CANCEL, END and QUIT to stop messages, START to resume them, and HELP or INFO for assistance.
Marketing and service messages are treated differently. Unsubscribing from marketing email stops marketing email only. Messages that form part of the Services — reminders, check-ins, alerts, reports and notices about the Account — will continue for as long as your details remain on an active Account. To stop those, your details must be removed from the Account, or the Services stopped.
Message frequency depends on the schedule chosen for the Receiver. Many people receive a single daily check-in. The maximum is eight per day. Message and data rates may apply.
8.1. Mobile information is not shared
Mobile information and messaging consent are not shared with, sold to, or otherwise provided to third parties or affiliates for marketing or promotional purposes.
We share telephone numbers with our communications providers only to the extent needed to deliver the messages you have asked for, as set out in clause 9.1..
9. Who We Share Information With
9.1. Our suppliers
We use the following suppliers to run the service. Each processes information only on our instructions, is bound by a written agreement, and may not use the information for its own purposes or share it with anyone else.
| Supplier | What we use it for | Information processed | How long they keep it | Location |
|---|---|---|---|---|
| Twilio | Delivering telephone calls and text messages; shortening links in SMS and recording when shortened links are clicked | Receiver and Stakeholder contact details, delivery records, call recordings, click events on shortened SMS links | 13 months | United States |
| Postmark | Delivering email | Contact details, email delivery records | 45 days | United States |
| Laravel Cloud | Hosting our application and database | All categories of information we hold | For as long as we hold it | United States |
| Amazon Web Services (S3) | Storing message audio, call recordings and transcriptions | Recorded messages, recordings of delivery calls, transcriptions of spoken responses | For as long as we hold it — see our retention policy | United Kingdom |
| Google BigQuery | Reporting and analysis | All categories of information we hold | For as long as we hold it | United States |
| Stripe | Taking payment and storing payment methods | Name, contact details, payment details | For as long as the relationship continues | European Economic Area and United States |
| Chatwoot | Live chat, customer service telephone calls, and recordings of those calls | Contact details, chat transcripts, support call recordings | 1 year | United States |
| Anthropic | Generating replies in our live chat | The content of your chat messages | 30 days | United States |
| Nightwatch | Monitoring the performance and errors of our application | Technical records which include database queries and the recipients of emails we send, and so may contain personal information | 90 days | United States |
| Cloudflare | Website hosting, content delivery, domain management, and Turnstile bot protection on forms | IP addresses, technical request information, and the contents of website forms while in transit | 30 days | Global network |
| Mixpanel | Understanding how people use our website and Platform, and investigating problems affecting an individual | Name and email address, usage information, and session recordings in which personally identifying information is masked | 2 years; session recordings 30 days | United States |
| Google Analytics | Understanding how people use our website | Usage information | 2 months | United States |
| Google Workspace | Our staff email and internal administration | Contact details, correspondence | For as long as we hold it | United States |
| Trustpilot | Collecting and publishing reviews | Name and email address of people invited to review us | For as long as the review is published | United States |
| UK Postbox | Receiving and scanning our post | Anything contained in post sent to us, including bank details on Direct Debit forms | Destroyed once transcribed | United Kingdom |
We review suppliers before we work with them. Where a supplier changes, we update this table.
9.2. Other circumstances
We also share information:
- With public authorities or law enforcement, where we are required to by law or in response to a lawful request. Our basis is compliance with a legal obligation, or our legitimate interests in protecting our rights and those of others.
- To prevent fraud and abuse, including telecommunications fraud, and to investigate technical problems. Our basis is our legitimate interests in the security of the service.
- In connection with a sale or reorganisation of our business, in which case we will tell you.
- In aggregated, anonymised form, as statistics that do not identify anyone.
We do not sell personal information, and we do not share it with anyone for their own marketing purposes.
10. Where Your Information Is Held
Most of our suppliers are based in the United States. Our application data and message audio are held in the United Kingdom and the United States as set out in clause 9.1..
Where personal information is transferred outside the United Kingdom to a country without a UK adequacy decision, we rely on the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, together with an assessment of the risks of the transfer and any additional safeguards needed. We take all steps reasonably necessary to ensure your information is treated securely and in accordance with this policy.
11. How Long We Keep It
We keep personal information for as long as it is needed for the purpose it was collected for, and then delete it.
Information we hold ourselves:
| Information | How long we keep it |
|---|---|
| Service information — contact details, schedules, message content | For as long as the service is active, and for a period afterwards so that a service can be restarted and so that we can answer questions about it |
| Usage information — records of calls, messages and emails | For as long as needed to operate the service and to report on it |
| Recorded messages | For as long as the service is active, and for a limited period afterwards |
| Recordings of delivery calls and transcriptions | For a short period only, sufficient to investigate problems |
| Customer service records | For as long as needed to handle your enquiry and any follow-up |
| Payment and accounting records | Six years, as required by tax law |
| Records of agreement to our terms | For as long as we can be required to demonstrate that agreement was given |
We are in the process of automating the enforcement of these periods. In the meantime, you can ask us to delete your information at any time and we will do so, subject to clause 15..
Information held by our suppliers is kept for the periods shown in clause 9.1.. Several suppliers hold information only briefly — for example our email provider keeps delivery records for 45 days and our monitoring tool keeps technical records for 90 days — and in those cases the information is deleted automatically without us needing to act.
Deleted information may persist in backups for a limited period before those backups are overwritten.
12. Keeping It Safe
The security of your personal information matters to us, particularly because much of it concerns people who are vulnerable.
- Information is encrypted in transit and at rest.
- Access is restricted to staff, contractors and agents who need it to operate, support or improve the service. They are bound by confidentiality obligations.
- Signing in uses a one-time passcode sent to your stored contact details. We do not store passwords.
- Sign-in attempts, changes to accounts, and changes to the deliverability of an address are logged so that we can answer the question "why did this happen?"
- Databases are backed up regularly.
- We use a monitoring tool that records technical information about our application, including database queries and the recipients of emails. This helps us diagnose problems affecting a specific person quickly. Access to it is restricted and the records are deleted after 90 days.
If we become aware of a breach of personal information that is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours, and will tell affected individuals directly where the risk to them is high.
13. Automated Decisions
We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you.
The service does act automatically — it delivers messages on the schedule you set and sends alerts when a message is unanswered — but those actions follow the configuration you have chosen, not a judgement we have made about anyone.
14. Artificial Intelligence
We use artificial intelligence provided by Anthropic to help answer questions in our live chat.
- AI-generated answers can be wrong. They are not advice, and you should not rely on them for anything important. Ask for a human at any time and we will pass you to one.
- Your messages are not used to train the AI provider's models.
- Chat transcripts are retained as set out in clause 9.1..
We also use AI to search our own published articles when answering questions. That process uses the text of the articles only and involves no personal information.
15. Your Rights
Under data protection law you have rights over your personal information. Which rights apply depends on why we are processing it.
- Access — you can ask for a copy of the personal information we hold about you.
- Rectification — you can ask us to correct information you think is wrong, or complete information you think is incomplete.
- Erasure — you can ask us to delete your personal information in certain circumstances.
- Restriction — you can ask us to limit how we use your information in certain circumstances.
- Objection — you can object to processing we carry out on the basis of our legitimate interests.
- Portability — you can ask us to transfer information you gave us to another organisation, or to you, where we process it by automated means on the basis of consent or contract.
- Withdrawing consent — where we rely on consent, you can withdraw it at any time.
You do not have to pay to exercise these rights. We will respond within one month. If your request is complex we may need longer, and we will tell you within the month if that is the case.
To make a request, contact us using the details in clause 2.. We may ask you to confirm your identity first.
If your details were added by someone else — because they set up a service for you or nominated you to receive alerts — you can exercise these rights directly with us. You do not need to go through the person who added you, and we will not ask their permission.
16. Complaints
If you are unhappy with how we have handled your personal information, please tell us first at support@carecalls.io so that we have the chance to put it right.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Complaining to the ICO does not affect any other legal remedy available to you.
17. If You Are in the United States
Depending on the state you live in, you may have additional rights over your personal information. These may include the right to know what personal information we collect and how we use it; the right to obtain a copy of it; the right to have it corrected or deleted; the right to opt out of the sale or sharing of personal information and of targeted advertising; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising any of them.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. As set out in clause 8.1., we do not share mobile information or messaging consent with third parties for marketing purposes.
To exercise any of these rights, contact us at support@carecalls.io. We will not treat you differently for doing so. If we cannot verify your identity or your authority to act for someone else, we will tell you why. If we decline a request, you may ask us to reconsider by replying to our response.
18. Children
Our service is not directed to children and we do not offer it directly to them.
We do not knowingly collect a child's personal information except where a parent or legal guardian has provided it in order to set up a service for that child. A person setting up a service must be at least 18 years old, and a Stakeholder must be at least 16.
If you believe a child's information has been provided to us without that authority, contact us at support@carecalls.io and we will delete it.
19. Cookies
Our website uses cookies and similar technologies. How they work, what they do, and how to control them are set out in our Cookie Policy.
20. Other Websites
Where we link to another organisation's website, this policy does not cover how that organisation handles personal information. We encourage you to read the privacy notice on any website you visit.
21. Changes to This Policy
We update this policy when the service changes, when the law changes, or when the suppliers we rely on change. The version number and effective date at the top of this page tell you which version you are reading.
Where a change materially affects how we use your personal information, we will tell you directly.