Privacy Policy

1. Who We Are and How to Contact Us

Data controller: Evertrack

For privacy enquiries, contact us at privacy@evertrackapp.com. If you are based outside the UK but offer services to people in the UK, we may have appointed a UK representative under Article 27 UK GDPR; contact details will be published if applicable.

2. Purposes of Processing

We use your personal data for the following purposes:

• Account management: Creating and managing your user account, authentication, and access control.
• Care delivery: Enabling care providers to record and manage resident care, hourly logs, incidents, medication, care plans, and behaviour monitoring.
• Compliance: Supporting CQC and Ofsted compliance, including accurate, complete, and secure records (Regulation 17).
• Support: Responding to enquiries, providing customer support, and sending service-related communications.
• Security: Detecting and preventing fraud, abuse, and security incidents.

3. Lawful Basis for Processing

We rely on the following lawful bases under Article 6(1) UK GDPR:

• Contract (Article 6(1)(b)): Processing necessary to provide the Service and perform our contract with you.
• Legitimate interests (Article 6(1)(f)): Security, fraud prevention, and improving our Service, where these interests are not overridden by your rights.
• Consent (Article 6(1)(a)): Where we send marketing communications; you may withdraw consent at any time.

For special category data (e.g. health data about residents), we rely on Article 9(2)(h) UK GDPR: processing necessary for the provision of health or social care. We may also rely on Article 9(2)(a) where consent is obtained.

4. Data We Collect

We collect the following categories of personal data:

• Account data: Email address, full name, role, organisation, password (hashed).
• Resident data: Names, care plans, health information, hourly logs, incident reports, medication records, behaviour logs (entered by care providers).
• Staff data: Employment records, training, supervisions, competency assessments.
• Usage data: Logs of access, IP address, device information, and actions within the Service.
• Communications: Emails and messages sent via the Service.

5. Who We Share Data With

We share personal data with the following categories of recipients:

• Supabase: Hosting, database, authentication, and storage (EU data centre in Ireland).
• Resend: Transactional and invitation emails.
• Your organisation: Other authorised users within your Organisation as configured by your administrator.

We have data processing agreements with our processors that comply with UK GDPR. We do not sell your personal data.

6. International Transfers

We primarily store and process data within the UK and European Economic Area. When we transfer data outside the UK, we use appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or other approved mechanisms. You may request copies of these safeguards by contacting us.

7. How Long We Keep Data

We retain personal data for as long as necessary for the purposes set out above:

• Account data: For the duration of your subscription and up to 7 years after termination for legal and regulatory purposes.
• Resident and care data: In accordance with your Organisation's retention policy and care sector requirements (e.g. CQC, Ofsted).
• Usage and audit logs: Up to 6 years for security and compliance.

When we no longer need the data, we securely delete or anonymise it.

8. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion in certain circumstances.
• Restriction: Request that we limit processing in certain circumstances.
• Object: Object to processing based on legitimate interests.
• Data portability: Receive your data in a structured, machine-readable format.

Where we process on the basis of consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. To withdraw consent for marketing, use the unsubscribe link in our emails or contact us.

To exercise your rights, contact us at privacy@evertrackapp.com. We will respond within one month.

9. Right to Complain

You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint. ICO helpline: 0303 123 1113.

10. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and regular security assessments. We require our processors to maintain the same standards. Care records are stored securely and accessed only by authorised users in line with Regulation 17 and the Data Protection Act 2018.

11. Special Category Data (Health Data)

"Data concerning health" includes personal data related to physical or mental health and the provision of healthcare. We process such data on behalf of care providers to deliver the Service. We rely on Article 9(2)(h) UK GDPR (provision of health or social care) and, where applicable, Article 9(2)(a) (consent). We apply additional safeguards and only process health data as necessary for care delivery and compliance.

12. Cookies and Similar Technologies

We use essential cookies to enable the Service to function (e.g. authentication, session management). We may use analytics cookies to improve our Service; where required, we will obtain consent. You can manage cookie preferences in your browser settings.

13. Statutory or Contractual Obligation

Providing certain personal data (e.g. email, name, role) is necessary to create an account and use the Service. If you do not provide this data, we may not be able to provide the Service. Care providers have a legal obligation under Regulation 17 to maintain accurate records; the Service supports this obligation.