Your data, handled with care.

The role we play depends on the data. It matters because it determines who you contact to exercise your rights.

Depending on your relationship with us, we may process the following categories:

• Resident care data (special category): care plans, “About Me” details, daily notes, NEWS2/RESTORE2 observations, incidents, allergies, conditions and NHS number — health and social-care data processed on the care home’s behalf.
• Staff & workforce data: name, contact details, role, rota and attendance, right-to-work and DBS status, training and qualification records, and (where the HR/payroll modules are used) salary, bank and tax details.
• Account & login credentials: usernames and securely hashed passwords, and audit metadata (who did what, and when) used for Reg 17 governance.
• Website & enquiry data: name, work email, telephone, organisation and the message or interests you submit when you contact us or book a demo.
• Technical data: IP address, device and browser metadata, and essential cookies needed to run the site securely (see our cookie settings in the footer).

Personal data is processed for these purposes:

• Providing and operating the Care Management System and HR platform for the care provider
• Delivering point-of-care records, clinical monitoring, handover, rota and compliance features
• Producing audit trails and governance evidence (including CQC Reg 17 records)
• Responding to website enquiries, arranging and confirming demos, and providing quotes
• Sending service and security notifications about the platform
• Meeting our legal, regulatory and statutory obligations
• Marketing communications where you have submitted an enquiry, requested a demo or otherwise opted in

Platform data (as processor): the care provider, as controller, determines the lawful basis. This is typically the performance of a contract for staff data, and, for resident health data, the provision of health or social care under UK GDPR Article 9(2)(h), together with legal obligations for statutory reporting. We process it only on the provider’s instructions.

Website & marketing data (as controller): we rely on our legitimate interest in responding to your enquiry and running our business, or on your consent where you have explicitly given it. You can withdraw consent at any time using the details below.

Website and enquiry data (contact-form submissions, demo bookings) is held on managed PostgreSQL infrastructure in the United Kingdom (London, AWS eu-west-2). Emails to and from our team are processed via Microsoft 365. Where a supplier operates outside the UK, any transfer is governed by the UK International Data Transfer Agreement or Standard Contractual Clauses with applicable safeguards. The current list of suppliers is published on our sub-processors page.

We may also disclose data where required to comply with a legal obligation, a court order or a lawful request from a regulator such as the CQC or the ICO.

We advertise this website using Google Ads. To understand whether that advertising works, we use Google’s conversion-measurement tags on this site, including Google’s “enhanced conversions” feature: when you book a demo or send us an enquiry, the email address you provide may be hashed (using SHA-256, so Google never receives the address itself) and sent to Google to match the enquiry to an ad interaction. Google processes this data in accordance with its Ads Data Processing Terms and may process it outside the UK.

None of this happens without your consent: advertising cookies and this measurement are controlled by the cookie banner (Google Consent Mode). If you decline marketing cookies, no advertising identifiers or hashed contact data are sent — you can change your choice at any time via the cookie settings link in the footer.

We apply technical and organisational measures appropriate to the sensitivity of care data:

For the full picture, see our Trust & Security overview.

• Resident & staff platform data: retained for as long as the care provider instructs, in line with the statutory retention periods for adult social-care and employment records. On termination we provide export assistance and then securely delete or return the data.
• Website & marketing leads: retained for up to 24 months from last meaningful contact, then deleted or anonymised unless you have become a customer.
• Server & access logs: retained for 90 days for security and incident-response purposes.

Following a verified deletion request, we delete or anonymise personal data within 30 days, subject to any legal obligation to retain specific records.

Under UK/EU GDPR you have the right to:

Where FlexiEle is the processor (platform data), please raise requests with your care provider, who is the controller; we will support them promptly. Where FlexiEle is the controller (website data), contact us using the details below.

To exercise your rights, or for any question about this policy, contact our Data Protection Officer:

You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO), though we would welcome the chance to resolve your concern first.

We may update this policy from time to time. Material changes will be notified through the platform or by email, and the “last updated” date above will change.