1. Who we are
Castodia Ltd is a UK company developing care-management software for adult social care. Registered office: 88 Oakland Road, Newton Abbot, Devon, TQ12 4EE. Company number: 17267660. Privacy contact: privacy@castodia.co.uk.
2. Our role when personal information is processed
Our role depends on why information is processed. For enquiries, website communications, supplier relationships, account administration and security, Castodia may act as a data controller.
When a care provider uses Castodia to manage information about people receiving care, employees, relatives or other individuals, that provider will normally be the data controller and Castodia its data processor. We process that information under the provider’s documented instructions and contractual arrangements.
3. Information we may process
The information processed depends on how Castodia is used and may include:
- Account and identity information, including names, email addresses, organisation, roles, permissions and authentication information.
- Care and support information entered by authorised providers, including care plans, daily records, health and wellbeing information, medication records, risk assessments, incidents, safeguarding records, appointments, photographs and documents.
- Staff information, including roles, training, competency and auditable activity within the platform.
- Technical and security information, including IP address, device and browser information, application version, sign-in events, audit logs, diagnostics and timestamps.
- Enquiries and business communications, including contact details, correspondence and support history.
4. Why we use personal information
Where Castodia acts as processor, the care provider determines the purposes for which care-related information is processed.
- Provide, secure and operate Castodia services.
- Authenticate users and provide appropriately permissioned access.
- Maintain security, audit and service-reliability records.
- Provide support and investigate incidents, faults or misuse.
- Administer customer relationships and respond to enquiries.
- Meet legal obligations and protect Castodia, its customers and users.
5. Lawful bases
Where Castodia acts as controller, we may rely on contract, legitimate interests, legal obligation or consent, depending on the activity. Where special-category information is involved, an additional condition under applicable data-protection law must also apply.
Where Castodia acts solely as a processor, responsibility for identifying the lawful basis normally remains with the relevant care provider.
6. Castodia Family
Where enabled by a care provider, authorised family or representative accounts may receive access to selected information about a person receiving support. Family users do not automatically receive the complete care record.
Access is specifically authorised and linked to the appropriate person and organisation. Available information may include selected memories, photographs, updates or other material the provider has chosen to share.
7. Sharing information
We do not sell personal information. We may share information where necessary with:
- The organisation responsible for the relevant Castodia account and its authorised users.
- Infrastructure and technology providers used to operate Castodia.
- Professional advisers and insurers.
- Regulators, courts or law-enforcement bodies where legally required.
- Other parties where required to establish, exercise or defend legal rights.
8. Service providers and subprocessors
Castodia uses specialist providers for cloud hosting, databases, authentication, storage, monitoring, communications, security and development infrastructure. Our current architecture includes Supabase and Vercel.
Where suppliers process customer personal information, appropriate contractual and security arrangements are required. A current subprocessor list may be published separately or provided to customers.
9. International transfers
Some suppliers may operate infrastructure or personnel outside the United Kingdom. Where personal information is transferred internationally, Castodia will use an appropriate lawful transfer mechanism and safeguards where required. Customer-specific arrangements will also be addressed in Castodia’s Data Processing Agreement.
10. Retention and deletion
We retain information only for as long as necessary for its purpose, subject to contractual, legal, regulatory, security and audit requirements. Different categories may have different retention periods.
Where Castodia acts as processor, retention and deletion are normally governed by the provider’s instructions and contract. Care and audit records may not be erased immediately merely because a user account closes.
11. Security
We use technical and organisational measures intended to protect confidentiality, integrity and availability. No online service can guarantee absolute security.
- Authenticated access and role-based permissions.
- Audit attribution and access controls.
- Secure communications, monitoring and backups.
- Vulnerability management, incident response and secure development practices.
12. Your rights
Depending on the circumstances, you may have rights of access, correction, erasure, restriction, objection and portability, as well as rights to withdraw consent and rights relating to automated decision-making. These rights are subject to legal conditions and exemptions.
If a care provider entered the information, contacting that provider is normally the fastest route because it is likely to be the controller. Castodia assists customers with valid requests where required.
13. Account deletion
Users may request appropriate account deletion through their organisation or Castodia’s data-request route. Deleting an account does not necessarily delete care records or audit information created by that user; records may need to remain attributable to preserve integrity, accountability and legal or regulatory requirements.
14. Children
Castodia is not a general consumer service directed at children. Where an authorised provider lawfully enters information about a child or young person, that provider is responsible for the lawful basis and safeguards.
15. Cookies and similar technologies
Our website may use essential technologies needed for security and operation. If we introduce non-essential analytics, advertising or tracking that requires consent, we will provide appropriate information and controls before use.
16. Changes and contact
We may update this policy as Castodia develops or legal, regulatory or technical requirements change. The latest version will appear here with its revision date.
For privacy enquiries, contact Castodia Ltd at 88 Oakland Road, Newton Abbot, Devon, TQ12 4EE or privacy@castodia.co.uk. You may also complain to the UK Information Commissioner’s Office if you are unhappy with how your information has been handled.