Start with the organisation responsible for your information
If your information was entered into Castodia by a care provider, employer or other organisation, contact that organisation first. It will normally be the data controller and can identify the relevant records and decide how your request should be handled. Castodia will assist it where required.
Requests you can make
- Access personal information.
- Correct inaccurate or incomplete information.
- Request erasure where the right applies.
- Restrict or object to certain processing.
- Request portability where applicable.
- Withdraw consent where processing relies on consent.
- Request deletion of an eligible Castodia user account.
Send a request to Castodia
If Castodia is responsible for the information, or you cannot identify the relevant provider, contact privacy@castodia.co.uk. State your name, the organisation involved, your relationship to Castodia and the right you wish to exercise. Please do not send care records, identification documents or passwords in your first message; we will explain any secure verification needed.
Identity checks and response times
We or the relevant provider may need proportionate information to confirm your identity and locate records. Requests are handled within the period required by applicable data-protection law. We will explain if a lawful extension, exemption or restriction applies.
Account deletion is not always record deletion
Deleting a login does not necessarily delete care records, medication entries, incident records or audit history created through that account. Those records may need to remain attributable for care-record integrity, safeguarding, accountability and legal or regulatory requirements.
Complaints
If you remain unhappy, you can complain to the organisation responsible for your data or to the UK Information Commissioner’s Office. Raising a concern with Castodia first may allow us to resolve it quickly.