Security & data protection
CareCore handles calls, WhatsApp messages, rotas and safeguarding records for domiciliary care providers. This page sets out exactly where that data lives, who can reach it, how long we keep it and what we do when something goes wrong. The care agency is the data controller. CareCore is the data processor, acting only on documented instructions.
Data residency
London, UK
Record types processed
23 (9 special category)
Sub-processors
5, all disclosed
Posture
Each of these is implemented in the product, not just in policy.
All care records, transcripts and messages are stored in AWS eu-west-2 (London, United Kingdom). Nothing is replicated outside the UK for storage.
Every row carries an agency identifier and is protected by database-level row-level security. One agency can never read another's data, even if application code is bypassed.
Four roles — registered manager, coordinator, carer, auditor. Carers see only their own record and the clients on visits they are rostered to.
Every operational and governance action writes an audit event that cannot be updated or deleted by any application role.
Per-agency retention windows are enforced by a scheduled nightly database job, not by anyone remembering to run one.
Accounts exist only via a single-use invite from a registered manager. Recordings are never publicly addressable — audio is streamed through a short-lived signed proxy.
Certifications
We publish status rather than badges. Anything marked in progress is not yet certified.
| Standard | Status | Notes |
|---|---|---|
| UK GDPR / Data Protection Act 2018 | In place | ROPA, retention schedule, DSAR process and audit trail all implemented in-product. |
| ICO registration | In progress | Controller registers separately; CareCore registers as processor. Fee payable annually. |
| Cyber Essentials | In progress | Technical controls (MFA, patching, access control) are met; certification body assessment to be booked. |
| NHS Data Security & Protection Toolkit (DSPT) | In progress | Evidence for the mandatory assertions is produced by this page; annual publication required by 30 June. |
| ISO/IEC 27001 | Roadmap | Underlying infrastructure (AWS, Twilio and our cloud platform) is certified; a CareCore-level ISMS certification is a 2027 objective. |
| CQC KLOE — Well-led / Safe | In place | Audit trail, incident log, escalation timings and staff-access evidence are exportable for inspection. |
Security controls
The control set an information-governance lead will want to walk through, with the evidence we can show for each.
Every table is scoped to agency_id and protected by row-level security in the database itself.
Evidence: RLS policies on all tables; enforced even if application code is bypassed
Four roles — registered manager, coordinator, carer, auditor — with page- and row-level permissions.
Evidence: src/lib/rbac.ts + has_role() security-definer checks in every policy
Carers see only their own record and clients on visits they are rostered to. Family contacts are hidden from carers.
Evidence: Carer-scoped RLS policies
TLS 1.2+ in transit; AES-256 at rest on managed Postgres and object storage.
Evidence: Platform-level cloud controls (AWS)
Recordings are never publicly addressable — the console requests a short-lived HMAC-signed token and audio is streamed through a server proxy.
Evidence: src/lib/recording.server.ts (30-minute token TTL)
Every Twilio voice and WhatsApp webhook is signature-verified before a single record is written.
Evidence: X-Twilio-Signature validation on all public endpoints
Registration requires a single-use invite token or a new agency creation; there is no open sign-up.
Evidence: handle_new_user() trigger rejects sign-ups without an invite
Every operational and governance action writes an immutable audit event (no update or delete permitted).
Evidence: audit_events table with UPDATE/DELETE denied to all roles
Per-agency retention windows are enforced by a scheduled nightly database job, not by anyone remembering.
Evidence: apply_retention() run daily at 03:15 UTC via pg_cron
One-click subject access export and pseudonymising erasure, both logged with a statutory 30-day due date.
Evidence: Data governance panel + data_subject_requests log
The AI's intent, confidence and the policy documents it relied on are stored against each call and thread.
Evidence: calls.workflow, conversations.ai_state, knowledge citation references
Anything the AI cannot safely handle is escalated to a named human, paged through the on-call chain, with time-to-human recorded.
Evidence: escalations.time_to_human_seconds, page_events
What we process
Our full Article 30 register. Special category data (health and care information) is marked.
| Record | Purpose | Data categories | Lawful basis | Data subjects |
|---|---|---|---|---|
| Agency tenancy | Identify the tenant, route inbound calls and messages to the right agency. | Business name, slug, main phone number, scheduling preferences | Contract (Art. 6(1)(b)) | Agency (organisation) |
| Staff accounts | Authenticate console users and attribute every action to a named person. | Name, work email, phone, avatar, agency membership | Contract (Art. 6(1)(b)) | Managers, coordinators, carers, auditors |
| Access rights | Enforce role-based access control and least privilege. | User id, role (admin / coordinator / carer / auditor) | Legal obligation — security of processing (Art. 32) | Staff |
| Onboarding invitations | Invite named colleagues into the agency workspace with a scoped role. | Email address, role, single-use token, expiry | Contract (Art. 6(1)(b)) | Prospective staff |
| Service user recordsSpecial category | Identify the person receiving care so calls, messages and visits resolve to the right record. | Name, date of birth, address, phone, conditions, risk profile, next of kin, care notes | Art. 6(1)(b)/(f) + Art. 9(2)(h) — health and social care provision | Service users |
| Family & representative contacts | Recognise who is messaging on WhatsApp and whether they may request changes. | Name, relationship, phone, verification and permission flags | Legitimate interests (Art. 6(1)(f)) — keeping families informed | Family members, advocates, next of kin |
| Care worker records | Roster, match by skill and reach the right carer for cover. | Name, phone, email, skills, reliability score, status | Contract (Art. 6(1)(b)) | Care workers |
| Availability patterns | Work out who can legitimately be offered a shift or cover. | Weekday or dated availability windows, notes | Contract (Art. 6(1)(b)) | Care workers |
| Absence reportsSpecial category | Record a reported absence and drive the cover broadcast. | Reason, dates, free-text note, affected visits | Art. 6(1)(b) + Art. 9(2)(b) where sickness is disclosed | Care workers |
| Rota / visitsSpecial category | The schedule of care; the source of truth the AI answers rota questions from. | Client, carer, date, times, status, visit notes | Art. 6(1)(b) + Art. 9(2)(h) | Service users, care workers |
| Call recordsSpecial category | Log every inbound/outbound call, its AI triage outcome and the workflow it triggered. | Numbers, direction, duration, intent, sentiment, urgency, AI summary, recording reference | Art. 6(1)(b)/(f) + Art. 9(2)(h) | Service users, families, care workers |
| Call transcriptsSpecial category | Evidence of what was said, for safeguarding review and AI quality assurance. | Verbatim speech, speaker label, timings, confidence | Art. 6(1)(f) + Art. 9(2)(h) | Anyone on the call |
| Call recordingsSpecial category | Audio evidence for disputes and safeguarding. Media itself is held by Twilio; CareCore stores only the reference. | Recording reference (audio hosted by Twilio) | Art. 6(1)(f) + Art. 9(2)(h) | Anyone on the call |
| WhatsApp threadsSpecial category | Family and service-user messaging, AI triage and the actions taken from it. | Phone number, message body, intent, sentiment, AI state, assignment | Art. 6(1)(b)/(f) + Art. 9(2)(h) | Families, service users |
| IncidentsSpecial category | Safeguarding, falls, medication and welfare concerns raised by AI or staff. | Category, severity, description, client, carer, resolution | Legal obligation — CQC / safeguarding + Art. 9(2)(h) | Service users, care workers |
| Operational tasks | The follow-up work created from a call, message or incident, with an owner and a due time. | Title, description, priority, owner, linked records, resolution | Contract / legitimate interests | Staff, service users (by reference) |
| EscalationsSpecial category | Hand-off to a human, with the chain of who was paged and when. | Reason, urgency, owner, acknowledgement and resolution timestamps | Legal obligation + Art. 9(2)(h) | Service users, staff |
| On-call roster & paging log | Know who is on call, and prove they were contacted. | Name, role, phone, channel, message sent, delivery status | Contract / legal obligation | Managers, coordinators |
| Cover broadcasts | Record which carers were offered a shift and who claimed it. | Visit, carer, phone, offer status, timestamps | Contract (Art. 6(1)(b)) | Care workers |
| Policy knowledge base | Ground AI answers in the agency's own policies rather than open-web guesswork. | Policy text and vector embeddings (no personal data expected) | Legitimate interests (Art. 6(1)(f)) | None (organisational content) |
| Audit trail | Who did what, to which record, and when — the accountability evidence (Art. 5(2)). | Actor, action, resource, metadata, timestamp | Legal obligation — Art. 5(2) / Art. 32 | Staff |
| Rights requests log | Evidence that access and erasure requests were answered within the statutory month. | Subject, request type, status, outcome summary, due date | Legal obligation (Art. 12) | Service users, care workers |
| Retention configuration | Per-agency retention windows, applied automatically every night. | Day counts per data class | Legal obligation — storage limitation (Art. 5(1)(e)) | None |
Retention
Windows are configurable per agency within statutory limits and enforced automatically overnight.
Agency tenancy
Life of contract
Staff accounts
Life of contract, then 30 days
Access rights
Life of contract
Onboarding invitations
Expires after 7 days; record kept 12 months
Service user records
Care records: 7 years after end of service (or 25th birthday for under-18s)
Family & representative contacts
Life of the care package + 12 months
Care worker records
6 years after leaving (employment limitation period)
Availability patterns
Rolling 12 months
Absence reports
3 years
Rota / visits
7 years with the care record
Call records
Configurable per agency (default set in the retention schedule)
Call transcripts
Configurable per agency (default set in the retention schedule)
Call recordings
Configurable per agency (default set in the retention schedule)
WhatsApp threads
2 years
Incidents
7 years (safeguarding: longer where an investigation is live)
Operational tasks
3 years
Escalations
7 years
On-call roster & paging log
3 years
Cover broadcasts
2 years
Policy knowledge base
Until superseded
Audit trail
Configurable per agency (default set in the retention schedule)
Rights requests log
3 years after completion
Retention configuration
Life of contract
Sub-processors
Controllers are notified before any addition. All are engaged under Article 28 terms.
| Provider | Purpose | Data shared | Location | Transfer basis |
|---|---|---|---|---|
| Lovable Cloud (managed Postgres on AWS) | Primary database, authentication and file storage. | All application data listed in the ROPA | AWS eu-west-2, London, UK | No transfer — data stays in the UK |
| Twilio | Inbound/outbound voice, call recording media, WhatsApp and SMS delivery. | Phone numbers, call audio, message bodies | Ireland/EU with US parent | EU SCCs + UK Addendum; Twilio is UK GDPR-committed |
| Deepgram | Speech-to-text transcription of call audio. | Call audio, resulting transcript text | United States | SCCs + UK Addendum; zero data retention available on request |
| Lovable AI Gateway (Google Gemini, OpenAI TTS) | Intent triage, reply drafting and neural voice synthesis. | Transcript snippets, message text, retrieved policy extracts | EU/US depending on model | SCCs + UK Addendum. Inference only — content is not used to train models. |
| Vercel | Application hosting and edge delivery. | Request metadata only; no care records at rest | EU region (lhr/fra) | SCCs + UK Addendum |
AI governance
CareCore uses AI to triage calls and messages. That capability is bounded and auditable.
Model providers are used for inference only. Care content is not used to train or fine-tune any model.
Answers are retrieved from the agency's own knowledge base and live rota. The AI does not invent clinical guidance.
Detected intent, confidence, sentiment and the policy extracts relied upon are stored against every call and thread.
Anything clinical, safeguarding-related or out of scope is escalated to a named human and paged through the on-call chain, with time-to-human recorded.
The AI never changes a care plan, medication instruction or risk assessment. It records, routes and confirms.
Only the transcript snippet, message text and the retrieved policy extract are sent for inference — never a full client record.
Individual rights
Requests are handled by the agency as controller; CareCore provides the tooling and answers within the statutory month.
Request received — logged in the rights request register with a statutory due date one calendar month out.
Identity verified against the client or carer record before any data leaves the system.
Export produced from the governance panel: the subject record plus every call, transcript, visit and incident held.
Third-party data reviewed and redacted where another individual would be identified.
Delivered securely; the register records who exported it and when.
Erasure requests are fulfilled as irreversible pseudonymisation — identifiers and verbatim speech are removed while the clinical and audit record survives, as care records must be retained by law.
Incident response
Our breach procedure is timed to fit inside the controller's 72-hour ICO obligation.
Detect — automated alerting on failed auth spikes, webhook signature failures and admin-role changes.
Contain within 1 hour — revoke sessions and keys, isolate the affected agency tenant.
Assess within 12 hours — scope the records and data subjects involved using the audit trail.
Notify the controller (the agency) without undue delay and in any event within 24 hours of confirmation.
The controller notifies the ICO within 72 hours where the breach is likely to result in a risk to individuals.
Notify affected individuals directly where the risk is high.
Post-incident review within 10 working days; corrective actions tracked to closure.
Due diligence
We will supply a Data Processing Agreement, DPIA support pack, retention schedule and penetration-test summary under NDA.
Data protection contact: privacy@carecore.app. Security disclosures: security@carecore.app — we acknowledge within one working day.