CARELITICA PRIVACY POLICY
Last updated: June 2026
1. WHO WE ARE
Carelitica is a UK care sector documentation platform operated as an independent business in England. We provide digital tools to help care workers write professional care notes, check compliance with CQC standards, and generate documentation for use in their professional practice.
- Data controller: Carelitica
- Contact email: legal@carelitica.co.uk
- ICO Registration: Pending registration — to be updated upon completion
We are in the process of registering with the Information Commissioner's Office as a data controller. Until registration is confirmed we are operating in accordance with our obligations under the UK General Data Protection Regulation and the Data Protection Act 2018.
2. WHAT THIS POLICY COVERS
This privacy policy explains what personal data we collect, how we use it, how long we keep it, and what your rights are. It applies to all users of the Carelitica platform including individual support workers, company administrators, and visitors to the website.
3. WHAT DATA WE COLLECT AND WHY
We collect the following categories of personal data.
Account registration data
When you create an account we collect your full name, email address, job role, and organisation name. We use this to create and manage your account and to personalise your experience on the platform. The legal basis for this processing is the performance of a contract with you.
Payment data
When you subscribe to a paid plan your payment is processed by Stripe. We do not store your card details. Stripe processes and stores all payment information on our behalf as a certified PCI DSS compliant payment processor. We retain a record of your subscription status, plan type, and transaction reference for billing and account management purposes. The legal basis for this processing is the performance of a contract and our legitimate interests in managing our business.
Profile data
If you choose to add additional information to your settings page such as your preferred name, manager contact number, and note style preference we store this to personalise your use of the platform. The legal basis is your consent and the performance of a contract.
Login and usage data
We record the date and time of your logins and your account type to enable the platform to function correctly and to provide company administrators with basic team management information. The legal basis is our legitimate interests in operating a secure and functional platform.
Company access code data
If you register under a company plan we store your association with that company to manage seat allocations and access permissions. The legal basis is the performance of a contract.
Technical data
We may collect your IP address, browser type, device type, and operating system for security and platform stability purposes. The legal basis is our legitimate interests in maintaining a secure platform.
4. WHAT DATA WE DO NOT COLLECT
This is important. Carelitica is built on a strict no storage principle for care note content.
We do not store, retain, or process the content of any care notes, body maps, incident reports, or any other documentation written using the Carelitica platform. All note content exists only in your browser session and is permanently deleted when you close or refresh the page. We have no access to what you write and we hold no copies of your documentation.
We do not collect or store any personal data about the individuals receiving care. Any references to service users within notes are the sole responsibility of the care worker and exist only on their device during their session.
We do not sell your personal data to any third party under any circumstances.
5. HOW WE SHARE YOUR DATA
We share your data only with the following trusted third party processors who are contractually obligated to handle it securely and in accordance with UK GDPR.
Supabase
Our database and authentication provider. Stores your account information, subscription status, and profile data. Supabase operates data centres in the European Union and complies with GDPR requirements. For more information visit supabase.com/privacy.
Stripe
Our payment processor. Handles all subscription payments and billing. Stripe is PCI DSS Level 1 certified. For more information visit stripe.com/privacy.
Anthropic
Our AI provider. When you use the note rewriting or compliance checking features your note text is sent to Anthropic's API for processing. Anthropic does not retain this data for training purposes under our API agreement. For more information visit anthropic.com/privacy. Note: do not include sensitive personal identifiers about service users in your notes when using AI features.
We do not share your data with any other third parties. We do not use your data for advertising purposes.
6. HOW LONG WE KEEP YOUR DATA
Account and profile data. Retained for as long as your account is active. If you delete your account we will delete your personal data within 30 days.
Payment and subscription records. Retained for seven years in accordance with UK financial record keeping obligations.
Login events. Retained for 12 months and then automatically deleted.
Note content. Never retained. Deleted immediately at end of session as described in Section 4.
7. YOUR RIGHTS UNDER UK GDPR
You have the following rights regarding your personal data.
Right of access. You can request a copy of all personal data we hold about you at any time by contacting legal@carelitica.co.uk. We will respond within 30 days.
Right to rectification. If any data we hold about you is inaccurate you can ask us to correct it.
Right to erasure. You can ask us to delete your personal data. We will comply unless we are required to retain it by law.
Right to restriction. You can ask us to restrict how we process your data while a complaint is being investigated.
Right to data portability. You can request your account data in a machine readable format.
Right to object. You can object to processing based on legitimate interests. We will review and respond within 30 days.
Right to withdraw consent. Where processing is based on consent you can withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights contact us at legal@carelitica.co.uk.
8. COOKIES
Carelitica uses essential cookies only. These are required for the platform to function and cannot be turned off. They include session authentication cookies managed by Supabase and payment session cookies managed by Stripe. We do not use advertising cookies, tracking cookies, or analytics cookies.
9. DATA SECURITY
We take the security of your personal data seriously. We implement the following measures.
- All data in transit is encrypted using TLS.
- All data at rest in Supabase is encrypted.
- Access to user data is restricted by role based permissions.
- Payment data is handled exclusively by Stripe and never touches our servers directly.
- We conduct regular reviews of our security practices.
In the event of a data breach that poses a risk to your rights and freedoms we will notify the ICO within 72 hours and affected users without undue delay.
10. CHILDREN
Carelitica is a professional platform intended for use by adults working in the care sector. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data please contact us at legal@carelitica.co.uk and we will delete it immediately.
11. CHANGES TO THIS POLICY
We may update this privacy policy from time to time. When we make significant changes we will notify you by email or by a prominent notice on the platform. The date at the top of this policy reflects the most recent update. Continued use of the platform after changes are posted constitutes your acceptance of the updated policy.
12. COMPLAINTS
If you are unhappy with how we handle your personal data you have the right to lodge a complaint with the Information Commissioner's Office. You can do this at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
We would appreciate the opportunity to address your concerns directly before you contact the ICO. Please email us first at legal@carelitica.co.uk.
13. CONTACT US
For any questions about this privacy policy or how we handle your personal data please contact us at legal@carelitica.co.uk. We aim to respond to all queries within five working days.
End of privacy policy content.