How we look after your records

• All traffic is encrypted in transit with HTTPS (TLS).
• Data is stored with our cloud providers, which encrypt it at rest.
• Passwords are stored as one-way hashes, never in plain text.
• Two-step sign-in (authenticator app) is available for every user, with backup codes.
• Role-based access: carers, managers, directors, families and inspectors only see what their role allows, and each organisation’s data is kept separate.
• Key records keep a change history showing who changed what and when.
• Secrets and API keys are held on the server, never in the browser.

CareFocusIQ runs on managed cloud infrastructure (see the provider list below). The database is backed up automatically by the hosting platform, and uploaded files are kept in durable cloud storage.

We do not publish an uptime percentage on this page. Service levels, support hours and response times are agreed in your contract. If you need the current data location or backup retention details for a DPIA, ask us and we will confirm them in writing.

Safety-critical alerts such as nurse call always run on your local nurse call system, never only through CareFocusIQ, so a broadband or software outage never stops a call being answered.

• UK GDPR and Data Protection Act 2018: we process data as your processor under a written agreement.
• Cyber Essentials: working towards certification. Not yet certified.
• ISO 27001: building towards it. Not yet certified.
• NHS Data Security and Protection Toolkit: aligning our controls so we can support your own DSPT submission.
• Clinical safety (DCB0129): applied to clinical features that need it.

We will update this page with certificate numbers once they are issued. Until then, please treat anything marked “working towards” as not certified.

Every customer gets a data processing agreement that meets Article 28 of UK GDPR. In summary:

• We act only on your documented instructions (you are the controller, we are the processor).
• Everyone with access to your data is bound by confidentiality.
• Appropriate technical and organisational security measures.
• We only use the sub-processors listed below, tell you before adding new ones, and pass the same duties on to them.
• We help you respond to subject access and other data rights requests.
• We tell you without undue delay if we become aware of a personal data breach, so you can meet the 72-hour ICO deadline.
• We help with data protection impact assessments (DPIAs).
• At the end of the contract we return your data in a usable format and then delete it.
• We give you the information you need to show compliance, and allow reasonable audits.

Current as of October 2026. We tell customers before adding or changing a sub-processor.

We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA, so that carers, residents’ families and inspectors can use CareFocusIQ on any device, with a keyboard, screen reader or zoom.

What we know is not yet fully accessible: some charts and dashboards rely on colour and do not yet have a full text alternative, some older pages have small text, and some downloaded documents (CSV and PDF exports) are not fully tagged for screen readers.

If something does not work for you, tell us through the contact form and say which page and what you were trying to do. We will reply within 5 working days and, where we can, give you the information another way in the meantime.

If you think you have found a security weakness, please tell us through the contact form with “Security” in the message, and do not access other people’s data or disrupt the service while testing. We will acknowledge your report and keep you updated while we fix it.

CareFocusIQ also helps you meet your own obligations: change history on key records, subject access exports, Speak Up concerns, incident and breach logs, and business continuity plans for an IT outage or cyber attack.