Security and data
Carefill holds staff rotas and the practical details a carer needs to make a visit. Here is where that data lives, who can see it, and what it deliberately does not hold.
Hosted in the UK
The database and the app's servers are both in London, in the UK.
No client health records
A shift holds a place, a person's initials and practical needs such as two carers and a hoist. Diagnoses, conditions and care plans are never asked for, so they cannot leak.
Addresses show late, and briefly
A carer sees a service user's address only from 12 hours before the run starts until it ends, not a week of them at once.
Sign-in through the charity's own Microsoft tenant
Staff sign in with their work account, and the charity decides who is in the staff group. Carers without an account get a six-digit code by email.
Every change is logged
Each change to a rota, assignment, leave request or staff record is written to an audit log with who made it and what it was before, kept for at least two years.
Segregated data
Each charity's rota is stored separately from every other charity's, so nothing you enter can be seen outside your own organisation.
Exactly what it holds
About staff
- Name, work email and role
- Qualifications and when they run out
- Shifts, runs, clock-ins and hours worked
- Leave requests and availability
About the people you support
- Initials, and the service they live at
- Practical needs, such as two carers and a hoist
- The address, visible to the carer from 12 hours before the run
- Nothing clinical. Not one field.
UK GDPR
The charity is the controller and Carefill the processor. Four things do most of the work, and the agreement covers the rest.
- No client health records are held at all, so the most sensitive kind of data never enters the system.
- A retention period is set for each kind of data, and a nightly job removes what is past it.
- Everything held about one person can be exported for a subject access request, with nothing about anyone else in it.
- Every change to a rota, assignment, leave request or staff record is logged, with who made it and what it was before.
The paperwork
- A data processing agreement, with the charity as controller and Carefill as processor.
- The current list of sub-processors and where each one processes, kept up to date and notified before a new one is added.
- Support with the charity's own data protection impact assessment: what Carefill holds, where, and who can reach it.
- A breach process: the charity's data protection lead hears from us as soon as we know, and the agreement sets out the timescale.
Certifications
Carefill holds none yet, and this page will not pretend otherwise. The build follows the Cyber Essentials controls, and certification is the next piece of work before a second organisation joins. When it is held, it is listed here with the certificate number, and not before.
Ask us the awkward question
If a question isn't answered here, it's worth asking before you trust anyone with a rota.