How HeraIQ works for carers

• You create your account yourself. It belongs to you and not to your employer, and it stays with you when you change company.
• You can hold an account with no employer at all. Your profile and your documents still work.
• There are two ways you come to work for a company. Your manager can add you to their staff list using your email address: the next time you sign in with that address, you are linked to them, without anything further from you.
• Or they send you an invitation. You accept it on your profile — or, if you would rather they added you, you share a one-time code with them from the same place.
• Your employer's record of you is a separate thing from your account. If they have your name wrong, only they can correct their copy, so ask them.

Your employer has their own HeraIQ account, and they decide what you can see inside it.

• Until they have set you up, the app gives you your own pages only: joining a company, your documents, your profile, help, your password and contacting us.
• Once you are set up, you can see the people you are assigned to visit. You cannot see the other people your employer supports.
• Your rota, your visits, your notes, your training record and your check-in records are your employer's records about your work. They are responsible for those and we hold them on their behalf, so questions, corrections and objections about them go to your employer. Our privacy notice explains that split.

Your profile holds your name and email address, and your phone number and date of birth if you choose to add them.

You can also fill in a work profile: the town or area you live in, how long you have worked in care, the kinds of care you know, the days you can usually work, what you enjoy outside work, whether you would move for the right job or could work anywhere in the UK, and a few lines about you in your own words. Nobody sees it unless you choose to show it, and then only a care company that already has your email address. Showing your work profile to care companies explains how.

Your document cabinet is for the documents a carer is asked for: passport or ID, right to work, a DBS certificate, training certificates and proof of address, and a driving licence and car insurance if you drive for work. You can also keep your CV there, though nothing requires one. Anything else you want to keep there goes under “Other”. You can upload a PDF, JPG or PNG of up to 10 MB. Hera checks each one as you add it (a DBS certificate once you work for a company or one has invited you): see How Hera checks your documents.

• The documents are yours, and they stay with you between employers.
• An employer sees a document only when you send it to them. Until you do, nobody there can open it. When you do, they also see Hera's check of it.
• Once an employer accepts a document, they take their own copy. Removing yours afterwards does not remove theirs, because they have to keep it as evidence.
• Removing a document from your own record deletes the file, and nothing brings it back. You would have to photograph the document again. We keep the record of Hera's check of it, but not the picture, for as long as our privacy notice says.
• A document your employer filed about you is theirs. You can take a copy into your own record, and theirs stays where it is.

An employer cannot make you active until they hold all five: passport or ID, right to work, a DBS certificate, a training certificate and proof of address. They cannot accept a document that Hera's check is holding back.

Hera, our assistant, checks every document you add to your cabinet, as you add it. That is true of every kind of document, and whether or not you have an employer yet, with one exception: a DBS certificate is not checked until you work for a company, or one has invited you (see below). Apart from that, you cannot add a document without the check.

To check it, we send the picture or the file to OpenAI, our AI provider, to read. OpenAI reads it on its standard service, not in a UK or EU region. It may keep it for a short time to watch for misuse: How we use AI says how long.

The check asks five things: is the picture clear, is it the right kind of document, are both sides there if it has two, is it in date, and is it in your name. It cannot tell whether a document is real, because a photo cannot show that. Your employer still checks the original with you.

• We keep the result: each of those answers, the reason if Hera asked for another picture, and how many times you tried.
• We also keep the facts Hera needed to decide: the kind of document, its dates, whether the name on it matches yours, the country codes in the machine-readable lines of a passport or ID card, and a DBS certificate's level and the kind of work it covers.
• For a DBS certificate, a training certificate, proof of address, a driving licence or car insurance, we also keep the name printed on it, so the app can show whether it matches yours, and the details the form fills in for you to check, such as a certificate, licence or policy number. A driving licence number contains your date of birth.
• From these checks, apart from the name printed on those five kinds of document, and the date of birth inside a driving licence number, we never keep a passport or ID number, your date of birth, your National Insurance number, a share code or your name as it is printed.
• Hera also notes things about the picture itself: that it looks like a photo of a screen or a photocopy, that part of it may have been changed, or that a corner is cut off. The app does not show you these notes. The managers of an employer you have sent the document to can see them for as long as the document stays in your cabinet. You can ask us for them at any time: see Your data, deleting your account, and complaining.

Until you work for a company, or one has invited you, HeraIQ pays for these checks. Either way, the check is part of your own cabinet, and we are responsible for it, apart from a DBS certificate: we check that for the company you work for, or the one that invited you, as its processor, under that company's lawful basis.

If the check finds a problem, the app tells you what it is and asks for a better picture or a different document. You cannot send that document to an employer until you send one the check can accept.

• If Hera still asks for another after three tries, you can send it anyway. Your manager then checks it by hand, and can see that you sent it after three tries.
• A document that has run out cannot be sent that way, and nor can one the rules do not take for the answer you gave, such as an ID card when a passport is needed. A British or Irish passport that has run out can still be sent.
• If you think Hera has got it wrong, tell your manager. They can look at the original and add it to your record themselves. If you have no employer yet, nothing is sent to an employer until you send it, and you can email us at hello@heraiq.io.
• If we could not check a document because something went wrong on our side, it does not hold you back. You can send it, and your manager checks it. The exception is the limit on checks for a day: a document that goes over it waits to be checked, and cannot be sent until it has been.

Apart from what Hera read from your passport or ID, which the managers of a company you are linked to can see, an employer sees Hera's check of a document only when you send it to them. Their copy of the document then carries Hera's check, and they cannot accept a document while Hera's check is holding it back.

When you set up your account, HeraIQ asks whether you have a British or Irish passport. Your answer tells us which documents to ask you for, so you are not asked for more than you need to give.

When you add the photo page of your passport, or another photo ID, Hera's check reads the machine-readable lines of letters on it, as part of checking it (see How Hera checks your documents). From that read we keep the nationality and the expiry date, whether the name matches yours, and when and whether the read worked. We never keep the passport number or your date of birth. The page itself stays in your documents, like any other document.

We use that read to notice when the passport does not match your answer, so that you can change your answer and your manager can ask you about it. Like any document, a passport or ID that Hera's check is holding back cannot be sent to an employer until you send one it can accept. The check looks at the photo only, and it does not check your right to work. That check is your employer's.

If you say you have a passport from another country, you may also be asked which visa or immigration status you hold, and whether it limits the hours you can work. “I'm not sure” is an answer too.

Your answers, and what Hera's check read from your passport or ID, are available to the managers of any company you are linked to. They use your visa answers when they plan your shifts. If your employer's right-to-work check records a weekly limit on your hours, HeraIQ will not let a visit be added to your rota if it would take you over that limit.

Once you are linked to a company, HeraIQ also asks whether you drive for work. Your answer is saved on your employer's record of you. If you say yes, you are asked for your driving licence and your car insurance. If your manager has answered it for you, their answer stands: ask them if it needs to change.

Your work profile is private until you choose. You are asked “Show my profile to care companies who have my email?”, and nothing is chosen for you: until you say yes, nobody at a care company can see it.

• If you say yes, a care company that already has your email address can see a short card of your profile when someone there types your email to invite you. Only a manager, or someone a manager has allowed to hire staff, can do that.
• The card shows your first name, the first letter of your surname, the answers you gave in your work profile and the summary you approved. It never shows your surname, email address, phone number, CV, any of your documents or the AI's draft.
• Nobody else can see your profile, and there is no public list. If you have not said yes, the company sees nothing, exactly as if you had no HeraIQ account.
• You can change your answer at any time on your profile, and it stops straight away.
• Every lookup is recorded against the company that made it: who asked, a scrambled form of the email address they typed rather than the address itself, whether a card was shown, and when. That company's managers can see their own company's records.
• A company can make at most 200 lookups a day, and each person in it at most 20 an hour.

Like every document, a CV is checked when you add it, and OpenAI, our AI provider, reads the whole file then. What follows is about the summary only. If you have added a CV, you can ask us to draft your summary from it, once a company has invited you or you work for one. Before anything is sent for the summary, we take out of the CV's text the name on your account, email addresses, phone numbers, postcodes, National Insurance and NHS numbers, and a date of birth where it is labelled as one. The rest goes to OpenAI, and to no other company. A CV that is a photo or a scan has no text we can read, so nothing is sent for the summary.

We check every draft, and do not offer one that adds figures or names your CV does not contain, gives contact details, or says anything about your health, your age, your family or other personal matters. A check can miss things, so read the draft before you approve it. You can change any of it, or write your summary yourself.

Only you see the draft. A care company only ever sees the summary you approve, and approving it deletes the draft. Our record of the request in LangSmith, which we use to find and fix problems, holds neither your CV nor the draft.

For your own account, profile and document cabinet, HeraIQ is the controller. That includes Hera's check of every document you add, which we pay for until you work for a company, or one has invited you, apart from a DBS certificate. The read of a DBS certificate is made for the company you work for, or the one that invited you, as its processor, and is the company's, not ours; the result is then kept in your document cabinet with your other documents. What we hold, why, how long we keep it and who receives it is set out in full in Carers in our privacy notice.

A DBS certificate can contain criminal record information, which the law treats with extra care. It is in your cabinet only because you put it there, and no employer sees it until you send it. Unlike other documents, it is not checked when you add it if you have no employer yet: it is saved, and not read, and nothing in it goes to OpenAI, until you have joined a company or one has invited you. It is then checked at that company's cost, and under that company's lawful basis, not ours, and the whole certificate goes to OpenAI to be read. Hera is told to read only the details at the top of it, and to leave out anything it says about a record. We keep only the certificate number, the date, the level, the kind of work it covers, the name printed on it and whether that matches yours.

The companies that handle information for us are named on our sub-processors page.

When you dictate a note, the recording is sent to us and on to OpenAI, our AI provider, to be turned into text. The text comes back into the note for you to read and change before you save it. If the app heard no speech, the recording is discarded and nothing is sent. When something is sent, we keep a record of the request in LangSmith, in the EU, so that we can find and fix problems.

Hera is the assistant in HeraIQ. The carer's version can only explain and summarise the records of the people you are assigned to visit: it cannot change, schedule, message or edit anything. What you type to it, and the records it reads to answer you, go to OpenAI. LangSmith, in the EU, keeps a record that each answer was made, with its timing and any error, so that we can find and fix problems. It no longer keeps what you typed, what Hera read or what it answered, apart from anything an error message quotes.

Hera's answers are drafts to check, not instructions. It can be wrong, and it is not a substitute for the care plan, your training, or asking your manager.

Hera is for care work. If you ask it for something it is not for, it declines and we keep up to 500 characters of that message so we can spot misuse. How we use AI, and what happens to those records, are in How we use AI and AI misuse flags and account blocking.

When you tap check in, and when you tap check out, the app records the time, and where your phone is at that moment if you have allowed it to use your location. It also records the time on your phone's own clock, and, if your phone reports it, how accurate that reading was.

Those two taps are the only times it asks. It does not record where you are while you travel between visits, while the app is closed or in the background, or when you are not working.

• You can refuse. Checking in still works and still counts as attended, and the record says that a location was not shared.
• If your phone cannot get a fix within five seconds, the check-in goes ahead without one.
• Managers at your employer can see what was recorded against the visit — the position, the accuracy where your phone gave one, and a note if your phone's clock was more than two minutes away from ours.

Your employer can also switch on a comparison between where you checked in and the address of the visit. It is off unless they turn it on, which is their decision to take after telling their staff. Where it is on, a manager sees one of three answers — at the visit, away from the visit, or cannot say — and a distance in metres where one could be worked out.

Being at the visit means within 150 metres by default, and your phone's own margin of error is added to that, so a weak signal makes the check more generous rather than stricter. Your employer can set a different distance, between 25 and 5,000 metres.

The comparison can only be made where we already hold a location for the person's home. For anyone your employer added from 16 September 2026 we do not hold one: we stopped sending service users' postcodes to an outside company to locate their homes, and the replacement is not built yet. For visits to those people the answer is always “cannot say” and there is never a distance, wherever you stood and whatever your phone did. It is about the address record, not about you.

“Cannot say” means the evidence is missing, not that something is wrong: no location was shared, the phone could not get a fix, or we hold no location for the address to compare with. Nothing about you is decided by the system. These are your employer's records, any decision taken from them is your employer's, and if you want to object to the comparison or ask what is held about you, speak to them.

We can block an individual HeraIQ account, or a whole organisation, where the service is being misused. One of our staff reads the case and decides; nothing is blocked automatically, and nobody can block an account without giving a reason first.

A blocked account is signed out and stops working.

Your employer can separately suspend you or take you off their staff list. That is their decision rather than ours, and it does not delete your own account, profile or document cabinet.

If you think a block was wrong, email hello@heraiq.io and we will look at it again.

Your employer can let a relative or friend of a person you visit, or the person themselves, see some information about that person on the web. This is called family access. It is off unless your employer switches it on, and your employer chooses who sees what.

If it is on, the people your employer chooses can see:

• Your first name and the first letter of your last name, for example “Alex J.”, on visits your manager has confirmed in the next two weeks. For a visit that is not confirmed, or if your account is not fully set up with your employer, they see “To be confirmed” instead.
• On visits that finished in the last two weeks, when you arrived and when you left, and whether the planned tasks were done, with how many. Your name is not shown there, but it is a record of your work on that visit.

They never see your surname beyond its first letter, your phone number, your email address, your home address, your visit notes, where you were when you checked in or out, or what a manager wrote about a visit.

Each time they look, HeraIQ records which screen and when. That record names them, not you.

These are your employer's records about your work, so questions and objections go to your employer: see What your employer decides. There is no setting for an individual carer to hide their name from family access. This point is still being confirmed: whether a carer can ask not to be named to family, and who decides. This point is still being confirmed: whether carers must be told before their names are shown, and how long before; carers' names can appear as soon as their employer uses family access. This point is still being confirmed: the lawful basis for showing a carer's first name and last initial, and their arrival, departure and task times, to a family member, and whether a notice is enough.

• To ask for a copy of what we hold about you, email hello@heraiq.io. It is free, and we reply within a month — if a request is complex or you have made several, we may need longer and will tell you inside that month. Your other rights are listed in Your rights.
• There is no button in the app or on the website to delete your account yet. Until there is, email hello@heraiq.io and we will delete it for you.
• Deleting your HeraIQ account does not delete your employer's records about you. They have to keep some of them as evidence, so ask your employer about those.
• If you are unhappy with how we have handled your information, tell us first at hello@heraiq.io. You can also complain to the Information Commissioner's Office — see Complaints.