Family access notice

The care provider decides. A manager there chooses who is invited, which screens each person may see, and for how long. HeraIQ does not choose who is invited.

Family access is off unless the provider turns it on in its settings. The provider can turn it off again at any time.

Only a manager at the care provider can invite you. You cannot ask HeraIQ for access, and you cannot sign up on your own.

When they invite you, the manager chooses:

• who you are to the person: the person themselves, a spouse or partner, a son or daughter, a parent, a brother or sister, another relative, a friend, an advocate, or someone else;
• which of the four screens below you may see. There must be at least one;
• a date when your access will be looked at again. It is after today and no more than 12 months ahead;
• the reason the provider is allowed to share with you. It is one of: the person's own agreement; a power of attorney for health and welfare that the provider has checked; a court-appointed deputy that the provider has checked; or a best-interests decision.

For a power of attorney or a deputyship, the provider records its reference, who checked it and the day. For a best-interests decision, it records who decided, why, and who was consulted. We store what the provider records. We do not check these documents ourselves.

You get an email from HeraIQ with a link. It names the provider. It does not name the person, and it does not contain your code. The manager gives you a six-character code themselves, in person or by phone. To accept:

• make a HeraIQ account using the exact email address the invitation was sent to, and confirm that address;
• sign in and finish the second step (see below);
• open the link in the email, type the code and tick the box that says you have read this notice and the privacy notice.

You cannot accept without the tick. If the tick is missing, nothing is recorded and no try at the code is used.

The invitation lasts 7 days. If you type the wrong code five times, it is cancelled and the provider must invite you again.

Someone who works for the care provider cannot hold family access to its records. At the moment family access is on the web only. The HeraIQ Care app does not show it.

Every time you use family access you must finish a second step as well as your password. This applies to every family account, whether or not it is required for other HeraIQ accounts.

The second step is a one-time code that we email to you, or an authenticator app that you have set up after using the emailed code. Without it, you cannot see anything.

Each screen is a separate choice. The provider can choose only from the four below. If a screen has not been shared with you, you cannot open it. What you see is picked out of the provider's records by fixed rules. No AI model writes it or chooses it. Times are UK times.

Care information

This tells you whether the person has a current care plan that the provider has approved. You see its version number, the day it was approved and the day it is due for review. If that day has passed, it says so. A draft is never shown.

It does not show anything the care plan says, and it does not show the risk assessment. The provider cannot choose to share parts of the plan with you yet. The screen says that the provider has not released any part of the care plan to family. This point is still being confirmed: whether a care provider will be able to release parts of the care plan to family, version by version.

Visit schedule

This lists the person's confirmed visits in the next 14 days. A visit is confirmed once a manager has published it, so a visit that is not listed has not necessarily been cancelled. If there are many, only the first are shown. For each visit you see:

• the day, the start time and the end time;
• the kind of visit, such as morning, lunchtime, teatime, evening, night, a wellbeing check or personal care;
• the carer's first name and the first letter of their last name, for example “Alex J.”, or “To be confirmed”;
• how many carers are planned, when it is more than one.

A carer's name is shown only for a confirmed visit whose carer is a current, fully set-up member of the provider's staff. Otherwise you see “To be confirmed”. Names are not shown at all until HeraIQ's notice to carers says that they may be. Times and carers can change. If you are unsure, ask the provider.

Visit updates

This lists the person's visits that finished in the last 14 days, newest first. Cancelled visits are not listed. For each visit you see:

• the planned day and time;
• when the carer arrived, or “Not recorded”;
• when the carer left, or “Not recorded”;
• whether the planned tasks were done: “Yes”, “No” or “Not recorded”, with how many tasks were done out of how many.

“Not recorded” means nobody wrote it down. It does not mean the carer did not come. A missed check-in and a missed visit can look the same here, so ask the provider if you are worried. The carer's name is not shown on this screen.

Who has access

This lists everyone who has access to this person's information through this portal now. For each, you see the name the provider gave them, how they are related to the person, and which screens they may see. It marks which one is you. It does not show anyone whose access is paused or has ended, and it does not show email addresses. If the provider invites the person themselves, they always keep this screen.

It does not list the provider's own staff. The provider's care team can also see the person's record.

What you will not see

• what a care plan or a risk assessment says;
• carers' notes and handover notes, or records of mood, food and drink, continence, skin, medication and personal care;
• a manager's notes about a visit;
• where a carer was when they checked in or out;
• carers' phone numbers, email addresses or home addresses;
• how to get into the person's home, such as a key safe code;
• concerns, incidents and safeguarding records;
• documents, files and messages;
• anything about anyone else the provider supports.

Your browser is told not to keep what these screens show. Please sign out when you have finished, especially on a shared device.

Each time you open one of the four screens, HeraIQ records it before it shows you anything. The record says which person, which screen, which account and when. If the record cannot be saved, you are not shown the screen. Opening the list of people shared with you is not recorded.

HeraIQ also keeps a dated record of each change to your access: when you were invited and accepted, when a permission was given or taken away, and when your access was paused, resumed or ended, and why. When a manager pauses, resumes or ends your access, or decides to keep it after a concern, they write the reason in their own words. It is kept in this record. The system is built so that these records cannot be changed or deleted in the ordinary way. Taking one out needs a deliberate step by whoever runs the database.

No screen shows these records to you, to the person or to the provider yet. This point is still being confirmed: whether the person, the family member and the provider's managers should be able to see who has looked at the record, and how a family member is told.

The provider also records the reason it can share with you. That is kept with your access record. It is never shown on any family screen.

More about what we hold about you, and why, is in the family section of our privacy notice.

• Other relatives and friends who have the Who has access screen see your name as the provider gave it, how you are related to the person, and which screens you may see.
• The provider's managers see your name, how you are related to the person, which screens you may see, your review date, whether your access is active, paused or ended, and the reason it records for sharing with you. They also have the email address they invited you at.

Your access stops working, or is paused, in these cases:

• The review date passes. Nothing renews it automatically.
• The provider pauses your access. You can see nothing while it is paused. The provider can lift a pause that it made itself, if everything that gave you access still holds.
• The provider ends your access. This is final. To give you access again, the provider has to invite you again, with a new code.
• The person stops being supported. If the provider archives the person, for example because their care has ended, access in use is paused and invitations still waiting are cancelled. If the person is supported again later, your access does not come back on its own.
• The provider turns family access off. Nothing can be seen while it is off. If the provider turns it back on, access that was already set up works again unless it has ended or passed its review date. This point is still being confirmed: whether turning family access off should also pause each person's access, so that turning it back on needs a fresh decision.
• The invitation is cancelled by the provider, runs out after 7 days, or is cancelled after five wrong codes. You never get access.
• Your account is deleted.
• You start working for the care provider.
• HeraIQ blocks the provider's account.

When a manager pauses, resumes or ends your access, the manager must say why. The reason is kept in the record described above. Nothing is sent to you when this happens.

The provider cannot yet extend a review date or record that the reason for sharing has been withdrawn. If a review date has passed, the provider ends that access and invites you again.

If a concern is recorded about the person, and it may involve a relative or friend, or nobody has recorded who it involves, the provider's managers are alerted and asked to look again at who has access. Nothing is paused automatically. A manager can then pause or end the access, or record that they looked and are keeping it, and must say why. You are not told when this happens. This point is still being confirmed: whether this notice should say that a concern which may involve a relative or friend leads to a review, and in what words, given safeguarding and the risk of tipping someone off; and whether access should instead be paused automatically.

HeraIQ does not record why care ended, and has no rule of its own for family access after a person dies. This point is still being confirmed: what should happen to family access when the person dies: whether it ends at once, whether a relative keeps any access, for what purpose and for how long.

If you no longer want access, or the person does not want you to have it, tell the care provider. Today the provider can pause or end your access, cancel an invitation that has not been accepted, and turn family access off for everyone.

You can also email us at hello@heraiq.io. This point is still being confirmed: what HeraIQ will do when a family member or the person asks for access to stop, who decides, and how quickly.

The care provider decides what is shared about the person it supports. HeraIQ runs the system for it. This point is still being confirmed: who is the controller of what a family member is shown, and of the family member's own account, sign-in and access-log details: the care provider, HERA INTELLIGENCE LTD, or each for different data.

To ask for a copy of what we hold about you, or to use another right, email hello@heraiq.io. Your rights are listed in Your rights in our privacy notice.

If you are unhappy with how we have handled your information, tell us first at the same address. You can also complain to the Information Commissioner's Office: see Complaints. For a question about what the provider shows you, ask the provider. This point is still being confirmed: the route for a family member to challenge a care provider's decision about their access, and whether this notice should repeat the Information Commissioner's Office complaint route.

An invitation lasts 7 days. Your review date is no more than 12 months from the day the provider sets it. The periods for sign-in codes and email receipts are in our privacy notice.

This point is still being confirmed: how long HeraIQ keeps invitations, access records, the access log and the history of changes, and whether HeraIQ deletes a family account on request.