Privacy notice

For the information described in the sections on website visitors, the waitlist and contact requests, accounts, carers, the prospect list, AI misuse flags and running the service, we are the controller. That means we decide how the information is used and we are responsible for it. The one exception is the read of a carer's DBS certificate, which we make for the company the carer works for, or the one that invited them, as that company's processor.

For the records a care provider keeps in HeraIQ, the care provider is the controller and we act on its instructions. The section When we act for a care provider explains what that means for you.

We have not appointed a Data Protection Officer. We have recorded our reasons for that decision, and data protection questions go to hello@heraiq.io.

To report a security problem, email security@heraiq.io.

• HeraIQ is software for care providers registered with the Care Quality Commission (CQC). The records they keep about the people they support and their staff are theirs. They are the controller, and we process those records for them.
• About you directly, we hold what you give us to join, get in touch or sign in, and the records that keep the service secure.
• Website analytics runs only if you accept it, and only on our public pages. See cookies.
• Our AI features use OpenAI. They prepare answers and drafts for people to check, and changes to care records wait for a person to confirm. A few preferences, notes and reminders save straight away instead, and Hera can run the organisation's own CQC self-audit without asking; each one is recorded in the audit trail. We keep a record of AI requests in LangSmith, in the EU, to find and fix problems. We do not train AI models on your information.
• We do not sell personal information.
• You have rights over your information, and you can complain to us or to the Information Commissioner's Office (ICO).

What we collect

Only if you accept analytics cookies: the public pages you view, three actions (clicking a sign-up button, sending a contact message and joining the waiting list), a random identifier stored in a cookie, and the IP address and browser details that reach PostHog with each of these. No session recordings, heatmaps or automatic click tracking. If you refuse, PostHog is never loaded and none of this is sent to it.

Why

To understand which pages are useful and where people stop on the way to joining.

Lawful basis

Your consent. You can withdraw it at any time, and withdrawing does not affect what was collected before.

How long

12 months

Who receives it

PostHog, Inc., our analytics provider, which stores it in the European Union, on its EU cloud in Frankfurt, Germany. PostHog, Inc. is a US company and can reach it from outside the EU, under the EU-US Data Privacy Framework with its UK Extension and standard contractual clauses. Analytics never runs in the signed-in product.

Some cookies are needed whether or not you accept analytics, for example to remember your choice and to keep you signed in. Our cookie notice names each one and explains how to change your choice.

Whether or not you accept analytics, our hosting provider logs each request to this website. See Keeping the service secure and running.

Joining the waiting list

When new accounts need our approval, this website offers a form for joining our waiting list. Our staff read each request and decide whether you can create an account.

What we collect

Your name, your email address, the name of your care service if you give it, and any note you add. We add our own record of the request: whether we have approved it and when, any note our staff make about the decision, and when we emailed you.

Why

To decide whether you can create an account, and to email you about it: once to say we have your request, and again if we approve it, to tell you how to create your account.

Lawful basis

Legitimate interests: considering your request for access to HeraIQ and replying to you about it.

Do you have to give it?

Your name and an email address we can reply to are needed to consider your request. The name of your care service and the note are up to you.

How long

12 months after your request, then deleted. An approval ends when its request is deleted, so if you have not created your account by then, you would need to ask again.

Who receives it

Our staff who review requests. Supabase (our database, in London), Vercel (hosting) and Resend (the emails we send you) handle it on our behalf.

If we approve an email address without a request through this form, for example because you asked us by email or we set up your account for you, we keep that address, and any note our staff make, in the same list for the same period.

Contacting us

What we collect

Your email address, your name if you give it, the subject, your message and the replies in the conversation. If you are signed in, we link the request to your account instead of storing your email address again, and note which organisation you belong to.

Why

To answer your question or help with your problem.

Lawful basis

Legitimate interests: answering the people who contact us.

Do you have to give it?

A way to reply, a subject and your message are needed so we can answer. Your name is optional.

How long

24 months after the request is closed

Who receives it

Supabase stores the conversation. Resend emails a copy of a new request to our inbox and delivers our emailed replies. If you use the HeraIQ Care app, Expo delivers a notification that we have replied, without the content of the reply.

Your employer cannot read a request you send us. It goes to HeraIQ staff only.

This section is for managers and office staff at a care provider.

What we collect

Your name, work email address and password, your organisation's name, the care home or site, and its CQC location ID if you give it. Your password is handled by our sign-in service, Supabase, and we never see it. We also set sign-in cookies, store a push notification token if you use the app, and, when you use second-factor sign-in by email, store the one-time code in scrambled form. If you set up a paid plan, you enter your card details on Stripe's own payment page and they never reach us; we keep the references Stripe gives us and a record of each payment Stripe tells us about.

Why

To create and run your account, keep it secure, take payment if you are on a paid plan, send you service emails and help when you ask.

Lawful basis

Legitimate interests: providing the service your organisation signed up for, and keeping accounts secure. For payments, performing the contract your organisation has with us.

Do you have to give it?

A name, email address and password are needed for an account. Without them we cannot create one. Card details are needed only for a paid plan, and only Stripe receives them.

How long

Account details: for the life of the account, plus 90 days. Push notification tokens: stop being used when you sign out and deleted within 24 hours, or after 180 days without use. Second-factor codes: Deleted when used, or within 24 hours of expiring. Payment and billing records: six years after the end of the financial year in which the payment was made.

Who receives it

Supabase (database and sign-in), Vercel (hosting), Resend (service emails and sign-in codes), Expo (app notifications) and, if you are on a paid plan, Stripe (card payments). Stripe is also a controller in its own right for the payment itself, under its own privacy policy.

What you record in HeraIQ about the people your organisation supports, and about its staff, is covered in When we act for a care provider.

A carer can hold their own HeraIQ Care account, profile and document cabinet, and keep them when they move between employers.

What we collect

Your name, email address and password (handled by Supabase, and never seen by us), your phone number and date of birth if you add them, a push notification token, the one-time code in scrambled form when you use second-factor sign-in by email, and the documents you upload to your cabinet, such as an identity document, right to work evidence, a DBS certificate, training certificates, proof of address or a CV. For each document, the result of Hera's check of it (see Hera's check of your documents).

Why

To give you an account and a profile that belong to you, and to let you offer your documents to an employer when you choose to, and to check each document as you add it (a DBS certificate once you have joined a company or one has invited you).

Lawful basis

Contract: providing the account and document cabinet you signed up for. Hera's check of your documents has its own row below.

Do you have to give it?

A name, email address and password are needed for an account. Everything else is up to you.

How long

Account details: for the life of the account, plus 90 days. Push notification tokens: stop being used when you sign out and deleted within 24 hours, or after 180 days without use. Second-factor codes: Deleted when used, or within 24 hours of expiring.

Who receives it

Supabase (database, sign-in and file storage), Vercel (hosting), Resend (service emails and sign-in codes) and Expo (app notifications). OpenAI reads every document you add, to check it, except a DBS certificate before you have joined a company or one has invited you. If you use Hera or dictate a note, OpenAI also processes what you say or type, and LangSmith keeps a record of the request, as described in How we use AI.

A DBS certificate can contain criminal record information, which the law treats with extra care. It is in your cabinet only because you uploaded it, and no employer can see a document until you offer it to them. Unlike other documents, it is not checked when you add it if you have no employer yet: it is saved, and not read, and nothing in it goes to OpenAI, until you have joined a company or one has invited you. It is then checked at that company's cost, and under that company's lawful basis, not ours, and the whole certificate goes to OpenAI to be read. Hera is told to read only the details at the top of it, and to leave out anything it says about a record. We keep only the certificate number, the date, the level, the kind of work it covers, the name printed on it and whether that matches yours.

When you join an employer, or offer a document to one, that employer becomes the controller of its copy and of your work records, such as your rota, visits, check-in and check-out records, notes and training. That copy carries Hera's check of the document. The employer's managers can also see the notes about the picture, for as long as the document stays in your cabinet. Questions about those records go to your employer. See When we act for a care provider.

Hera's check of your documents

What we collect

For every document you add: what kind of document Hera took it to be, whether the picture was clear, whether both sides were there, its expiry or issue date, whether the name on it matches yours, the outcome and its reasons, how many times you tried, when it was checked and who paid. For a passport or ID, the country codes in its machine-readable lines. For a DBS certificate, its number, issue date, level and the kind of work it covers. For a training certificate, proof of address, a driving licence or car insurance, the details the form fills in for you to check, such as a course, a date, a licence number or a policy number. For each of those five kinds of document, a DBS certificate included, the name printed on it, to show whether it matches yours. A driving licence number contains your date of birth. Notes about the picture: that it may be a photo of a screen or a photocopy, that part of it may have been changed, or that a corner is cut off. From these checks, apart from the name printed on those five kinds of document, and the date of birth inside a driving licence number, never a passport or ID number, your date of birth, your National Insurance number, a share code or your name as printed.

Why

To tell you at once if a document will not do, so that you can send a better one; to stop a document that is unclear, the wrong kind, missing a side or out of date being sent to an employer; and to show an employer what Hera found, so that they know what to look at closely.

Lawful basis

Contract: providing the document cabinet you signed up for, which checks what you add. Legitimate interests, ours and an employer's, for the notes about the picture that an employer sees: helping them spot a document that needs a closer look. A DBS certificate, which can contain criminal offence data, is not checked until you have joined a company or one has invited you, and is then checked under that company's lawful basis, not ours.

Do you have to give it?

We do not require any document. If you add one, it is checked, apart from a DBS certificate, which is saved and not checked until you have joined a company or one has invited you. An employer may need a document before they can make you active.

How long

For the life of the account, plus 90 days

Who receives it

OpenAI reads each document it checks, on its standard service, not in a UK or EU region (see How we use AI). Supabase stores the result. Apart from what was read from your passport or ID, which the managers of a company you are linked to can see, an employer receives the result only for a document you send them, and becomes the controller of its copy, which carries the result. The notes about the picture stay with the document in your cabinet, and the employer's managers can see them for as long as it stays there.

Until you work for a company, or one has invited you, we pay for these checks. After that, the company pays. Either way the check is part of your cabinet, and we are its controller, apart from a DBS certificate: we check that for the company you work for, or the one that invited you, as its processor, under that company's lawful basis.

The check is made by our software, not by a person, and it can stop you sending a document to an employer until you send one it can accept. You can always reach a person. After three tries you can send most documents anyway, and your manager checks them by hand. A document that has run out, or one the rules do not take for the answer you gave, cannot be sent that way, but your manager can look at the original and add it to your record themselves. A document that goes over the limit on checks for a day waits to be checked, and cannot be sent until it has been. If you think the check is wrong, tell your manager, or email us (hello@heraiq.io).

The app does not show you the notes about the picture, so that they cannot be worked around by trying again. They are still your information, and you can ask us for a copy (see Your rights).

Your passport and visa answers

When you set up your account, we ask whether you have a British or Irish passport, and keep your answer and when you gave it. It decides which documents you are asked for. If you say you have a passport from another country, you may also be asked which visa or immigration status you hold and whether it limits the hours you can work, and we keep those answers too.

When you add the photo page of your passport, or another photo ID, Hera's check reads its machine-readable lines (see Hera's check of your documents, and How we use AI). From that read we keep the nationality, the expiry date, whether the name matches yours, and when and whether the read worked: never the passport number or your date of birth. We use it to notice when the passport does not match your answer. It is not a check of your right to work.

Your answers and what was read from your passport or ID are available to the managers of any company you are linked to, who use your visa answers to plan your shifts. They are kept with your account and deleted with it.

Your work profile, and care companies that look you up

You can fill in a work profile: the town or area you live in, how long you have worked in care, the kinds of care you know, the days you can usually work, what you enjoy outside work, whether you would move for the right job or could work anywhere in the UK, and a summary in your own words. It is kept with your account details, with your choice whether to show it to care companies, when you made that choice and the words you were shown.

If you choose to show it, a care company that types your email address into HeraIQ to invite you sees a card with your first name, the first letter of your surname, your answers and the summary you approved. It does not see your surname, email address, phone number, CV, documents or the AI's draft, and nobody else sees your profile. If you have not chosen to show it, the company sees nothing.

We record every lookup: the company, the person who made it, a scrambled form of the email address they typed, whether a card was shown, and when. That company's managers can see their own company's records. We have not yet decided how long these records are kept, and nothing deletes them yet.

If you ask, once a company has invited you or you work for one, we draft your summary from your CV. The CV file itself is checked like every document when you add it, and OpenAI reads the whole file then; what follows is for the summary only. We take the name on your account, email addresses, phone numbers, postcodes, National Insurance and NHS numbers, and a date of birth labelled as one, out of the CV's text, and send the rest to OpenAI. Only you see the draft, and approving your summary deletes it. Our record of the request in LangSmith holds neither your CV nor the draft.

This section is for relatives, friends and advocates whom a care provider invites to see some information about a person it supports, and for the person themselves if the provider invites them. Our family access notice says what you can see and when your access stops.

What we collect

For your account: your full name, your email address and your password (handled by our sign-in service, Supabase, and never seen by us), sign-in cookies, the one-time code we email you for the second step, in scrambled form, and the details of an authenticator app if you set one up. For your invitation: your email address, the name the care provider typed for you, who invited you and when, how many times a code was tried and whether it was accepted, and the code only in scrambled form. For your access: how you are related to the person, which screens you may see, your review date, whether your access is active, paused or ended and why, the reason the care provider records for sharing with you, and a dated record of each change. That reason can include, for a power of attorney or a deputyship, its reference, who checked it and the day, and for a best-interests decision, who decided, why and who was consulted. When a manager pauses, resumes or ends your access, or decides to keep it after a concern, the reason that manager wrote in their own words is kept with that change. Because it is free text, it can include names. When you accept your invitation: that you ticked the box saying you had read the family notice and the privacy notice, the version of each that your page was showing, and the time. Each time you open one of the four screens: which person, which screen, your account and the time.

Why

To give you the access the care provider chose, to keep it secure, and to keep a record of what was shown, what changed and which notices you said you had read, and when.

Lawful basis

This point is still being confirmed: the lawful basis for a family member's own data, and whether it differs between a relative, a friend, an advocate and the person themselves.

Do you have to give it?

A name, an email address and a password are needed for an account, and the second step is needed every time you use family access. To accept your invitation you must also tick that you have read the family notice and the privacy notice. Without these we cannot give you access. The care provider decides whether to invite you and what to share.

How long

An invitation lasts 7 days. Second-factor sign-in codes: Deleted when used, or within 24 hours of expiring. Email delivery receipts, including the one for your invitation: 365 days. This point is still being confirmed: how long to keep invitations, access records, the access log and the history of changes, for a family member and for the person.

Who receives it

The care provider that invited you sees your name, how you are related to the person, what you may see, your review date, your access status and the reason it recorded, and its managers have the email address they invited you at. Its managers can also read the record of changes to your access, including the reasons they wrote. Other people who have the Who has access screen for the same person see your name, how you are related to the person and what you may see. Supabase (database and sign-in), Vercel (hosting) and Resend (the invitation email and sign-in codes) handle it on our behalf. No AI model is used to build what family members are shown.

What you are shown about the person

What you are shown about the person is the care provider's record, not ours. We hold it for the care provider, as described in When we act for a care provider. The four screens show: whether there is an approved care plan, its version and two dates, and nothing that the plan says; the person's confirmed visits in the next 14 days (day, times, kind of visit, how many carers are planned, and the carer's first name and last initial or “To be confirmed”); the visits that finished in the last 14 days (planned time, when the carer arrived and left, and whether the planned tasks were done); and who else has access. Nothing else about the person is shown. This point is still being confirmed: whether HERA INTELLIGENCE LTD is a controller or a processor for a family member's own data (account, sign-in, invitation, access record, access log), and whether the care provider is the controller of what a family member is shown.

Your rights

To use a right, or to ask about your access, email hello@heraiq.io. Your rights and how to complain are in Your rights and Complaints. For a question about what the care provider shows you, ask the care provider. This point is still being confirmed: whether a family member's complaint about the care provider's decision on their access needs a route of its own beyond the complaint route above and the care provider's own.

This section is for care organisations registered with CQC, and for anyone who reads an email address we hold for one. We did not collect most of this information from you, so we are telling you where it came from.

What we hold

For each CQC-registered location whose provider CQC lists as an organisation or an NHS body: its name, address, phone number, website, service types, size and rating, and details of the provider such as its company or charity number. Where we have one, an email address for the organisation. We do not take the names of registered managers or other people from the register, and we do not include providers that CQC lists as individuals, such as sole traders, or as partnerships.

Where it came from

The CQC register of active locations, which is public and licensed under the Open Government Licence v3.0. Email addresses come from the Charity Commission's public register of charities or from the organisation's own website, and are general mailboxes such as info@ or enquiries@. Our staff can also enter an address that someone at the organisation gave us, for example on a phone call, which may be a named person's work address.

Why

To tell care organisations about HeraIQ by email.

Lawful basis

Legitimate interests: telling care organisations about a service built for them.

What happens now

Sending is switched off, and we have not emailed anyone on this list. If we switch it on, every email will say who we are and include a link to unsubscribe.

How long

We keep each entry while its location is on the CQC register. When a location leaves the register, we mark it inactive. We have not yet decided how long inactive entries are kept before they are deleted. If you object, we keep a record of the objection for as long as we hold the list, so that we keep honouring it.

Who receives it

Supabase, which hosts our database. If sending is switched on, Resend delivers the emails.

Your right to object

You can object at any time to our using these details to tell you about HeraIQ, whether you speak for the organisation or are a person who reads one of these mailboxes. Email hello@heraiq.io and we will stop. We keep the objection so that the address is not emailed in future.

Hera, our AI assistant, is for care management. When it declines a request as off-topic, we record that request so we can spot misuse.

What we record

Up to 500 characters of your message (not Hera's reply or the rest of the conversation), your account, your organisation, whether it came from the manager portal, the carer app or voice, the AI model used, and our staff's review decision.

Why

To detect and stop use of Hera for things it is not for, and to protect the service for everyone.

Lawful basis

Legitimate interests: preventing misuse of the service.

Who can see it

Only named HeraIQ staff, in a console that needs a second sign-in step. Your organisation cannot see it.

What can happen

A flag is only a prompt for review. A member of our staff reads it and may dismiss it, escalate it, or block an account or an organisation. Nothing is blocked automatically.

How long

180 days, after which a nightly job deletes it. A record of each block or unblock, with its reason, is kept for 730 days.

Who receives it

Supabase, which hosts our database.

If you think a flag or a block was wrong, email hello@heraiq.io.

We keep a few records about how the service is used, so we can keep it secure, fix problems, stop abuse and control costs. Our lawful basis is legitimate interests in running a secure and reliable service. Supabase hosts these records, apart from request logs, which Vercel keeps.

• Request logs. When your browser or the app contacts HeraIQ, Vercel, our hosting provider, handles the request and logs details such as your IP address, browser and the page requested, whether or not you accept analytics. We also hold your IP address briefly in memory to limit how many requests one connection can make, for example to our contact form.
• Sign-in cookies, which last until you sign out.
• Error records: the kind of error, the screen and the organisation, without who saw it. Kept for 90 days.
• AI usage records: the organisation that pays, or that HeraIQ paid, the task, the model, and the amount and cost of AI processing, without who made the request or what it said. Kept for 400 days.
• Email delivery receipts: a scrambled form of the recipient's address and whether the email was sent. Kept for 365 days.
• Push delivery receipts: the device token a notification was sent to and whether it was delivered. Kept for 180 days.
• Second-factor sign-in codes, in scrambled form: Deleted when used, or within 24 hours of expiring.

Care providers use HeraIQ to keep their records. For everything held in a care provider's account, the care provider is the controller and we are its processor. We use that information to provide HeraIQ to the care provider, under a data processing agreement. That includes:

• records about the people they support: identity and contact details, health and care needs, risks, medication information, DNAR status, NHS number, next of kin and GP, mental capacity and safeguarding information, care plans, risk assessments and visit notes;
• records about their staff: identity and contact details, rotas and visits, check-in and check-out location records, training, DBS certificate details, and right to work and identity documents;
• messages, and conversations with Hera about the care provider's service.

Separately, we keep a few limited records for our own purposes of security, preventing misuse and controlling costs, and for those we are the controller. They are described in AI misuse flags and account blocking and Keeping the service secure and running.

If you receive care from, or work for, a care provider that uses HeraIQ, please contact that care provider about your information, including to use your rights. If you contact us instead, we will tell you which provider to contact, or pass your request on, and help the provider respond.

We do not train AI models on this information, and we do not use it as examples for anyone else.

When a care provider's agreement with us ends: 90 days to request an export, then deleted within 30 days. Backup copies then age out on their own schedules, which depend on where each copy is held. We will confirm the current periods in writing on request.

Hera and the other AI features in HeraIQ use OpenAI. OpenAI receives only what a request needs, in order to answer it:

• the text you type to Hera, and the records Hera looks up to answer;
• your voice in a voice conversation, sent straight from your browser to OpenAI;
• dictated notes, to turn them into text;
• every document a carer adds to their cabinet, a CV included, and documents a care provider asks it to read, including identity documents and DBS certificates (a carer's only once they have joined a company or one has invited them): to check that each is clear, the right kind, complete, in date and in the right name, and to pull out details for a person to check;
• the text of a carer's CV, only when they ask us to draft a summary from it, with their name and other identifiers taken out first (the CV file itself is sent whole when it is added, like every document); only the carer sees the draft;
• text to be read aloud, descriptions for images, and text used to search records.

OpenAI processes this on its standard infrastructure, not in a UK or EU region. It keeps abuse-monitoring logs for up to 30 days, and by default does not use this information to train its models. We do not train AI models on your information either.

We keep a record in LangSmith that each AI request ran, so that we can find and fix problems with Hera: its name, timing, tags, the identifiers and model it ran with, and any error. It does not record what the request contained or what it returned, apart from anything an error message quotes. Records made before we stopped recording that content may still hold it until they are deleted. LangSmith holds these records in its EU region for up to 400 days. If our systems are ever pointed at LangSmith anywhere else, this monitoring switches itself off.

AI prepares answers and drafts. Changes to clinical, identity, status or rota records are prepared as confirmations that a named person applies. Four preference fields on a person's record save straight away and are logged with their previous value. The notes and reminders Hera is asked to remember also save straight away, and you can ask Hera to forget a memory. Hera can also run the organisation's own CQC self-audit, and set how often it runs, without asking first; a run records a reading and a draft report and changes no care record.

Hera's check of a carer's document is made by our software alone, and it can stop that document being sent to an employer until the carer sends a better one. A person can always step in, as Carers explains: after three tries the carer can send most documents to their manager to check by hand, and a manager can add any document to a carer's record after seeing the original. Apart from that, we do not make decisions about anyone by automated means alone that have legal or similarly significant effects. AI drafts are reviewed by the care provider's staff, and an account is blocked only after one of our staff has reviewed it.

We use the service providers below to run HeraIQ. They process information only on our instructions, apart from Stripe, which is also a controller in its own right for the payment itself, under its own privacy policy. Our sub-processors page gives more detail about each one, including what it receives.

PostHog is not a sub-processor. We use it for our own purposes, to measure visits to our public website, and only after you accept analytics cookies. It never runs in the signed-in product. Its data is stored in the European Union, on PostHog's EU cloud in Frankfurt, Germany. PostHog, Inc. is a US company and can reach that data from outside the EU, under the EU-US Data Privacy Framework with its UK Extension and standard contractual clauses. The provider is PostHog, Inc.

Where a provider processes information outside the UK, we rely on the safeguard shown in the table. You can ask us for a copy by emailing hello@heraiq.io.

We also share information when the law requires it. We do not sell personal information.

Our cookie notice lists every cookie this website sets, what each is for, and which ones appear only if you accept analytics.

In brief:

• one care provider's records are kept apart from another's by database row-level security for reads from the browser and the carer assistant, and by organisation checks on our server;
• an audit trail of changes made through Hera, which for supported actions keeps the state of the record before the change, and where undoing adds a new entry rather than deleting the original;
• files are held in private storage and reached through short-lived links;
• uploads are held apart and checked on our server before use;
• connections are encrypted, and browsers are told to use encryption only;
• our staff console is limited to named staff, with a second sign-in step;
• the database is hosted in London.

What is not in place yet:

• two-factor sign-in for customer accounts is built but not yet switched on;
• we hold no ISO 27001, SOC 2, Cyber Essentials or DSPT certification;
• no independent penetration test has been carried out;
• uploaded files, such as the documents in a carer's cabinet, are not yet included in backups;
• there is no DCB0129 clinical safety case.

Our security page has the details.

The main periods for the information we hold as controller are below. The sections above give the rest, for the records that keep the service running.

For a care provider's records, the care provider decides. When its agreement with us ends: 90 days to request an export, then deleted within 30 days.

You have these rights over the information we hold as controller:

Access

Ask for a copy of the information we hold about you.

Rectification

Ask us to correct information that is wrong or incomplete.

Erasure

Ask us to delete your information.

Restriction

Ask us to pause using your information while a concern is looked into.

Portability

Ask for information you gave us, in a common machine-readable format, where we rely on your consent or a contract.

Objection

Object to our using your information where we rely on legitimate interests. You can always object to marketing, and we will stop.

Withdrawing consent

Where we rely on your consent, such as for website analytics, withdraw it at any time.

Some rights apply only in certain situations, and we will explain if one does not apply. To use a right, email hello@heraiq.io. It is free. We may ask you to confirm who you are.

We reply within one month of receiving your request, or of receiving anything we asked for to confirm who you are, whichever is later. If we need you to tell us more about what you are asking for, the time until you reply does not count. If your request is complex, or you have made several requests, we may need up to two more months, and we will tell you within the first month.

For records a care provider keeps about you, please contact the care provider. We will help them respond.

If you are unhappy with how we have handled your information, please tell us first by emailing hello@heraiq.io. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint.

HeraIQ is for care businesses and the people who work for them. Care providers may use it only for adult social care, so it must not hold records about anyone under 18.

When we change this notice, we publish the new version here and update the version number and date at the top.