Privacy Policy

Who we are

CarePrint is a recognition platform operated by TheQuestLab CIC, a Community Interest Company registered in England and Wales (“CarePrint”, “we”, “us”). For the personal data described in this notice, TheQuestLab CIC is the data controller, except where we act as a data processor on behalf of a care provider (see “Providers and their data” below).

If you have any question about this policy or your data, contact us at hello@mycareprint.co.uk. Our registered office is [registered office], Kingston upon Hull. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].

The information we collect

• Recognition submissions — the praise text someone writes, the name of the care worker it is about, the submitter’s stated relationship (e.g. family member, client, colleague), and any name or contact detail the submitter chooses to give.
• Care worker records — a care worker’s display name, role title, the organisation that added them, and the verified recognition that builds their record.
• Provider accounts — the email address and sign-in credentials of managers and coordinators, and the organisation details they enter.
• Technical data — basic information needed to keep you signed in securely and to keep the service running.

What we do not collect

CarePrint is not a clinical or care record. We do not ask for, and submitters are asked not to include, medical details, care needs, or other special-category health information. If such information is submitted in free text, providers and CarePrint may redact or remove it.

Why we use it, and our lawful basis

• To capture and display recognition — on the basis of the submitter’s consent, freely given when they submit.
• To let providers verify recognition and support their care workers — on the basis of our contract with the provider and our legitimate interest in operating the service.
• To give care workers a portable record they own — on the basis of legitimate interests and, where a care worker claims their record, their account with us.
• To keep accounts secure and meet our legal obligations — on the basis of legitimate interests and legal obligation.

Consent, and withdrawing it

Where we rely on consent, you can withdraw it at any time by contacting hello@mycareprint.co.uk. Withdrawing consent does not affect anything done before you withdrew it. A care worker can ask for recognition on their record to be hidden or removed.

Who we share it with

We do not sell personal data. We share it only with: the relevant care provider and the care worker the recognition is about; and the trusted service providers who host and run the platform on our behalf under contract (our “processors”), listed in our Data Protection statement. A publicly shared record shows only verified recognition and never reveals a submitter’s identity or contact details.

Where your data is held

CarePrint is built to keep data within the UK/EU. Our hosting is provided by [hosting/data processor, e.g. Lovable Cloud / Supabase], in the [UK/EU] region. Where any transfer outside the UK is necessary, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or adequacy regulations.

How long we keep it

• Pending recognition that is never verified expires automatically after 90 days.
• Verified recognition is kept as part of the care worker’s record for as long as their record is active, or until they ask us to remove it.
• Account data is kept while the account is open and for [retention period] afterwards, unless we must keep it longer by law.

Your rights

Under UK data protection law you have the right to access your data; to have it corrected or erased; to restrict or object to its use; and to data portability. To exercise any of these, email hello@mycareprint.co.uk and we will respond within one month.

You also have the right to complain to the ICO at ico.org.uk, though we would appreciate the chance to put things right first.

Providers and their data

When a care provider uses CarePrint to manage recognition for their own workers, that provider is the controller for their organisation’s data and CarePrint acts as their processor. Our responsibilities in that role are set out in our Data Protection statement and any agreement with the provider.

Changes to this policy

We may update this policy from time to time. The date below shows when it last changed, and material changes will be highlighted on this page.