1.1 CareKudos Ltd ("we", "us", "our") is committed to protecting your privacy and personal data.
1.2 This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.
1.3 We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1.4 Please read this policy carefully. By using the Platform, you confirm that you have read and understood this policy.
1.5 CareKudos Ltd is registered with the Information Commissioner's Office (ICO). Registration Reference: ZC108498.
Data Controller: CareKudos Ltd (for user account information)
Data Processor: CareKudos Ltd (for customer staff and service user data)
Registered Address: 1 Langley Road | Isleworth | London | TW7 5AH | UNITED KINGDOM
Company Number: 17013021
ICO Registration Number: ZC108498
Contact: privacy@carekudos.co.uk
3.1.1 Account Information:
3.1.2 Organisation Information:
3.1.3 Profile Information:
3.1.4 Content:
3.1.5 Communications:
3.1.6 AI Prompt Content:
3.2.1 Usage Data:
3.2.2 Device Information:
3.2.3 Log Data:
3.2.4 Cookies and similar technologies (see our Cookie Policy)
3.2.5 Dictation Audio:
3.3.1 Organisation administrators may provide information about you.
3.3.2 Payment processors provide payment confirmation (we do not store payment details).
3.3.3 We do not receive or process special category data of Service Users (all content is anonymised before processing).
4.1.1 Create and manage your account.
4.1.2 Enable recognition and posting features.
4.1.3 Generate reports and analytics.
4.1.4 Provide customer support.
4.1.5 Process payments.
4.1.6 Generate AI writing suggestions when you ask for one, by sending the text you typed to a third-party AI provider (see section 7).
4.1.7 Draft the narrative of monthly CQC evidence reports, where your organisation has switched AI on (web app only, see section 7).
4.2.1 Analyse usage patterns.
4.2.2 Develop new features.
4.2.3 Conduct research and analytics.
4.2.4 We do not use your content to train AI models, and our AI providers are contractually prohibited from doing so.
4.3.1 Send service updates and notifications.
4.3.2 Respond to inquiries and support requests.
4.3.3 Send marketing communications (with consent where required).
4.3.4 Provide important information about your account.
4.4.1 Maintain records as required by law.
4.4.2 Respond to lawful requests from authorities.
4.4.3 Protect our legal rights.
5.1 We process your personal data under the following legal bases:
5.1.1 Contract Performance: To provide the Platform services under our Terms and Conditions.
5.1.2 Legitimate Interests: To operate and improve the Platform, ensure security, and communicate with users.
5.1.3 Legal Obligation: To comply with applicable laws and regulations.
5.1.4 Consent: For marketing communications and certain optional processing activities.
6.1.1 Your posts and recognition may be visible to others in your organisation based on your privacy settings.
6.1.2 Managers can view aggregated data about team performance.
6.1.3 Organisation administrators can manage accounts and access certain data.
We share data with the following sub-processors:
| Sub-processor | Purpose | Data Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting | UK / EEA |
| Google Cloud / Firebase | App hosting, database, notifications | UK / EEA |
| SendGrid | Email delivery | UK / EEA |
| Twilio | SMS notifications | UK / EEA |
| GoCardless | Direct Debit payment processing | UK / EEA |
| Google Analytics | Usage analytics (anonymised) | UK / EEA |
| OpenAI, L.L.C. | AI writing help (see section 7) | United States |
| Anthropic PBC | AI writing help (see section 7) | United States |
| Google LLC (Gemini API) | AI writing help (see section 7) | United States |
6.2.1 We impose data protection obligations on all sub-processors.
6.2.2 Only one organisation's chosen AI provider is used at a time, and only if your organisation has switched AI features on. Section 7 explains in full what is sent, to whom, and what they may do with it.
6.2.3 We remain fully liable for sub-processor performance.
6.3.1 To comply with legal obligations.
6.3.2 To respond to lawful requests from authorities.
6.3.3 To enforce our Terms and Conditions.
6.3.4 To protect our rights, privacy, safety, or property.
6.4.1 We may share information with third parties where you have given explicit consent.
7.1.1 AI writing help (mobile and web app): when you tap "Draft with Kudo" while writing a recognition post, we send the text you have typed to a third-party AI provider, which returns a suggested draft.
7.1.2 CQC evidence reports (web app only, managers and administrators): where an organisation has switched AI on, the monthly CQC evidence report narrative is drafted by the same provider from the recognition and Good Catch content recorded for that service in that month.
7.1.3 AI features are off unless your organisation switches them on. AI writing help additionally requires your own consent, which you give through an in-app disclosure and can withdraw at any time in Settings.
7.2.1 Your organisation selects one of the following providers, and only the selected provider receives any data:
7.2.2 OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, USA — processed in the United States.
7.2.3 Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA — processed in the United States.
7.2.4 Google LLC (Gemini API), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA — processed in the United States.
7.2.5 Your organisation's administrator can tell you which provider is in use, and the app names the possible recipients on the consent screen and again each time a draft is produced.
7.3.1 For AI writing help: only the text you have typed into the post box at the moment you ask for a draft; where you are completing a Good Catch outcome, the Good Catch post the outcome belongs to; your organisation's list of company values and any guidance your organisation has configured; and a draft you have rejected, if you ask for a different suggestion.
7.3.2 For CQC evidence reports: the recognition and Good Catch content recorded for that service location in the reporting month, the service location name, and the calculated KLOE scores.
7.3.3 We do not send your name, email address, telephone number, photograph, login credentials, or your organisation's customer records.
7.3.4 Free-text you type is sent as you wrote it. You must not include the name of, or any detail identifying, a person receiving care. The app scans each draft and warns you where something appears identifying, but this is a safeguard and not a guarantee.
7.4.1 The provider uses the text solely to generate the requested suggestion and return it to us.
7.4.2 Under our contracts with these providers, data submitted through their business APIs is not used to train or improve their AI models.
7.4.3 Providers may retain the text for a limited period (no more than 30 days) for security and abuse monitoring, after which it is deleted.
7.4.4 A suggestion is only ever a suggestion. Nothing is published until you have reviewed it, edited it if you wish, and chosen to post it. No decision about you is made by AI, and no AI output affects your employment, pay or assessment.
7.5.1 Our legal basis for this processing is your consent (UK GDPR Article 6(1)(a)) for AI writing help, and our legitimate interests in helping organisations evidence regulatory compliance for CQC evidence reports.
7.5.2 Because these providers process data in the United States, transfers are made under UK International Data Transfer Agreements and/or the EU Standard Contractual Clauses, together with a transfer risk assessment. See section 8.
7.5.3 We have satisfied ourselves that each provider offers protection for your data equivalent to that required by UK GDPR, and each is bound by a written data processing agreement with us.
7.6.1 You can decline AI writing help when it is first offered, and nothing you type will be sent.
7.6.2 You can turn AI writing help off at any time in Settings. It takes effect immediately.
7.6.3 Declining or disabling AI does not limit any other part of the Platform.
7.6.4 If you have questions about AI processing, contact privacy@carekudos.co.uk.
8.1 Your information is primarily processed within the UK / European Economic Area (EEA).
8.2 There is one routine exception. Where your organisation has switched AI features on, the content described in section 7.3 is transferred to an AI provider in the United States for the time it takes to generate a suggestion. No other personal data is routinely transferred outside the UK/EEA.
8.3 For that transfer, and for any other transfer outside the UK/EEA, we ensure appropriate safeguards are in place, such as:
8.3.1 UK International Data Transfer Agreements (or the UK Addendum to the EU Standard Contractual Clauses).
8.3.2 Standard Contractual Clauses approved by the European Commission.
8.3.3 Adequacy decisions for certain countries.
8.3.4 A documented transfer risk assessment, reviewed periodically.
9.1 We retain your personal data for as long as necessary to:
9.1.1 Provide the Platform services.
9.1.2 Comply with legal obligations.
9.1.3 Resolve disputes.
9.1.4 Enforce our agreements.
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion, plus 30 days for backup purposes |
| Posts and recognition | Until account deletion or as required for organisational records |
| Pilot Programme data | Retained for 30 days after the pilot ends to allow conversion to a paid subscription; securely deleted if not converted |
| Usage logs | 12 months |
| Payment records | 7 years (legal requirement) |
| Communications | 2 years |
| Audit logs | 2 years |
9.3 After the retention period, your data will be securely deleted or anonymised.
10.1 Under UK GDPR, you have the following rights:
10.1.1 Right to Access: Request a copy of your personal data.
10.1.2 Right to Rectification: Request correction of inaccurate data.
10.1.3 Right to Erasure: Request deletion of your data (subject to legal requirements).
10.1.4 Right to Restrict Processing: Request limitation of processing.
10.1.5 Right to Data Portability: Request transfer of your data to another service.
10.1.6 Right to Object: Object to processing based on legitimate interests.
10.1.7 Rights Related to Automated Decision-Making: Not be subject to solely automated decisions.
10.2 To exercise your rights, contact us at privacy@carekudos.co.uk.
10.3 We will respond to your request within one month.
10.4 You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): www.ico.org.uk.
11.1 We implement appropriate technical and organisational measures to protect your data.
11.2.1 Data at Rest: All personal data is encrypted using AES-256-GCM encryption.
11.2.2 Data in Transit: All data transmission is encrypted using TLS 1.3.
11.2.3 Encryption keys are stored separately in a secure key management service.
11.3.1 Role-based access control (RBAC) enforced at application level.
11.3.2 Principle of least privilege applied to all user roles.
11.3.3 All access requests and modifications are logged for audit purposes.
11.4.1 Regular vulnerability scanning and penetration testing.
11.4.2 Intrusion detection and monitoring systems in place.
11.4.3 Web application firewall to filter incoming traffic.
11.5 No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
11.6 You are responsible for maintaining the security of your login credentials.
12.1 We use cookies and similar technologies to operate and improve the Platform.
12.1.1 Essential Cookies: Required for Platform functionality.
12.1.2 Analytics Cookies: Help us understand how users interact with the Platform.
12.1.3 Preference Cookies: Remember your settings and preferences.
12.2 You can control cookies through your browser settings, but disabling may affect Platform functionality.
12.3 For more information, see our Cookie Policy.
13.1 The Platform is not intended for individuals under the age of 18.
13.2 We do not knowingly collect personal data from children under 18.
13.3 If you believe we have collected data from a child, please contact us.
14.1 The Platform may contain links to third-party websites.
14.2 We are not responsible for the privacy practices of third parties.
14.3 We encourage you to read the privacy policies of any third-party sites you visit.
15.1 We may update this Privacy Policy from time to time.
15.2 We will notify you of material changes by email or through the Platform.
15.3 The "Last Updated" date at the top of this policy indicates when changes were made.
15.4 Continued use of the Platform after changes constitutes acceptance of the updated policy.
Data Protection Queries: privacy@carekudos.co.uk
General Inquiries: hello@carekudos.co.uk
Post: 1 Langley Road | Isleworth | London | TW7 5AH | UNITED KINGDOM
Phone: +44 7944200094
ICO: You can contact the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
We use cookies to run the site and, with your consent, to understand how it is used. Choose which categories to allow. See our Cookie Policy for details.
Required for the site to function, such as security and remembering your choices. These cannot be switched off.