Privacy Notice

1. Who we are

Care Airo Ltd is the controller of the personal data we collect through this platform.

2. What personal data we collect

Through the mobile application

When care workers use the CareAiro mobile app, we collect:

• GPS location (only during visit check-in and check-out for verification)
• Camera access (to scan QR codes for secure check-in and upload incident photos)
• Microphone access (for optional speech-to-text visit note dictation)
• Photos from library (to attach images to incident reports)
• Visit notes, tasks, and care records entered by the care worker
• Device push notification token (for shift and visit alerts)

Through the web platform

• Name, email address, and role for account management
• Activity logs and audit trails for compliance purposes
• Standard server log entries (IP address retained 30 days)

3. Why we process your data and our lawful basis

4. How long we keep your data

5. Who we share your data with

We share personal data only with:

• Google Cloud Platform — our cloud infrastructure provider (europe-west2, London)
• Resend — email delivery for notifications and system alerts
• Professional advisors — lawyers, accountants, auditors where necessary
• Competent authorities — where legally required (e.g. lawful court order)

We do not sell personal data. We do not use your data to train AI models. We do not pass your data to third parties for their own marketing.

6. Your rights

Under UK GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you
• Rectification — ask us to correct data that is wrong
• Erasure — ask us to delete data in certain circumstances
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a structured format
• Object — object to processing based on legitimate interests

To exercise any rights, email privacy@careairo.com. We will respond within one calendar month.

You may also complain to the Information Commissioner's Office: ico.org.uk · 0303 123 1113

7. Automated decision-making

The CareAiro platform uses AI to assist care managers with scheduling suggestions and care summaries. These are advisory tools only — no automated decisions that produce legal or similarly significant effects are made without human review.

8. Cookies

The CareAiro web application uses strictly necessary cookies for session management and authentication only. We do not use analytics, tracking, or advertising cookies.

9. Security

We protect personal data using encryption in transit (TLS 1.2+), encryption at rest, role-based access controls, and immutable audit logs. Our infrastructure is hosted exclusively in the United Kingdom (Google Cloud Platform, london region).

10. Mobile application permissions

11. Changes to this notice

We may update this notice from time to time. The "Last updated" date at the top shows when it was last revised. Material changes will be communicated to registered users.

12. Contact