Version 1.0 — November 2026

These terms form part of the agreement between CQC Compliance Services Ltd (trading as MyCareAudit, company 12536256, “we”) and each customer organisation (“you”). They apply when we process personal data for you as your processor under Article 28 of the UK GDPR. If you need a signed copy for your records, email Contact us via email.

1. Roles and scope

You are the controller of the records you put into the platform about the people you support and your staff. We are your processor. We process that data only to provide the platform, support and the features you choose to use, for as long as your subscription runs.

Types of data: identity and contact details, care and support records, health information (special category data), safeguarding and incident records, staff employment, training and vetting records, and files you upload. People: the people you support, their families and representatives, and your staff.

2. Our commitments

We act only on your documented instructions, which are these terms and the way you configure and use the platform. We will tell you if we believe an instruction breaks data protection law.
Everyone at MyCareAudit with access to your data is bound by confidentiality.
We apply the security measures described on our Security page, including UK hosting, encryption in transit and at rest, role-based access, separation between organisations, audit logs and tested backups.
We use only the sub-processors listed on our Sub-processors page, each under a written contract with equivalent data protection terms. We give at least 30 days’ notice of a new sub-processor for customer records, and you may object.
We help you respond to requests from individuals (access, correction, deletion and so on), including through the platform’s export tools.
We help you with security, breach notification, data protection impact assessments and consultation with the ICO, as far as is reasonable given the information we hold.
We tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information we have, so you can meet your own 72-hour duty to the ICO.
We give you the information you reasonably need to show you are meeting Article 28, and allow reasonable audits, normally by questionnaire or by reviewing our security evidence.

3. AI features

When a user runs an AI feature, only the content that feature needs is sent to Microsoft Azure OpenAI in the UK South region. It is not used to train AI models. AI output is a draft for a person to check and approve. See our AI Trust page.

4. International transfers

Customer records are hosted in the UK. We do not transfer them outside the UK unless a listed sub-processor needs to, and then only with a lawful transfer mechanism such as UK adequacy regulations or the UK International Data Transfer Agreement / Addendum.

5. End of the contract

You can export your data at any time (see Data portability). When your subscription ends we delete or return your data as you instruct, and in any case delete it from the live system within 90 days. Encrypted backups age out within our backup retention period. We keep data longer only where the law requires it.

6. Contact

For any question about these terms, email Contact us via email. See also our Privacy Notice.