MyCareAudit Logo

Privacy Notice

Last updated: October 2026

CQC Compliance Services Ltd (trading as MyCareAudit), Company Registration 12536256 (England and Wales), Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“we”, “us”). This notice explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Our role: controller and processor

We are the controller for data about our website visitors, enquirers, account holders, customers and their billing contacts, and people who receive our emails.

We are a processor for the records our customers put into the platform about the people they support and their staff (for example care records, audit evidence, rotas and training records). For that data the care provider is the controller and decides why and how it is used. We process it only on their written instructions under our data processing terms. If you are a resident, young person, family member or staff member of one of our customers, please contact that provider first about your rights; we will help them respond.

2. What we collect

  • Account and contact data: name, job title, organisation, email, phone number and service details.
  • Billing data: plan, invoices and payment status. Card details are taken by Stripe; we never see or store full card numbers.
  • Platform content: audit answers, evidence files, policies, reports and anything else you upload or record.
  • Customer records (as processor): may include health and care information about the people a provider supports. This is special category data. Staff records may include employment, training, right-to-work and DBS check details.
  • Technical data: IP address, browser, device and security logs, used to run and protect the service.
  • Usage data: pages visited, measured by our own cookieless analytics (no cookies, no cross-site tracking) and, only if you agree, by Google Analytics and Google Ads.

3. Why we use it and our lawful basis

  • To provide the platform and support you — contract.
  • To take payment, keep accounts and meet tax and legal duties — contract and legal obligation.
  • To keep the service secure, prevent misuse and improve it — legitimate interests.
  • To send service and account emails — contract. To send marketing emails to business contacts — legitimate interests, with an unsubscribe link in every email.
  • To set Google Analytics and Google Ads cookies — consent, which you can withdraw at any time.
  • Special category data in customer records is processed for the provider under Article 9(2)(h) UK GDPR (health and social care) and the related conditions in the Data Protection Act 2018. The provider is responsible for that lawful basis.

4. AI features

Some features use AI to draft reports, summaries and documents. When you use them, only the content each feature needs is sent to Microsoft Azure OpenAI in the UK South region to produce the result. Under our contract your content is not used to train AI models. AI output is a draft for a person to check; it does not make decisions about anyone. Many checks in the platform are rules-based and use no AI at all. See our AI Trust page for details.

5. Who we share data with

We do not sell personal data. We share it only with named suppliers who process it for us under contract:

  • Hosting and storage: IONOS (UK servers) for the application and database; Amazon Web Services (London region) for file storage.
  • AI processing: Microsoft Azure OpenAI (UK South region).
  • Email delivery: Brevo (EU), for service and marketing emails.
  • Payments: Stripe.
  • Analytics and advertising (only with your consent): Google Analytics and Google Ads.

We may also share data where the law requires it, for example with regulators or the police.

6. Where data is held and international transfers

Customer data is hosted in the UK. Some suppliers can process data outside the UK: Brevo (email) in the EU, and Stripe and Google, which may process data in the United States. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum, plus the supplier’s security commitments.

7. How long we keep it

Account data is kept while your account is active and for up to 12 months after it closes, unless you ask us to delete it sooner. Billing records are kept for 6 years for tax purposes. Customer records are kept for the length of the customer contract and then deleted or returned as the provider instructs; providers set their own retention periods for care records. Security logs are kept for up to 12 months.

8. Security

Data is encrypted in transit and at rest. Access is limited by role, accounts are separated by organisation, and we keep audit logs of access. See our Security page.

9. Your rights

You can ask to access, correct or delete your data, restrict or object to its use, and receive a copy in a portable format. Where we rely on consent you can withdraw it at any time (for cookies, use the cookie settings on this site). Contact us at Contact us via email. We will reply within one month.

10. Complaints

Please contact us first so we can try to put things right. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

11. Contact

For any privacy question: Contact us via email, or write to the registered office above. See also our Cookie Policy.