Privacy Policy

Version: 1.4 Effective Date: 28 April 2026 Last Updated: 7 November 2026 — see Changelog at the bottom. This document still requires solicitor review before being relied on commercially or for insurance underwriting purposes (see docs/legal/DPA.md status).

Who We Are

AssuraFlow is a product of EchoVell Ltd (echovell.com), a company registered in England and Wales, which operates the service.

• Company number: to be added before launch
• Registered office: to be added before launch

Our Two Roles

AssuraFlow is used by care providers to keep care records and governance records. That gives us two different roles:

• Processor for our customers' records. When a care provider keeps records in AssuraFlow (about the people it cares for, their families, its staff, and its governance decisions), the care provider is the Data Controller and decides what is recorded and why. We process those records only on its instructions, under our Data Processing Agreement.
• Controller for our own records. We are the Data Controller for the information we need to run our own business: user accounts, security logs, billing, support requests and enquiries sent to us.

If You Receive Care, or Are a Family Member or Representative

If your care provider uses AssuraFlow, your records in it may include your care and health records, incidents and safeguarding concerns, risk assessments, daily notes, complaints, contacts with your family and professionals, and records of personal money the provider handles for you. Your provider is responsible for these records. Its own privacy notice explains what it records, why, its lawful basis, how long it keeps records, and how to exercise your rights. If you want to see, correct or ask questions about your records, please contact your care provider first. If you contact us, we will pass your request to the provider and help it respond; we cannot decide the request ourselves.

Children's records are handled the same way: the children's home or service is responsible, and requests from a child, a parent or someone with parental responsibility go to the provider.

Data We Process for Care Providers (as Processor)

The full list is in our Data Processing Agreement (§3.2). In summary:

• Service-user records: a reference number chosen by the provider (we don't hold a name on the person record), care sector, admission and discharge dates, health records, incidents including body maps and safeguarding concerns, risk assessments, daily logs, care documents, oversight reviews, complaints, contact logs, and personal-money records.
• People connected to service users: names and roles of family members, advocates and professionals recorded in contact logs and complaints.
• Staff, Nominated Individuals and Responsible Individuals: names, roles, homes assigned, training records, governance decisions, and fit-and-proper-person evidence, which can include DBS check outcomes.
• Governance records: issues, actions, audits, policies, inspection notes and the audit trail of who changed what.

Data We Collect for Ourselves (as Controller)

Purpose

• Deliver contracted governance platform services.
• Protect security, availability, and legal compliance.
• Support support requests and incident handling.
• Answer enquiries and, where you agreed, contact you about the service.

Lawful Bases

For our own records (as Controller):

For records we process for care providers: the provider decides the lawful basis. Care records are normally kept because registered care providers are legally required to keep them (Art. 6(1)(c)) or as a public task (Art. 6(1)(e)), with health data processed for health or social care purposes (Art. 9(2)(h) and Data Protection Act 2018 Schedule 1 paragraph 2). Safeguarding and criminal records checks can rely on other Schedule 1 conditions. Our Data Processing Agreement (§2.2) sets out the bases providers typically use.

Automated Processing and AI Features

AssuraFlow includes AI-assisted features (e.g. drafting summaries and suggested follow-up actions) governed by AI-USAGE-DISCLOSURE-POLICY.md. AI output is assistive, not authoritative, and human review is required before use in governance reporting or regulatory interaction. A narrow, opt-in "Autopilot" mode exists for a fixed whitelist of low-judgment, reversible actions (reminders, report drafts, document tagging, scheduled audit starts) on Enterprise-tier accounts that explicitly enable it; high-judgment actions (governance issues, remediation actions, standalone actions) always require human approval and are never automated. No processing under this policy produces a decision with legal or similarly significant effect on an individual without human involvement.

AI features are switched on per deployment. When they are on, information submitted to them (the text of a question, or the record being explained or summarised) is processed by our AI service provider, Anthropic PBC (its Claude models, processed in the United States), acting as our sub-processor to deliver the platform's AI functionality. NHS numbers, National Insurance numbers, email addresses, UK phone numbers and postcodes are removed first, and names the organisation holds (its staff, the people named in its contact logs and complaints, its service-user references) and titled names such as "Mrs Jones" are replaced with placeholders. A name we don't hold, written without a title, can still be sent, so avoid typing names into the assistant. Under Anthropic's commercial terms and its data processing addendum, Anthropic processes this content only to provide the service to us, may not train its models on it, and deletes it within 30 days, unless a different period is agreed in writing or it must keep content longer to enforce its usage policy or meet a legal obligation (content flagged for a usage-policy breach can be kept for up to 2 years). The transfer to the United States is covered by Anthropic's data processing addendum, which includes the UK Addendum to the EU Standard Contractual Clauses. Voice notes dictated in the mobile app, when an organisation has voice features on, are sent as audio to OpenAI (United States) for transcription only, and are not stored by us.

Data Sharing

No sale of personal data. We share data only:

• with contracted subprocessors needed for hosting, communications, AI features (Anthropic for AI text features, OpenAI for voice transcription) and support;
• with people and systems a care provider chooses: regulators given read-only inspector access, commissioners given time-limited access, connected systems, and anyone the provider sends an export to. Event notifications sent to a provider's own systems contain record ids, types, severity and status only, never names or care details;
• where the law requires it.

See SUBPROCESSORS-DATA-RESIDENCY-STATEMENT.md and docs/legal/DPA.md §7.1 for the current, factual subprocessor list.

Where Data Is Stored and Transfers

Customer data is stored and processed in the United Kingdom, on Microsoft Azure (UK South). Backups stay in the UK. Before go-live, the service runs in a test environment that holds no real customer or service-user data; no customer personal data is processed until the service is running on Azure in the UK.

Some optional features rely on providers based outside the UK: the AI and voice features described above (Anthropic and OpenAI, United States) and SMS notifications (Twilio, United States), and only when an organisation has those features switched on. Card payments are handled by Stripe. Where a transfer outside the UK occurs, AssuraFlow applies UK-compliant transfer safeguards. See SUBPROCESSORS-DATA-RESIDENCY-STATEMENT.md for the subprocessor list and where each one processes data.

Cookies

AssuraFlow uses only strictly-necessary and functional cookies (session authentication, CSRF protection, interface preferences) — no advertising or cross-site tracking cookies. See the public Cookie Policy page for the full breakdown.

Retention

Records we process for care providers are kept for as long as the provider keeps them, under the provider's own retention schedule. Care records often have long statutory periods (for example, children's case records in children's homes in England are kept until the child's 75th birthday). When a provider's contract ends, it can export its records, and we delete them within 60 days unless the law requires us to keep them. The audit trail of who did what is kept as governance history and is not deleted; it holds user and record identifiers and short descriptions of actions, not the records themselves. Our Records Retention and Deletion Policy lists the reference periods.

Our own records:

• Account data: while the account is active, then deleted or anonymised when the account is closed, except where it is attached to records the provider must keep (for example, who made a governance decision).
• Security and access logs: 2 years.
• Billing records: 6 years from the end of the financial year they relate to, for tax and accounting purposes.
• Support requests and enquiries: as long as needed to resolve the matter, then reviewed for deletion.

Rights

You may request access, rectification, deletion, restriction, portability and objection, subject to legal limits. For records held for a care provider, contact the provider; for our own records, contact us. Some records cannot be deleted on request while the law requires the provider to keep them. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been processed unlawfully.

Data Protection Officer

Contact our Data Protection Officer at dpo@assuraflow.io for any data protection question, or to exercise a data subject right.

Contact

privacy@assuraflow.io

---

Changelog