Privacy Policy

1. Who We Are

Ecohomes Care Ltd ("we", "us", "our") is a domiciliary care provider registered in England and Wales. We are a CQC Registered Provider and the Data Controller for all personal information we process.

Detail	Information
Company name	Ecohomes Care Ltd
Company number	15230160
Registered address	Fort Dunlop, Unit 115-119, Fort Parkway, Birmingham B24 9FE
Email	info@ecohomescare.com
Phone	0121 663 6618
ICO Registration	Registered with the Information Commissioner's Office — Registration number: ZC133741
Data Controller	Maureen Ibelema Iwari-Pollyn (Director)

2. What Personal Data We Collect

From website visitors

• Name and contact details when you submit an enquiry form
• Name, location and review text when you submit a testimonial
• Anonymous usage data via Google Analytics (pages visited, time on site, device type — no personal identification)
• Cookie consent preferences stored in your browser

From prospective and existing clients

• Full name, date of birth, home address
• Health conditions, diagnoses and medical history
• Medication records
• Care needs assessment information
• Emergency contact details (next of kin / family members)
• Financial information only where relevant to care funding

From job applicants and staff

• Name, address, date of birth, National Insurance number
• CV, employment history and references
• DBS certificate and disclosure number
• Right to work documents
• Training records and qualifications

3. How We Use Your Data

Purpose	Data used
Responding to website enquiries	Name, phone, email
Publishing approved testimonials	First name, general location, review text
Providing and managing care services	Client health data, care plans, medication records
Employing and managing staff	Staff personal and employment data
Meeting CQC regulatory requirements	Client and staff records
Improving our website	Anonymous analytics data
Legal compliance and record keeping	All relevant data as required by law

We will never sell your personal data to third parties, use it for unsolicited marketing without your consent, or share it for purposes unrelated to our care services.

4. Our Lawful Basis for Processing

Under UK GDPR Article 6, we must have a lawful basis for every data processing activity. We use the following bases:

Processing Activity	Lawful Basis
Providing care services	Legal obligation + Vital interests
Employment and staff management	Contract + Legal obligation
CQC compliance and reporting	Legal obligation
Website enquiry responses	Legitimate interests
Publishing testimonials	Consent
Analytics (anonymised)	Legitimate interests (with consent for cookies)

5. Special Category (Health) Data

Health data, including care plans, medication records and medical history, is classified as special category data under UK GDPR Article 9 and receives the highest level of legal protection.

We process health data under Article 9(2)(h) — processing necessary for the provision of health or social care — and under the Health and Social Care Act 2008 (CQC Regulation 17).

6. Who We Share Your Data With

We only share personal data where there is a lawful reason to do so. We may share data with:

• NHS and healthcare providers — for continuity of care (e.g. hospital discharge)
• Local authority social services — where care is funded or referred by the local authority
• CQC (Care Quality Commission) — as required for regulatory compliance
• HMRC and legal authorities — where required by law
• Emergency services — in a medical emergency to protect vital interests
• Data processors listed below — under strict data processing agreements

We never share personal data with third parties for marketing purposes without your explicit consent.

7. Data Processors We Use

We use the following third-party services that process data on our behalf. Each is required to handle data only on our instructions and in accordance with UK GDPR.

Processor	Purpose	Data location	Privacy policy
Supabase Inc.	Website database — stores approved testimonials, enquiries, vacancies and blog posts. No client health data stored here.	🇮🇪 EU — West EU (Ireland, eu-west-1). Fully within EEA — no international transfer.	supabase.com/privacy
GoDaddy Inc.	Web hosting — public website files only. No personal data stored in hosting files.	UK / EU	godaddy.com
Vercel Inc.	Admin portal hosting (portal.ecohomescare.co.uk) — login-protected. No client health data.	EU region	vercel.com/legal/privacy-policy
Google LLC	Analytics (anonymised), Google Business Profile, Search Console	EU (UK adequacy decision)	policies.google.com/privacy
OpenRouter / Anthropic PBC	AI chat assistant and care checker — processes enquiry text only. No health data transmitted. Conversations not stored after session.	USA — Standard Contractual Clauses (SCCs) per ICO guidance	openrouter.ai/privacy

If we add new processors in future, this policy will be updated within 30 days.

8. International Data Transfers

Most of our data processing takes place within the EU/EEA, which is covered by UK adequacy decisions:

Where processors are based outside the EEA, we ensure appropriate safeguards:

• Google — covered by the EU-US Data Privacy Framework (UK adequacy decision)
• OpenRouter / Anthropic (USA) — Standard Contractual Clauses (SCCs) as approved by the ICO under Article 46 UK GDPR. Only non-sensitive enquiry text is processed — no health data is ever transmitted to US processors.

We never transfer client health or special category data outside the UK/EEA without explicit consent and full legal safeguards.

9. How Long We Keep Your Data

Data Type	Retention Period
Client care records	Duration of care + 8 years (or until age 25 if a minor)
Staff employment records	7 years after employment ends
DBS disclosure information	Maximum 6 months (DBS Code of Practice)
Website enquiry data	12 months, then securely deleted
Approved testimonials	Until removal is requested
Financial / invoicing records	7 years (HMRC requirement)
Accident / incident records	10 years
Website analytics	26 months (Google Analytics default, anonymised)

10. Your Rights

Under UK GDPR you have the following rights. To exercise any of them, contact us at info@ecohomescare.com. We will respond within one calendar month.

• Right of access — request a copy of all personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your data (subject to legal retention requirements)
• Right to restrict processing — ask us to pause using your data
• Right to data portability — request your data in a machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Rights related to automated decisions — request human review of automated decisions affecting you

There is no charge to exercise any of these rights. We may ask for proof of identity before we can action your request.

11. Cookies

Our website uses cookies. When you first visit, a consent banner asks for your preferences. You can change your choices at any time using the Cookie Settings link in the footer.

Cookie type	Purpose	Consent required
Essential	Keep the website working correctly (session, security, cookie preference memory)	No — strictly necessary
Analytics	Google Analytics 4 — anonymous usage statistics only	Yes — optional

We do not use advertising, tracking or profiling cookies. Analytics data is anonymised — we cannot identify individual visitors from it.

12. AI Features on Our Website

Our website includes two AI-powered features:

AI Care Needs Checker

A 4-step questionnaire that asks general questions (who needs care, the main challenge, urgency, location area) and provides a recommendation to call us. No health data is collected and no data is stored — responses are processed within your browser session only. The AI provides information only, not care decisions.

AI Chat Assistant

This processes the text of questions you type in the chat widget. No special category or health data should be entered into the chat. Conversation text is sent to our AI provider (OpenRouter / Anthropic) under Standard Contractual Clauses. Conversations are not stored after your session ends.

13. Children's Data

Our website is not directed at children under 13. We do not knowingly collect personal data from children through our website. If care is provided to a minor, we follow applicable safeguarding requirements and extended data retention rules under the NHS Records Management Code of Practice.

14. How to Complain

If you have a concern about how we handle your personal data, please contact us first:

• Email: info@ecohomescare.com — subject: "Data Protection Concern"
• Phone: 0121 663 6618
• Post: Ecohomes Care Ltd, Fort Dunlop, Unit 115-119, Fort Parkway, Birmingham B24 9FE

We will respond within 30 calendar days as required by UK GDPR Article 12.

For full details of our complaints process, visit our Data Protection Complaints page.

If you remain unsatisfied, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or call 0303 123 1113.

15. Changes to This Policy

We review and update this Privacy Policy at least annually, or sooner if there are changes to the law or how we process data. We will update the "Last updated" date at the top of this page when changes are made. For significant changes we will notify existing clients directly.