Privacy Policy

1. Who we are

Data Controller: Holuvantage Ltd

Trading as: Hocare

Registered address: England & Wales

Contact: info@holuvantage.com

Holuvantage Ltd is the data controller for data relating to its own users and prospects. Where Hocare is used by a subscribing care organisation to process data about their staff, clients and service users, the subscribing organisation is the data controller and Holuvantage Ltd acts as a data processor under a separate Data Processing Agreement.

2. What data we collect

We collect the following categories of personal data depending on your role:

Category	Examples	Who it relates to
Account data	Name, email address, role, organisation	Staff, administrators
Authentication data	Hashed passwords, session tokens, OTP codes	All authenticated users
Location data	GPS coordinates at time of care visit clock-in	Care workers
Care records	Care plans, visit logs, medication records, incident reports	Care clients / service users
Special category data	Health conditions, medication, safeguarding information	Care clients / service users
Family portal data	Next-of-kin name, email, messages to care team	Family members
Video data	Recorded care visit check-ins, incident video evidence	Care workers, family members
Usage data	Pages visited, features used, timestamps	All users
Payment data	Subscription tier, billing contact (payment card handled by third-party processor)	Subscribing organisations

3. Legal basis for processing

We process personal data on the following legal bases:

• Contract performance — to provide the Hocare platform to subscribing organisations and their users
• Legitimate interests — to improve the platform, detect fraud, ensure security, and communicate service updates
• Legal obligation — where required by law, including retention of financial records
• Consent — where specifically requested, such as optional marketing communications
• Vital interests / explicit consent — for special category health data processed in connection with care delivery

4. How we use your data

• To create and manage your Hocare account
• To provide GPS-verified visit tracking, eMAR, incident reporting and other platform features
• To generate AI-assisted care note summaries and risk flags (data processed but never retained for training)
• To send system notifications, expiry alerts and service communications
• To process subscription payments through our payment processor
• To maintain audit trails required for CQC inspection
• To ensure platform security, detect abuse and prevent fraud
• To comply with our legal obligations

5. Data storage and retention

All personal data is stored on servers located within the United Kingdom and European Union. No data is transferred outside of the UK/EU without appropriate safeguards.

We retain personal data for the following periods:

Data type	Retention period	Reason
Account data	Duration of subscription + 12 months	Support and dispute resolution
Care records and visit logs	7 years from date of record	CQC compliance and legal obligation
Medication administration records	7 years from date of administration	Regulatory requirement
Incident reports	7 years from date of incident	Legal and regulatory obligation
Safeguarding records	10 years from date of record	Regulatory obligation
Video recordings	90 days unless flagged for evidence	Storage efficiency; longer retention on request
Financial records	6 years	HMRC legal requirement

6. Who we share data with

We do not sell personal data. We share data only where necessary:

• Within your organisation — staff and administrators within the same subscribing care organisation according to their access level
• Family portal users — next-of-kin see only data relating to their specified relative
• Payment processor — subscription billing data processed by a PCI-DSS Level 1 certified provider. We do not store payment card details.
• Cloud infrastructure — data is hosted on enterprise-grade, UK/EU-based cloud infrastructure under strict data processing agreements
• AI services — care note text is processed by an AI provider solely to generate summaries. No data is retained by the AI provider or used for model training
• Regulators and law enforcement — where legally required

7. Your rights

Under UK GDPR, you have the following rights:

• Right of access — to obtain a copy of personal data we hold about you
• Right to rectification — to have inaccurate data corrected
• Right to erasure — to have data deleted where there is no legal basis to retain it
• Right to restrict processing — to limit how we use your data in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to processing based on legitimate interests
• Rights related to automated decision-making — we do not make solely automated decisions with legal or significant effects

To exercise any of these rights, contact us at info@holuvantage.com. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies

Hocare uses essential cookies required for authentication and session management. We do not use advertising cookies or third-party tracking cookies. For full details, see our Cookie Policy.

9. Children's data

Where Hocare is used to manage school run services, personal data relating to children (names, school details, collection records) may be processed under the lawful authority of the subscribing care organisation. We do not knowingly collect personal data from children directly through the platform interface.

10. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption at rest and in transit, row-level access controls, regular security reviews, and staff access restrictions based on role.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to subscribing organisations by email at least 30 days before taking effect. The current version is always available at hocare.holuvantage.com/privacy.