Privacy notice

Who we are

One Place Care is run by Arron & Partners Ltd. Email us at arron@arronpartners.co.uk about anything on this page.

Two different roles

One Place Care is software that care providers use to run their service. We have two roles, and they are treated differently.

• For the records a care provider keeps in the system (its staff, the people it supports, care notes, rotas, training, incidents and so on), the care provider decides what is kept and why. It is the "controller". We are only its "processor": we store and handle the records on its instructions, and we do not use them for our own purposes. If your information is in a care provider's system, your first contact is that care provider, and its own privacy notice applies.
• For information about people who visit this website, ask about the product, or have a sign-in account, we decide how it is used. We are the controller and this notice covers it.

What we hold when you visit, ask about us or sign in

• What you tell us when you email us or book a demo: your name, work email, organisation and what you asked.
• Your sign-in account: your name, email address and the organisation you belong to, a protected form of your password (we cannot read it), and, if you use two-step sign-in, the details your authenticator app needs.
• Sign-in and security records: when you signed in and from where (the usual technical details a website receives), and a record of who opened sensitive documents.
• Billing details for subscriptions: the contact for the account. Card details go straight to our payment supplier and are not kept by us.

We use only the cookies and browser storage the service needs to work, such as keeping you signed in and letting the app work when there is no signal. We do not use advertising or tracking cookies.

Why we use it, and our legal reasons

• To run your account and give you the service you asked for (contract).
• To keep the service secure, prevent misuse and fix faults (our legitimate interest in running a safe service).
• To reply to your questions and arrange demonstrations (our legitimate interest, or steps you asked for before a contract).
• To keep accounts and tax records and meet other legal duties (legal obligation).

We do not sell personal information. We do not use anything in a care provider's records to train artificial intelligence.

Who else handles it for us

We use a small number of suppliers to run the service. They handle information only to do the job below.

• Supabase: Hosts the database, sign-in (including two-step sign-in) and the private file storage for every record in the system.
• Anthropic (Claude): Reads uploaded training certificates and new starter documents (PDFs and photos) to suggest dates and details that a manager then checks; and, only if the organisation switches it on, reads an old care plan a manager uploads to draft the new care plan for them to check (this document contains health information, so confirm the supplier's data processing terms and your transfer safeguards first); and, only if the organisation switches on the tidy-up for voice notes, tidies the wording of a dictated note (the text of the note, never the person's name); powers the in-app study assistant.
• Resend: Sends email: password and invite emails (through Supabase), weekly reminders and short alerts.
• Stripe: Takes subscription payments.
• Vercel: Runs the One Place Care website and web application.

Some suppliers may handle information outside the UK. Where they do, we rely on the legal safeguards the law provides for that, such as the UK's approved contract terms. We also share information when the law requires it.

How long we keep it

Account information is kept while the account is open and for a short period after, so that we can deal with questions or disputes. Records held for a care provider are kept for as long as that provider chooses, using the keep-for periods it sets in the system, and are returned or deleted when its subscription ends. Accounts and tax records are kept for the period the law requires.

Security

Each company's records are kept apart from every other company's. Managers sign in with two steps. Information is encrypted while it travels and when it is stored. Opening or downloading sensitive records is logged. If something goes wrong with personal information, we will tell the care providers affected without delay, and the ICO where the law requires it.

Your rights

You can ask to see the information we hold about you, have mistakes corrected, have information deleted or limited in some cases, object to some uses, and ask for a copy you can move elsewhere. Email us and we will reply within one month. If your information is in a care provider's records, we will pass your request to that provider, who decides it.

If you are unhappy with how we handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put things right first.

Changes

If we change this notice in a way that matters, we will say so on this page and update the date at the top.