Privacy Policy

1. Introduction

Welcome to the privacy policy of PsycheMeta Ltd ("we", "us", or "our"), a company registered in England and Wales (Company Number: 16586115). Our registered office is at F23, 18 Foregate Street, Worcester, WR1 1DN.

This privacy policy explains how we collect, use, store, and protect your personal data when you use our website (www.homecareos.co.uk), our software platform, and any related services (collectively, the "Service").

We are committed to protecting your privacy and ensuring that your personal data is handled in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other applicable data protection legislation.

2. Information We Collect

2.1 Personal Information You Provide

When you register for an account, request a demo, or contact us, we may collect:

Full name and job title
Email address and telephone number
Company or organisation name
Billing address and payment details (processed securely via our payment provider)
Any other information you choose to provide in correspondence with us

2.2 Usage Data

When you use our Service, we automatically collect certain technical information, including:

Browser type and version
Operating system
IP address and approximate location
Pages visited, time spent on pages, and navigation paths
Referring website or source
Device type and screen resolution

2.3 Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyse usage patterns, and deliver relevant content. For full details, please see Section 8 (Cookies) below.

2.4 Data Collected via the HomecareOS Carer Mobile App

The HomecareOS Carer app (iOS and Android) is provided to care workers by their employing agency for use in the course of their employment. When you use the app, we collect:

Identity & contact data:name, email address, phone number, employment role (linked to your agency's staff record)
Precise location:GPS coordinates captured only at the moment of visit check-in and check-out, and when the app is used for mileage tracking between visits. Location is used solely to verify visit attendance and to calculate mileage reimbursement. It is not tracked continuously, sold, shared with advertisers, or used for any advertising or profiling purpose.
Camera & photo library:photos you choose to capture or attach to care notes, body maps, and incident reports. Photos are stored within your agency's tenant only and are never used for facial recognition, advertising, or shared with third parties.
Biometric authentication (Face ID / Touch ID):used only to unlock the app on your device. Biometric data never leaves your device and is never transmitted to our servers. We only receive a yes/no signal that authentication succeeded.
Push notification tokens:to deliver shift reminders, messages from coordinators, and urgent visit updates. Tokens are tied to your app install and are removed when you uninstall or log out.
Care records you enter:check-in/out times, care notes, medication administration records, observations, goals, and tasks. This data is held on behalf of your employing agency as the Data Controller.
Device & diagnostic data:device type, operating system version, app version, and crash logs. Used to diagnose technical issues and improve reliability. Not used for advertising or profiling.

The mobile app does not collect contacts, browsing history, health and fitness data from HealthKit/Google Fit, SMS/call logs, microphone audio, financial or payment information, or any advertising identifiers (IDFA/AAID). The app contains no third-party advertising SDKs and no third-party analytics SDKs beyond Expo/Sentry for crash diagnostics.

2.5 Controller / Processor Relationship (Mobile App)

When a care worker uses the HomecareOS Carer mobile app in the course of their employment, the employing care agency is the Data Controller for all care records, service user data, and visit information. PsycheMeta Ltd acts as the Data Processor under a written Data Processing Agreement with each agency, processing data strictly in accordance with the agency's documented instructions. For questions about how your agency uses the data you enter in the app, contact your agency's Data Protection Lead.

3. How We Use Your Information

We use the personal data we collect for the following purposes:

Providing and improving our Service:to operate, maintain, and enhance the HomecareOS platform and related features
Communication:to respond to your enquiries, send service updates, and provide customer support
Processing transactions:to manage subscriptions, billing, and payments
Analytics and personalisation:to understand how our Service is used and to improve user experience
Marketing:to send you information about our products and services, where you have opted in to receive such communications
Legal compliance:to comply with our legal obligations, resolve disputes, and enforce our agreements
Security:to detect, prevent, and address fraud, abuse, and technical issues

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

Consent:where you have given clear consent for us to process your personal data for a specific purpose (e.g. marketing communications)
Contractual necessity:where processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract
Legitimate interests:where processing is necessary for our legitimate business interests (e.g. improving our Service, fraud prevention), provided these are not overridden by your rights and interests
Legal obligation:where processing is necessary to comply with a legal obligation to which we are subject

We do not sell, rent, or trade your personal data to third parties. We may share your data in the following limited circumstances:

Service providers:trusted third-party companies that assist us in operating our Service (e.g. hosting providers, payment processors, email delivery services). These providers are contractually bound to protect your data and use it only for the purposes we specify.
Legal requirements:where we are required to disclose your data by law, regulation, legal process, or governmental request
Business transfers:in connection with a merger, acquisition, reorganisation, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change.
With your consent:we may share your data with other third parties where you have given us explicit consent to do so

Where your data is held

The HomecareOS database and uploaded files are stored in Ireland, on Amazon Web Services, through our database provider Supabase. The HomecareOS application's server functions run in Dublin, provided by Vercel. Some features rely on specialist service providers: Anthropic and OpenAI for AI features, including transcribing voicemails and recorded care-planning conversations (we keep the written transcript, not the audio); Twilio for phone calls, voicemail recordings and text messages; Resend for email delivery; Mapbox for maps and address lookup; Stripe for payments; Sentry for error monitoring; and Expo, Apple and Google for delivering notifications to phones and browsers, which can include a client's name and address in a visit reminder. Some of these providers process data outside the UK and the EU, including in the United States.

The HomecareOS web app and carer app do not use Google Analytics, so the pages you use and the records you open there are not reported to Google Analytics. Google Analytics and Google Ads conversion tracking run on this marketing website, as described in Section 8. Creating an account happens in the application. This website does not send the sign-up conversion. It only passes the advert click identifier through to the sign-up page so the application can match a completed registration to the advert.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

Account data:retained for the duration of your account and for up to 12 months after account closure
Transaction data:retained for up to 7 years to comply with financial and tax regulations
Marketing data:retained until you unsubscribe or withdraw consent
Usage data:typically retained for up to 26 months

When your data is no longer required, we will securely delete or anonymise it in accordance with our data retention policies.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access:you can request a copy of the personal data we hold about you
Right to rectification:you can request that we correct any inaccurate or incomplete personal data
Right to erasure:you can request that we delete your personal data, subject to certain conditions
Right to data portability:you can request that we provide your data in a structured, commonly used, and machine-readable format
Right to restrict processing:you can request that we limit the processing of your personal data in certain circumstances
Right to object:you can object to the processing of your personal data based on legitimate interests or direct marketing
Right to withdraw consent:where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 13 below. We will respond to your request within one month, as required by law.

8. Cookies

Our website uses cookies to distinguish you from other users and to provide a better browsing experience. Cookies are small text files placed on your device by your web browser.

8.1 Types of Cookies We Use

Strictly necessary cookies:essential for the operation of our website (e.g. session management, security). These cannot be disabled.
Analytics cookies:help us understand how visitors interact with our website by collecting anonymised usage data (e.g. Google Analytics, Microsoft Clarity, Metricool)
Functional cookies:remember your preferences and settings to provide a more personalised experience
Marketing cookies:Google Ads conversion cookies, used to measure whether a click on one of our adverts led to a demo booking or a message sent through the contact form. They are set only after you accept.

8.2 Our Consent Banner

When you first visit our website, a consent banner appears at the bottom of the screen asking whether you would like to accept or reject non-essential cookies (analytics and advertising). Your decision is stored in your browser's local storage so we don't ask again on subsequent visits. You can change it on any page. By default, advertising and analytics storage are denied until you explicitly accept. That covers Google's Consent Mode signals for ad storage, ad user data, ad personalisation and analytics storage.

We use Google Analytics 4 and Google Ads conversion tracking (Google tag AW-18012658601) with Consent Mode v2. If you reject, we do not set analytics or advertising cookies. Google may still receive anonymised, cookieless pings for statistical modelling, which cannot be linked back to you. A demo booking on the booking page, or a contact form that is successfully sent, is measured as a demo-request conversion. Opening the page, or clicking the button before the form succeeds, is not.

If you arrive from a Google advert, the address can include a click identifier (gclid) and campaign parameters (UTM parameters). We add those parameters to links you follow on this site, and to the "Get started" link that opens the application at app.homecareos.co.uk, so a later sign-up can be matched to the advert. We do not store that identifier in a cookie. The sign-up conversion itself is recorded in the application when registration is completed, not on this website.

We also use Microsoft Clarity and Metricool to understand how our website is used, for example, aggregated usage statistics and heatmaps. These are loaded only after you accept analytics cookies; if you reject, they do not run and collect nothing. You can read Microsoft's privacy statement at privacy.microsoft.com.

8.3 Changing Your Mind

You can change your cookie preferences at any time by clicking . This will reopen the banner so you can accept or reject. Alternatively, most browsers allow you to refuse or delete cookies directly. Consult your browser's help documentation for instructions. Disabling certain cookies may affect the functionality of our website.

8.4 The Homecare Heroes Page

Our Homecare Heroes concept page at homecareos-hero-concept.vercel.app/heroes is hosted separately from this website and has its own cookie banner. It uses Google Analytics 4 with Consent Mode v2, and loads it only after you press Accept all. Advertising signals are always denied on that page. Your choice is stored in your browser's local storage (under the name hcos_cookie_consent), and you can change it at any time using the Cookie settings link at the bottom of the page. Because the page is on a different address, a choice you make on homecareos.co.uk does not carry over to it, and you will be asked again.

If you accept, we measure only anonymous events:

which chapters of the page you reach
whether you turn the sound on or off
the number of carers you try in the price calculator
clicks on the book-a-call, get started and Speak to the creator buttons

We do not send your name, email address or any other personal data from that page to Google Analytics.

9. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

Encryption of data in transit (TLS) and at rest (AES-256) in our database and file storage
Care records and uploaded files stored in Ireland, in Amazon Web Services data centres used by our database provider Supabase, with the HomecareOS application's server functions running in Dublin
Row-level security on every database table, limiting each user to their own agency's records
Office screens and menus that follow each person's role
Internal security reviews, with issues fixed and checked against the live system

We do not yet hold a security certification of our own, such as Cyber Essentials or ISO 27001, and we have not yet commissioned an independent penetration test. Our security page explains what is and is not in place.

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to maintaining the highest standards of data protection.

10. Children's Privacy

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information as soon as possible. If you believe we may have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Update the "Last updated" date at the top of this policy
Notify you via email (if you have an account with us) or by placing a prominent notice on our website
Where required by law, seek your consent to any material changes in how we process your personal data

We encourage you to review this policy periodically to stay informed about how we protect your data.

12. Mobile App Account & Data Deletion

This section explains how to request deletion of your account and associated personal data from the HomecareOS mobile application, in accordance with Apple App Store and Google Play Store requirements.

12.1 Your Right to Delete

You have the right to request deletion of your account and personal data at any time. We offer two routes:

In-app deletion:open the Carer app, go to Profile → Settings → Delete my account, and confirm. Your deletion request will be submitted immediately.
Web deletion:visit www.homecareos.co.uk/account/delete and submit the form with your registered email address. You will receive a confirmation email within 24 hours.

12.2 What Gets Deleted

Within 30 days of a verified deletion request, we will permanently delete or irreversibly anonymise the following data:

Your user profile (name, email, phone, avatar, biometric enrolment)
Your authentication credentials and session tokens
Your push notification tokens and device registrations
Personal preferences, availability, leave records, mileage claims submitted in your name
Messages and conversations where you were a participant (content may be preserved for other participants in accordance with their retention rights)

12.3 What We Must Retain

UK law (Health and Social Care Act 2008, CQC fundamental standards, and equivalent regulations in Wales, Scotland, and Northern Ireland) requires care records to be retained for up to 8 years (or until a child service user's 25th birthday, whichever is longer). This includes:

Care notes, medication administration records, and body map entries you authored
Visit check-in/out timestamps and GPS verification events
Incident reports and safeguarding records
Financial and employment records retained for HMRC purposes (up to 7 years)

Where retention is legally required, records you authored will be anonymised or pseudonymised so that they no longer identify you personally. Your name will be replaced with an opaque identifier, and your contact details will be removed. This satisfies UK GDPR Article 17(3)(b) (retention for legal obligation) while honouring your deletion request to the maximum extent possible.

12.4 Timeline

Within 24 hours:confirmation of your request
Within 30 days:personal profile data deleted; care records anonymised
After 8 years:retained care records fully deleted from archival storage

12.5 Agency Employees: Important

If you are a care worker currently employed by an agency that uses HomecareOS, your account is provisioned and managed by your employer. You may still request deletion of your personal data using the routes above, but note:

Deleting your account will end your ability to use the app for work
Your employing agency will be notified so they can provision an alternative record-keeping method
Care records you authored will be anonymised but not removed from the agency's care-record system, as the agency is the legal Data Controller for those records

If you are leaving employment, your agency will normally trigger deletion of your account within a reasonable period after your end date. You may request an expedited deletion at any time.

13. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our data protection practices, please contact our Data Protection Officer:

Data Protection Officer | PsycheMeta Ltd
Email: privacy@homecareos.co.uk
Post: Data Protection Officer, PsycheMeta Ltd, F23, 18 Foregate Street, Worcester, WR1 1DN
Phone: 01905 674704

If you are not satisfied with our response to your enquiry or believe that we are processing your personal data in a way that is not compliant with UK data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF