Security and data protection for care records
homecareOS handles some of the most sensitive data there is: the health records of the people your carers look after. This page sets out plainly how that data is protected today, where it is held, and what we have not yet put in place.
How your data is protected
Every database table has row-level security tied to the signed-in user's agency, and data is encrypted in transit and at rest on our servers.
Row-level security on every database table, limiting each user to their own agency's records
Connections use TLS, and our database and file storage are encrypted at rest (AES-256)
Carers see only the clients they visit, and family logins only their own relative, enforced in the database
Office menus and screens follow each person's role
Documents, visit photos and signatures kept private to your agency; profile photos and logos use public links
Offline copies on carers' phones rely on the phone's own encryption, so carers should use a screen lock
Where it runs, and what is not certified yet
homecareOS runs on Supabase and Vercel, whose infrastructure is independently audited. Their certificates cover those providers, not homecareOS itself, and we do not yet hold a certification of our own.
Care records and uploaded files stored in Ireland on Amazon Web Services, through Supabase
Application server functions run in Dublin, provided by Vercel
Supabase and Vercel both hold ISO 27001 certification and SOC 2 Type 2 reports
Database backed up automatically every day
Not yet certified to Cyber Essentials or ISO 27001, and no independent penetration test yet
Security issues found in our own reviews are fixed and checked against the live system
Your data protection obligations
Your agency is the data controller for its care records, and PsycheMeta Ltd, the company behind homecareOS, processes them on your behalf. Our privacy policy sets out who else processes data, where it is held and how to exercise data rights.
PsycheMeta Ltd is registered with the Information Commissioner's Office (ZC101853)
Our privacy policy names the service providers that process your data, including those in the United States
Agency staff cannot edit or delete medication records
Corrections to a carer's care note keep the reason and the original wording
Care plan, MAR and risk assessment PDFs and report CSVs to help you answer a subject access request
Support staff must give a reason to open your account, and past sessions show in your Support Access Log
Questions from your DPO or commissioner?
We are happy to walk your data protection officer, IT team or commissioner through how homecareOS protects care data, and to share what we can.