GDPR and data protection
UK GDPR-Ready Care Management Software
Protect sensitive care information with secure, UK-hosted production database infrastructure, role-based access controls, audit trails and documented data protection practices. Carionex helps care providers manage their information governance responsibilities with confidence.
Using Carionex does not by itself make an organisation compliant with data protection law. Each customer remains responsible for its own processing.
Verified credentials
The NHS Data Security and Protection Toolkit is a published self-assessment. Credentials are held by TradeAlgoSuite Technologies Ltd.
Who is responsible for what
Customer care organisations ordinarily act as controllers for their service user records. Carionex generally acts as processor for customer-managed information, and as controller only for certain direct business activities. See the Privacy Policy and the Data Processing Agreement.
Controller
Customer care organisations
- Decide why and how service user and staff records are used.
- Establish the lawful basis and, for health data, the UK GDPR Article 9 condition.
- Respond to data subject requests and decide how long records are kept.
Processor
Carionex for customer-managed records
- Processes customer records only on the customer's documented instructions.
- Acts under the Article 28 terms in the Data Processing Agreement.
- Passes any request it receives from an individual to the customer.
Controller
Carionex for its own business
- Account administration, billing and customer support.
- Website, enquiries and marketing.
- Security of the platform and our legal obligations.
Protecting Sensitive Care and Health Information
Carionex supports the secure handling of the records care providers depend on every day.
Records we help you protect
- Children's and young people's care records
- Care plans and risk assessments
- Medication administration records
- Safeguarding documentation
- Staff records and compliance information
- Visit notes and care observations
How the platform supports that
- Role-based permissions limit what each user can view and change.
- Audit logs record relevant sign-ins, permission changes and changes to key records.
- Each customer organisation's data is logically separated by database access policies.
- Uploaded documents and files are held in private storage.
- Data is encrypted in transit and at rest, with an extra application-level layer for particularly sensitive credentials.
- Optional two-factor authentication is available for user accounts.
Customer controllers remain responsible for establishing an appropriate lawful basis and an Article 9 condition for the health and other special category data they record, for informing the people concerned, and for deciding who in their organisation has access.
Security and encryption
What is encrypted, and where. We describe each connection separately because not every external channel is configured identically.
- Primary production database
- Encrypted at rest with AES-256. Backups held by the database provider are encrypted.
- Connections to the platform
- HTTPS is enforced. Connections to the service, and between the service and the primary production database, use TLS 1.3 where the client supports it.
- Uploaded documents and files
- Held in private storage, so they are not publicly addressable.
- Statutory submission credentials
- Additionally encrypted at application level before they are stored.
- Third-party services
- Email, SMS, payment and similar providers use TLS at the version each provider supports. We do not claim identical encryption settings for every external integration.
Because the platform must process data to provide its services, it is not end-to-end encrypted. No system can be made completely secure. Further detail is on our Security & Compliance page.
Data hosting and residency
Carionex's primary production database is hosted in the Amazon Web Services London region (eu-west-2), United Kingdom. Supporting infrastructure and authorised subprocessors may process certain information in other locations, subject to applicable data protection requirements and international transfer safeguards.
- Other parts of the service, such as application hosting, file storage, email and SMS delivery and payment services, rely on third-party providers whose own subprocessors may be outside the UK.
- Where personal data leaves the UK we rely on a mechanism recognised by UK law, such as UK adequacy regulations, the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
- The full Subprocessor Register is available on request from privacy@carionex.co.uk.
Personal data breaches
Controllers decide whether a breach is reportable. We make sure customers hear about one quickly enough to do so.
Customer as controller
The controller must assess whether a breach is likely to result in a risk to individuals. Where it is, the controller must notify the ICO within 72 hours of becoming aware, where feasible, and tell affected individuals where the risk is high.
Carionex as processor
We notify the affected customer without undue delay after becoming aware of a personal data breach affecting its data, with the information and assistance it reasonably needs to meet its own obligations.
Notification terms are in clause 9 of the Data Processing Agreement, and our approach is summarised in the Privacy Policy.
Supporting data subject rights
Requests about customer-managed records go to the customer as controller, and we assist them. This is what the platform supports today.
- Access
- Authorised users can search and view records, and produce reports and exports for many record types. There is no single one-click export of everything held about one person, so for a subject access request we assist the customer on request.
- Rectification
- Authorised users can correct records in the platform, and audit logs show who changed key records and when.
- Erasure
- Authorised users can delete records. Removing a staff member starts a 14-day grace period, after which their personal identifiers are anonymised automatically while payroll and audit records are preserved. The customer decides what must be retained by law.
- Restriction
- There is no dedicated processing-restriction flag. Customers can limit who sees a record using role-based permissions, and we apply restrictions on the customer's documented instruction.
- Portability
- CSV and report exports are available for many modules, but formats and completeness vary by module. Where a format is not built in, we provide a commonly used, machine-readable export and confirm the format in writing.
- Customer offboarding
- On termination the customer has 30 days to export its data. We then delete it from live production systems within 30 days, and backup copies roll off on a limited rolling period. See clause 12 of the DPA.
Backup and disaster recovery
Carionex maintains documented backup and recovery arrangements, including automated and encrypted database backups and restoration procedures, supported by our managed infrastructure providers. Detailed schedules and recovery objectives are held in our internal assurance documentation and are available for supplier due diligence on request. Read more on the Security & Compliance page.
Agreements and documentation
- View Data Processing Agreement
Article 28 terms, subprocessors and transfers
- Privacy Policy
How we handle personal data
- Terms of Service
The agreement for using Carionex
- Security & Compliance
Certifications and verification links
- Download DPA (PDF)
The current approved version
Viewing or downloading the published DPA does not by itself create a contract. We can issue a controlled copy, the Subprocessor Register and our Supplier Security and Compliance Assurance Pack on request.
Frequently asked questions
Is Carionex GDPR compliant?
Compliance with the UK GDPR is an obligation on each organisation for its own processing, so no software can make a customer compliant by itself. Carionex acts as processor under an Article 28 Data Processing Agreement, maintains documented technical and organisational measures, and is registered with the ICO (ZC133367). Customers remain responsible for their lawful basis, transparency and record keeping.
Where is Carionex's production database hosted?
The primary production database is hosted by Amazon Web Services in London, United Kingdom (eu-west-2). Supporting infrastructure and authorised subprocessors, such as application hosting, file storage, email and SMS delivery, may process certain information in other locations, subject to international transfer safeguards. The full Subprocessor Register is available on request.
Who owns service user records?
The customer. Care organisations keep control of their service user and staff records, and Carionex does not acquire ownership of them by storing them. We process them only as set out in the customer agreement and the DPA.
Does Carionex provide a DPA?
Yes. Our Data Processing Agreement under Article 28 of the UK GDPR is published on this website, together with the subprocessor terms, security measures and international transfer terms. We can issue a controlled copy for your organisation on request.
How does Carionex protect sensitive health information?
Through role-based access controls, audit logging, logical separation of each customer's data, private file storage, and encryption in transit and at rest, with optional two-factor authentication. The customer, as controller, remains responsible for identifying its lawful basis and Article 9 condition for health data.
Can customers export their records?
Yes, with limits we state openly. CSV, report and document exports are available for many record types, but formats and completeness vary by module. Where a format is not built in, we provide a commonly used, machine-readable export on request and confirm the format in writing.
What happens to data when a customer leaves?
The customer has 30 days after termination to export its data. We then delete it from live production systems within 30 days, or earlier on written request, unless the law requires it to be kept. Copies in backups roll off on a limited rolling period and are not removed immediately. See clause 12 of the DPA.
What independent security assurance does Carionex hold?
TradeAlgoSuite Technologies Ltd holds Cyber Essentials certification, and has published an NHS Data Security and Protection Toolkit assessment with Standards Met for 2025/26. The Toolkit is a self-assessment published on the NHS website. We do not currently hold ISO 27001 or Cyber Essentials Plus. Verification links are on our Security and Compliance page.
Completing supplier due diligence?
Our Data Protection Contact can send the Supplier Security and Compliance Assurance Pack, the Subprocessor Register and a controlled copy of the DPA for your organisation.
Data Protection Contact, TradeAlgoSuite Technologies Ltdprivacy@carionex.co.uk
Company number 17162783. ICO registration ZC133367.