Privacy Policy

Carionex® is a trading name of TradeAlgoSuite Technologies Ltd ("we", "us", "our"), a company registered in England and Wales. This policy explains how we handle personal data when you visit our website, use the Carionex web platform and mobile apps, or contact us. It is written for the care and dental staffing organisations that use Carionex and for the people whose information is held on it.

Trading name

Carionex

Legal entity

TradeAlgoSuite Technologies Ltd

Company number

17162783

ICO registration number

ZC133367

Registered office

128 City Road, London, EC1V 2NX, United Kingdom

Website

www.carionex.co.uk (opens in a new tab)

Privacy enquiries

privacy@carionex.co.uk

TradeAlgoSuite Technologies Ltd is registered with the UK Information Commissioner's Office (ICO) under registration number ZC133367. You can check the register using the ICO registration search (opens in a new tab). ICO registration is a legal requirement for organisations that process personal data. It is not a certification, accreditation or endorsement of our practices by the ICO.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy should be read with our Data Processing Agreement, Cookie Policy, Terms of Service and Security & Compliance page.

The responsibilities we hold depend on whose data is involved and why it is being processed.

Carionex as data controller

TradeAlgoSuite Technologies Ltd is the controller of personal data that we collect and use for our own purposes, including:

• Website enquiries and contact forms.
• Demo registrations, bookings and trial requests.
• Customer account administration and support.
• Billing and subscription management.
• Marketing communications.
• Website analytics and advertising measurement, where you have consented.
• Security monitoring, fraud prevention and running our business.

Carionex as data processor

When a customer organisation (for example a domiciliary care agency, care home operator or dental staffing agency) uses Carionex, it decides why and how the personal data it enters is used. For that data we act as a processor, handling it only on the customer's documented instructions. Examples include:

• Service user profiles and care records, care plans and assessments.
• Medication administration records (eMAR/TAR).
• Visit records and care notes.
• Staff information and employment records.
• Rota and scheduling information, and GPS clock-in and clock-out records.
• Timesheets and payroll information.
• Dental staffing bookings.
• Invoicing and financial records.
• Family portal information.
• Incident and safeguarding documentation.

Customer organisations ordinarily determine the purposes and lawful bases for processing their service users' and staff members' information. Our processing on their behalf is governed by the applicable Data Processing Agreement. If you are a service user, family member or staff member of one of our customers, that organisation is the main point of contact for how your information is used.

The data held on Carionex depends on the features a customer uses and what it chooses to enter. The categories below describe what the platform supports.

Personal identification data

• Names, addresses and contact details.
• Dates of birth.
• Emergency contacts.

Health and care information

This is special category data and is processed by us as a processor for customers.

• Care needs and assessments.
• Medical conditions and allergies.
• Medication records.
• Care plans and visit notes.
• Safeguarding and incident records.

Employment and workforce information

• Staff profiles and contact details.
• Employment and compliance documents.
• Training and qualification records.
• Scheduling and attendance.
• Timesheets and payroll information.
• Bank details and statutory payroll identifiers, such as National Insurance numbers and tax codes.

Location information

• GPS coordinates recorded when staff clock in and clock out.
• Visit verification information derived from those records.

Your device's location permission is a technical control that lets the app access location. It is not, on its own, the lawful basis for the processing (see section 4).

Technical and usage information

• Login and authentication events.
• IP addresses and device and browser information.
• Audit trails and relevant activity logs.

Information we hold as a controller

• Contact details and message content you give us when you enquire, book a demo, register or apply for a role.
• Customer account, subscription and billing details.
• Cookie, analytics and advertising-measurement data, only where you have consented (see section 14).

Where we are the controller

We rely on the following lawful bases under Article 6 of the UK GDPR. Where we rely on legitimate interests, we have considered the impact on individuals and do not rely on them where your rights and freedoms outweigh ours.

Where consent is the lawful basis, you can withdraw it at any time, and doing so will not affect processing that took place before withdrawal.

Where we are the processor

Our customers are responsible for identifying a lawful basis under Article 6 for the personal data they process through Carionex. For special category data such as health information, they must also identify an appropriate condition under Article 9 UK GDPR and, where needed, a condition in Schedule 1 of the Data Protection Act 2018.

GPS clock-in and clock-out records are a customer decision. Because of the imbalance of power between employers and staff, consent is generally not an appropriate basis for monitoring staff location. We do not assume that it is. Customers should instead assess and document the basis that applies to their circumstances, such as the performance of an employment contract, legal and regulatory obligations to evidence care delivery, or legitimate interests, and tell their staff how location data is used.

Our primary production database is hosted by Amazon Web Services (AWS) in London, United Kingdom (region eu-west-2).

This does not mean every category of personal data, backup, log or processing activity stays exclusively in the UK. Other parts of our service rely on third-party infrastructure and tools, including application hosting and content delivery, file storage, email and SMS delivery, payment services and analytics. Some of these providers, or their own subprocessors, may process data outside the UK. See section 12 for how we use third-party providers.

International transfers

Where personal data is transferred outside the UK, we use a mechanism recognised by UK data protection law. Depending on the provider and the data involved, this is one of:

• UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where a US provider is certified to it.
• The ICO's International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

Where required, we also assess the risks of the transfer and apply additional safeguards. You can contact us for more detail on the mechanism that applies to a particular provider.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and disclosure. These include:

• Encryption of data in transit using HTTPS/TLS.
• Encryption of production data at rest, and encryption of backups, provided through our managed hosting infrastructure.
• Additional application-level encryption for particularly sensitive credentials, such as statutory submission credentials.
• Logical separation of each customer organisation's data, enforced by database access policies.
• User authentication, with passwords stored in a protected, non-readable form.
• Optional two-factor authentication.
• Private storage for uploaded documents and files.
• Role-based access controls and permission management (section 7).
• Audit logging of relevant activity (section 7).
• Security monitoring and an incident response process (section 9).
• Confidentiality obligations for people with access to personal data.

Carionex includes controls that help customers manage who can see and change information:

• Role-based permissions that limit what each user can view and do.
• Restricted access to sensitive records, so that information is limited to those who need it.
• User authentication, with optional two-factor authentication.
• Audit logs and activity history for relevant events, such as sign-ins, permission changes and changes to key records.
• Accountability for relevant record changes, by recording who made them and when.

Audit logging covers security-relevant and business-critical events. It does not record every action taken in the system. Customers are responsible for assigning roles appropriately, removing access for people who leave, and reviewing their own audit information.

We use measures intended to protect the availability and integrity of data, including automated database backups, encrypted backups, restoration procedures, disaster recovery arrangements and business continuity measures. We rely on our managed infrastructure providers for much of this.

Detailed backup schedules, recovery point and recovery time objectives, and restoration testing evidence are maintained in our internal security assurance documentation. We do not publish guaranteed backup frequencies or recovery times in this policy. Customers who need this information for due diligence can contact us.

We investigate and assess suspected and confirmed personal data breaches, and take containment and remediation steps to limit harm and prevent recurrence.

• Customer data (we are the processor): we notify the affected customer without undue delay after becoming aware of a personal data breach affecting data we process on its behalf, and give reasonable information and assistance to help it meet its own obligations.
• Our own data (we are the controller): we assess the risk, and report to the ICO within 72 hours of becoming aware where the breach is likely to result in a risk to individuals. We tell affected individuals where there is a high risk.

The customer, as controller, decides whether a breach must be reported to the ICO or communicated to affected individuals, and is responsible for doing so where the law requires it. We support customers in meeting those obligations but do not make that decision for them. Notification terms are set out in the Data Processing Agreement.

How long we keep personal data depends on whether we are the controller or the processor, and on legal requirements, contractual obligations and customer instructions.

Account closure, export and deletion

• Account closure: on termination, and subject to legal retention obligations, we delete or return customer personal data at the customer's choice, as set out in the Data Processing Agreement.
• Export before deletion: customers should export the records they need before closing an account (see section 11).
• Secure deletion requests: send deletion requests to privacy@carionex.co.uk. We may need to verify the request with the customer account holder.
• Backups: deleted data may remain in encrypted backups until those backups expire in the ordinary cycle. It is not restored to live systems except as part of disaster recovery, in which case deletions are re-applied. We do not promise immediate permanent deletion from every backup.
• Legal exceptions: we may keep data we are legally required to keep, or need in order to establish, exercise or defend legal claims.

Customer organisations keep control of their service user and staff records. We do not acquire ownership of customer records because they are stored on Carionex, and we process them only as set out in the applicable agreement and the Data Processing Agreement.

• Export: the platform provides export and reporting functions for many types of record, including commonly used file formats such as CSV. The formats and completeness of exports vary by module, so customers should check that their needs are covered before they close an account.
• Offboarding: when a customer leaves, we support the return of its data in a reasonable, commonly used format on request, and then delete it as described in section 10.

To plan an export or offboarding, contact privacy@carionex.co.uk.

Carionex uses established cloud infrastructure and technology service providers to securely deliver, maintain and operate our platform.

Our primary production database is hosted in the United Kingdom within the Amazon Web Services (AWS) London region (eu-west-2).

We work with authorised third-party service providers for application delivery, infrastructure management, communications, security and other essential operational services.

Where personal data is processed or transferred outside the United Kingdom, appropriate safeguards are applied in accordance with applicable UK data protection legislation.

Further details of our subprocessors, their processing activities and applicable data protection arrangements are available to customers as part of our supplier due diligence documentation. Customers can request it by emailing privacy@carionex.co.uk.

Recipients you instruct

When a customer uses statutory features, such as payroll submissions to HMRC or pension contribution submissions to a pension provider, data is sent to those bodies on the customer's instruction. They process it as independent controllers under their own privacy notices.

Under the UK GDPR, you have the following rights, where they apply:

• The right to be informed about how your data is used.
• The right of access to the personal data we hold about you.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure, in certain circumstances.
• The right to restrict processing, in certain circumstances.
• The right to data portability, for data you provided that we process by consent or contract.
• The right to object, including to direct marketing at any time.
• Rights relating to solely automated decision-making that has legal or similarly significant effects. We do not make decisions of that kind as a controller. Features in the platform that assist customers, such as document checking, are designed to support rather than replace human review by the customer.

Requests about customer-controlled records. If your request concerns care or staff records held on Carionex for one of our customers, that customer is the controller. We will normally refer your request to them, or handle it in coordination with them, rather than responding ourselves. It helps if you tell us which organisation you deal with.

To exercise a right over data for which we are the controller, email privacy@carionex.co.uk. We aim to respond within one month and may need to verify your identity first.

Our website and platform use cookies and similar technologies. Our Cookie Policy lists them in detail. In summary:

• Essential cookies keep you signed in and protect the platform. They do not require consent.
• Functional cookies remember choices such as your preferences.
• Analytics cookies help us understand how the website is used. They are set only with your consent.
• Advertising and conversion measurement is used only with your consent. It lets us measure which advertising leads to enquiries.

Consent and managing your choices

We use Google Consent Mode v2. Until you choose, analytics and advertising storage is denied. You can review or change your choices at any time, and withdrawing consent stops the cookies being used.

Advertising measurement

When you register for a demo, book a demonstration, contact us or sign up, we record that conversion on our servers so we can tell genuine enquiries and customers from ordinary page visits. Where you have accepted marketing cookies, we also store the campaign details and the advertising click identifier from the advert you clicked, linked to a random reference rather than your name, and we may send the conversion outcome to advertising platforms so campaigns can be measured. For some conversions this includes contact details, which are hashed before they are sent. We do not send names, email addresses or phone numbers to Google Analytics as event parameters. Attribution data is kept for up to 24 months and then deleted or anonymised.

Marketing communications

We send marketing emails only where permitted by law. Every marketing email includes an unsubscribe option, and you can also ask us to stop at privacy@carionex.co.uk. Opting out of marketing does not stop service and security messages that we need to send to run your account.

Our Security & Compliance page sets out our current position. The table distinguishes between independently assessed certifications, self-assessed submissions and registrations.

We do not currently hold ISO 27001 certification or Cyber Essentials Plus certification, and we do not describe ourselves as doing so. Our security measures and commitments in this policy are our own and are not independently audited unless stated above.

We review this policy periodically and update it when our services, our subprocessors or the law change. The effective date shows when this policy first took effect and does not change when we revise it. The last-updated date shows when the current version was published.

We will tell customers about material changes by email or through the platform before they take effect where practicable.

For privacy and data protection enquiries, or to exercise your rights, contact:

Complaints

If you have a concern about how we handle personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint (opens in a new tab) or by calling 0303 123 1113. If your concern is about a care or staffing organisation's use of your information, you can raise it with that organisation, which is the controller.