Data handling and privacy limitations
This is a description of application behaviour, not reviewed legal terms, a DPA, a certification or a complete deployment-specific privacy notice. The operator must supply and review those documents before onboarding real personal data.
What is stored
Accounts, home access, invitations, uploaded source documents, policy revisions and Git history, questions, answers, source references, management actions and reports may be stored. Authorised managers can inspect home activity. The assistant is not a confidential safeguarding or incident-reporting service.
The public interest form stores submitted contact details and free text locally. It does not automatically email the submitted address or send leads to an email provider. Keyed digests support short-lived abuse limits and daily duplicate suppression. Abuse buckets older than a day are removed on subsequent submissions.
What can leave the application
When a live AI service is configured, the provider processes request content and relevant tool results, including policy excerpts. Automated redaction is a risk-reduction measure, not a guarantee that every identifier is removed or a narrative is anonymous. Do not submit unnecessary resident, health, staff or safeguarding information.
Questions and your home's approved policy text are treated differently on purpose. In a question, names, contact details, NHS numbers and calendar dates are replaced before the request leaves. Approved published policy is sent as stored: it is your home's own instruction, including names, addresses, schedules and dates written in that document. Do not publish resident records as policy. Detection on questions is not guaranteed and is not anonymisation.
External regulatory feeds may be contacted by monitoring tasks. Account email delivery depends on the operator's configured email backend. Hosting providers and administrators may process stored data. The operator must identify actual processors, regions, access arrangements and international transfers.
The marketing page loads its typography through a Google Fonts stylesheet and font files, making browser requests to Google. It does not load third-party executable JavaScript. Local font fallbacks are used if those fonts are unavailable.
Retention and deletion
No universal retention period or complete automated customer-erasure process is established by this page. Deleting an account or changing a policy does not remove every copy from query records, source archives, Git history, reports or backups. The operator must agree retention by record type, lawful holds, exports, deletion procedures and backup expiry.
Before real use
Obtain the deployment's verified controller and privacy contact, purposes and lawful basis, applicable rights and request process, processor/subprocessor terms, hosting and processing locations, retention schedule, security responsibilities, and support and incident arrangements. Complete the relevant privacy and risk assessment with the care-home operator.
Legal approval, live-provider suitability, backups and successful restore are not verified by a green technical health check. If these facts have not been supplied, do not treat the application as approved for personal data.