Privacy Policy
In short. When a care provider uses Wellviax, the care provider decides what happens to the care records in it and we act on their instructions. If you are a resident, a service user, a family member or a member of staff and you want to see or correct your records, ask the care provider — not us. We explain why below, and how to reach us either way.
1. Who we are
1.1 Cipher Knights supplies Wellviax, a care management system used by care homes, children's homes and domiciliary care agencies in the United Kingdom.
1.2 For questions about this policy or about personal data, contact support@cipherknights.com or +44 7424 967568.
2. Our role depends on whose data it is
2.1 This is the most important thing in this policy, because it decides who you should ask about what. For everything held in Wellviax about the people a care provider supports and about its own staff, you are the controller and we are the processor as those terms are used in the Data Protection Laws.
| Data | Controller | Our role |
|---|---|---|
| Care records, medication records, care plans, and other records about people receiving care | The care provider | Processor |
| Staff records held by a care provider — rotas, timesheets, payroll, training, DBS | The care provider | Processor |
| Our customer's own business contacts — the people we deal with commercially | Cipher Knights | Controller |
| Enquiries through our website, and website analytics | Cipher Knights | Controller |
2.2 Where we are a processor, we hold and handle the data on the care provider's instructions. We do not decide what is collected, why, or how long it is kept. If you are a resident, a service user, a relative or a member of staff, your rights are exercised against the care provider, and they will contact us if they need our help.
2.3 Where we are a controller — essentially our own business contacts and our website — sections 3 to 7 apply and you can contact us directly.
3. Data we hold as controller
3.1 We hold, about people at organisations we deal with:
- name, job title, work email address and work telephone number;
- the organisation they work for and its regulator;
- correspondence with us, including support enquiries;
- records of demonstrations, quotes and contracts.
3.2 We also hold limited technical information about visitors to our website — see our Cookie Policy.
3.3 We do not seek, and ask you never to send us, care records or health information by email. If you need to show us a record to get support, tell us where to look in the system rather than sending a copy.
4. Why we hold it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to an enquiry and giving a quote | Legitimate interests — replying to someone who contacted us |
| Providing the Service, support and account administration | Performance of a contract |
| Invoicing, credit control and keeping accounting records | Legal obligation, and legitimate interests |
| Securing the Service and investigating misuse | Legitimate interests — keeping the system and its data safe |
| Telling existing customers about changes to the Service | Legitimate interests, and performance of a contract |
| Marketing to organisations who have not bought from us | Consent, or the soft opt-in where it applies |
4.1 You may object to processing based on legitimate interests, and may withdraw consent to marketing at any time. Every marketing email carries an unsubscribe link.
5. Who we share it with
5.1 We share personal data only with:
- our sub-processors, listed in section 10, who host and run the Service for us;
- our professional advisers, where they need it;
- a purchaser, if our business is sold, under equivalent obligations;
- a court, regulator or law enforcement body where we are required by law to disclose.
5.2 We do not sell personal data, and we never will. We do not share Customer Data with advertisers, data brokers or any third party for their own purposes.
5.3 We do not use care records to train artificial intelligence models, our own or anyone else's.
6. Where it is held
6.1 Wellviax and its database are hosted in the European Economic Area. Backups are held in the same region.
6.2 We will not transfer personal data outside the UK or EEA unless an appropriate safeguard under the Data Protection Laws is in place, such as the UK International Data Transfer Addendum.
7. How long we keep it
7.1 As processor: for as long as the care provider's contract with us runs. On termination we make the data available for export for 30 days, may delete it after that, and will delete it within 90 days, unless we are required by law to keep it.
Care providers: this is much shorter than your own retention duties. Care records commonly have to be kept for years after a person leaves a service. Exporting what you are required to keep, before that window closes, is your responsibility and not ours.
7.2 As controller: enquiry records for up to 24 months after the last contact; customer and contract records for 7 years after the contract ends, which is the accounting retention period; and website analytics as set out in the Cookie Policy.
8. Security
8.1 We take the measures required by Article 32 of the UK GDPR, taking account of the state of the art, the costs of implementation and the risks to people. In particular:
- Encryption in transit. All traffic uses TLS.
- Encryption at rest. The database and backups are encrypted, and particularly sensitive fields — bank details, sort codes, right-to-work share codes, two-factor secrets — are separately encrypted within it.
- Separation between customers. One provider's data is not reachable from another's account. This is enforced in the system, not by policy.
- Access limited to need. Care staff reach a person's record only while on a shift covering that person. Our own staff access customer data only where necessary for support, and that access is logged.
- Audit trail. Access to and changes of sensitive records are recorded.
- Backups are taken regularly and restoration is tested.
8.2 No system is perfectly secure. We do not claim otherwise, and clause 9.4 sets out what we do if something goes wrong.
9. Our commitments as processor
9.1 These are the terms required by Article 28(3) of the UK GDPR. Where we have signed a separate data processing agreement with a customer, that agreement prevails.
9.2 We will:
- process personal data only on the customer's documented instructions, including on transfers, unless required otherwise by law — in which case we will tell them first unless the law forbids it;
- ensure everyone authorised to process it is under a duty of confidence;
- take the security measures required by Article 32;
- engage a sub-processor only under a written contract imposing equivalent obligations, and remain liable for their performance;
- give the customer at least 30 days' notice of any new or replacement sub-processor, so they may object;
- assist the customer, so far as is reasonable, with responding to data subject requests;
- assist the customer with security, breach notification, data protection impact assessments and prior consultation;
- on the customer's choice, delete or return the personal data at the end of the contract, and delete existing copies unless the law requires them to be kept;
- make available the information needed to show compliance with these obligations, and allow and contribute to audits, including inspections, by the customer or an auditor they mandate;
- tell the customer immediately if, in our opinion, an instruction infringes the Data Protection Laws.
9.3 Subject matter and scope. The subject matter is the provision of Wellviax. The duration is the term of the customer's contract. The nature and purpose is the hosting, storage and processing of care and workforce records so the customer can run its service. The types of personal data include names, contact details, dates of birth, NHS numbers, health and care records, medication records, employment records, and financial details for payroll. The categories of data subject are people receiving care, their relatives and representatives, and the customer's staff. It includes special category data — health data in particular — and may include data about criminal convictions where a customer records DBS outcomes.
9.4 Breach notification. If we become aware of a personal data breach affecting a customer's data, we will notify that customer without undue delay and in any event within 24 hours of becoming aware, with the information they need to meet their own obligation to report to the Information Commissioner's Office within 72 hours. Reporting to the ICO, and to affected individuals, is the customer's decision and duty as controller.
10. Sub-processors
10.1 We use the following sub-processors to provide the Service:
| Provider | What they do | Where |
|---|---|---|
| Render | Application hosting | EEA (Frankfurt) |
| Supabase | Database hosting and backups | EEA (Frankfurt) |
| Brevo | Sending transactional email | EEA |
| Google (Firebase) | Distributing test builds of the mobile app to named testers | EEA / adequacy |
10.2 We will give customers at least 30 days' notice before adding or replacing a sub-processor. A customer who reasonably objects on data protection grounds may raise it with us, and if we cannot resolve it, may terminate without penalty for the remainder of the term.
11. Your rights
11.1 Where we are the controller, you have the right to be informed, to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability. Where we rely on consent, you may withdraw it at any time.
11.2 Where we are the processor — which covers all care records — please contact the care provider. If you contact us instead, we will not act on the request ourselves, because it is not ours to decide. We will pass it to the provider promptly and tell you we have done so.
11.3 To exercise a right against us, email support@cipherknights.com. We respond within one month.
11.4 You may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you raised it with us first, so we can put it right.
12. Automated decision-making
12.1 We do not make decisions producing legal or similarly significant effects about anyone by automated means alone.
12.2 The Service flags matters for a person's attention — a medication due, a notification deadline, an expiring DBS check. Those are prompts to a human being. It does not decide anything about anyone's care.
13. Changes to this policy
13.1 We may update this policy. Where a change materially affects how we handle personal data, we will notify customers by email at least 30 days before it takes effect.
13.2 The version and date at the top always show which version applies.
14. Contact
Cipher Knights
Email: support@cipherknights.com
Telephone: +44 7424 967568