Privacy notice: OurKin Care

1. Who we are

[Company legal name], [registered address], company number [ ], ICO registration [ ]. Contact: privacy@ourkin.care.

We are the data controller for information held in OurKin Care.

2. What care information we collect

• About the person being cared for: name, their relationship to the care owner, and only the categories switched on — medications and schedules, appointments, health conditions, care notes, and documents such as care plans and letters.
• About circle members: name, contact details, role, and what they view and change.
• Consent records and, for legal representatives, lasting power of attorney or deputyship details.

Some of this is health information. The law treats it as especially sensitive, so we protect it more strongly than the rest of OurKin.

3. Why we use it

Only to run the care space: showing the right information to the right people, sending the reminders the circle asks for, and sharing updates between members.

We do not use it for advertising, profiling or selling, and we do not use it to train AI models.

4. Our legal basis

• To provide the service: UK GDPR Article 6(1)(b), contract.
• For health information: Article 9(2)(a), explicit consent from the person, or from someone legally authorised to act for them.

5. Who can see it

People in the circle, according to their role:

Our suppliers only to run the service: [hosting provider, e.g. AWS London], [email or SMS provider], [support tool if it can see care data]. Each has a contract requiring them to protect it.

OurKin staff only in limited cases, such as a support request you raise, and every such access is approved and logged.

We will never share it with insurers, employers, councils or the NHS unless you ask us to, or the law requires it.

6. Where it's stored and how it's protected

Stored in [UK region], encrypted in transit and at rest, separately from other OurKin data. Extra unlock (Face ID, fingerprint or PIN) for the care space, and every view and change is logged.

7. How long we keep it

• While the care space is active.
• After consent is withdrawn or the space is closed: deleted 30 days later, unless you delete it sooner.
• After the person dies: deleted 90 days later, giving the family time to save anything they need.
• Backups: removed within [X] days of deletion.
• Consent and access records, with no health detail, kept for [6 years] to show we acted lawfully.

8. Your rights

You can see and get a copy of the information, correct it, delete it, restrict or object to its use, take it elsewhere, and withdraw consent at any time (this doesn't affect what happened before you withdrew).

Do any of this in app settings, or email privacy@ourkin.care. We reply within one month. Legal representatives can use these rights on the person's behalf.

9. Complaints

Contact us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.