Privacy Policy

1. Who operates In My Care

In My Care is a private, invite-only application used by a family to record and review the daily care of a person they look after.

Operator: Recommunicated ("Recommunicated", "we", "us"), a sole trader established in the United Kingdom
Product: In My Care
Trading address: 86-90 Paul Street, London, England, EC2A 4NE, United Kingdom
Reseller and Merchant of Record for all orders: Paddle.com Market Limited
Contact: hello@inmycare.app, or the Support page on this website

Recommunicated is the data controller for account information, security data and support correspondence. For the care records a family enters about the person they look after, the family members who create and manage that care circle decide what is recorded and who may see it; Recommunicated processes those records on their behalf and holds them under the safeguards described here.

2. Scope of this policy

This policy covers the In My Care application, its installable web app, and the public pages on this website. It does not cover services operated by other organisations that you reach from the app.

3. Information we collect

Account information you give us, such as name, email address, phone number and profile photo.
Care records entered by members of a care circle.
Files uploaded to a care circle, including photographs, scans and voice notes.
Messages in family chat and posts in Moments.
Technical information needed to run the service securely, such as sign-in events and device push registrations.

4. Health and special-category information

Care records include information about a person's health, medication, nutrition, mobility and wellbeing. This is special-category information and receives additional protection.

We process this information because it is necessary for the provision of health and social care, and for the management of care services, under Article 9(2)(h) UK GDPR together with the health and social care condition in Schedule 1 Part 1 of the Data Protection Act 2018. Where a care circle records that the person being cared for has given explicit consent, we also rely on Article 9(2)(a).

5. Identity documents

Where a care circle stores identity documents such as a passport or visa, those files are held in private storage, are not publicly reachable, and are opened through short-lived links that are checked against your role in the care circle each time.

6. Chat and Moments content

Messages, posts, comments and reactions are visible only to active members of that care circle. Coordinators can moderate content. Removed content may be retained in a restricted form to support moderation, safeguarding and audit obligations.

7. Voice, image and video recordings

Recordings and images are stored privately with the care circle that created them and are not used to train models or shared for advertising.

We process sign-in events, session information and push-notification registrations to keep accounts secure and to deliver reminders you have asked for.

9. Purposes of processing

Providing the care record and its reminders.
Keeping accounts and care circles secure.
Responding to support, privacy and safeguarding requests.
Meeting legal and record-keeping obligations.

10. Lawful bases

Providing the care record, reminders and the paid membership: performance of a contract (Article 6(1)(b)).
Keeping accounts and care circles secure, preventing fraud and misuse, and improving the service: our legitimate interests (Article 6(1)(f)).
Meeting accounting, tax, safeguarding and record-keeping duties: legal obligation (Article 6(1)(c)).
Optional analytics and any marketing messages: consent (Article 6(1)(a)), which you may withdraw at any time.

11. Authority to process another adult's information

Care circles record information about an adult who may not be entering it themselves. The person who sets up a care circle is asked to record the basis on which they act. A family relationship does not by itself grant unrestricted authority.

Information is shared with active members of the same care circle according to their role. Family viewers see a reduced, read-only view.

13. Service providers and processors

We use service providers to host the application, store files, send email and deliver notifications.

Supabase - application database, authentication and private file storage, under a data processing agreement.
Cloudflare - hosting and delivery of the application, under a data processing agreement.
Paddle.com Market Limited - our reseller and Merchant of Record. Paddle receives the billing information you enter at checkout, together with the account identifier needed to link a membership to your account, and uses it to take payment, handle tax, issue invoices, manage subscriptions and process refunds. Paddle is a separate controller for that payment data. See Paddle's privacy notice at paddle.com/legal/privacy.
Web push services operated by your browser or device maker - used only to deliver the reminders you switch on.

We do not sell personal information and we do not share it with advertisers.

14. International data transfers

Care records and files are held in the service provider regions we configure for the application. Some of our providers, including Paddle, operate globally, so information may be transferred outside the United Kingdom and the European Economic Area. Where that happens we rely on the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or an adequacy decision, together with the technical protections described in section 15.

15. Data security

Access to care records is restricted by role and enforced in the database, not only in the app. Files are held in private storage. We cannot guarantee that any system is completely secure.

16. Retention

Account profile and memberships: kept while your account is active, then removed when deletion completes.
Care records, health readings, medication history, incidents and doctor visits: kept for 7 years from the date recorded, reflecting the period care and health records are ordinarily retained.
Financial records, receipts and billing history: kept for 7 years to meet tax and accounting duties.
Consent, authority and audit records: kept for 7 years.
Chat messages, Moments posts and comments: kept while the care circle exists, then removed within 90 days of it closing.
Security and sign-in logs: kept for 12 months.
Support and privacy correspondence: kept for 2 years after the request closes.

When a period ends, information is deleted or irreversibly anonymised.

Care records may need to be retained after an individual leaves or deletes their account. See the Data Retention Summary.

17. Account deletion

You can request deletion of your account inside the app, or from the public account deletion page. Requesting deletion also cancels any paid membership at the end of the period you have already paid for, so you are not billed again. See section 18 for what may be retained.

18. Care-record retention after deletion

Deleting an account removes your access and your personal profile information. It does not automatically erase care records that others rely on, such as medication administration history, health readings, incidents, doctor visits, financial records, consent records and audit history. Where those records are retained, your visible attribution is changed to "Former member".

18a. Payments and your membership

Recommunicated does not take payments directly and never sees or stores your full card details. Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders and handles billing, tax, invoicing, subscription changes, returns and refunds. When you subscribe, we receive from Paddle only the information needed to run your membership: a subscription and customer reference, the plan you chose, its status, and the dates of the current billing period.

19. Your rights

Depending on where you live and the circumstances, you may be able to ask for access, correction, deletion, restriction, portability, or to object to certain processing. Submit a privacy request and we will review it.

Where we rely on consent, you can withdraw it. Withdrawal does not affect processing already carried out.

21. Complaints

Complaints can be raised with us first. You may also complain to a supervisory authority.

If you are in the United Kingdom you may complain to the Information Commissioner's Office at ico.org.uk. If you are in the European Economic Area you may complain to your national data protection authority.

22. Children and eligibility

In My Care is intended for adults. You must be 18 or over to hold an account. We do not knowingly create accounts for children. If you believe a child holds an account, contact us and we will remove it.

23. Changes to this policy

Material changes create a new version with a new effective date. Where renewed acceptance is required, we will ask you in the app.

24. Contact

Operator: Recommunicated ("Recommunicated", "we", "us"), a sole trader established in the United Kingdom
Product: In My Care
Trading address: 86-90 Paul Street, London, England, EC2A 4NE, United Kingdom
Reseller and Merchant of Record for all orders: Paddle.com Market Limited
Contact: hello@inmycare.app, or the Support page on this website