Privacy Policy

CareLeap is a digital independence and personal development platform designed to support young people living in residential children's homes and those preparing for greater independence.

Our platform enables young people and authorised care home staff to manage independence goals, weekly incentive charts, achievements, rewards, diaries and Wishes & Feelings.

CareLeap is committed to protecting personal information, particularly information relating to children and young people.

This Privacy Policy explains what information we collect, why we collect it, how it is used, how it is protected, who may access it and the rights of individuals.

CareLeap aims to comply with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

CareLeap provides its platform to residential children's homes and authorised care providers.

For information entered and managed by care providers, the care provider will generally act as the Data Controller, determining the purposes and lawful basis for processing.

CareLeap will generally act as the Data Processor, providing the technology used to manage information on behalf of the care provider.

CareLeap may act as an independent Data Controller for its own business administration, customer relationships and subscription information.

These responsibilities must be established in the relevant agreements.

CareLeap processes information necessary to operate its platform.

Young People's Personal Information

• Name and age
• Username and securely hashed password
• Care home association
• Optional uploaded profile photograph
• Account status and creation date

Independence and Progress Information

• Personal independence goals
• Weekly incentive charts
• Completed and outstanding tasks
• Achievements
• Rewards and reward redemptions
• Progress towards independence

Wishes & Feelings

Young people can write and submit their own Wishes & Feelings.

These may include personal experiences, preferences, opinions, concerns and information about their wellbeing.

Only authorised care home users can access this information according to their permissions.

Only authorised staff can delete submitted Wishes & Feelings responses through the platform.

Profile Photographs

Young people can voluntarily upload a profile photograph.

Photographs are intended to be visible only to the young person and authorised staff within their own care home.

They are not intended to be publicly accessible or visible to other care homes.

Diary and Activities

CareLeap may store appointments, activities, reminders and relevant diary events.

Financial and Reward Information

Where enabled, CareLeap may store incentive balances, spending records, rewards and related transaction information.

Technical Information

CareLeap may process technical identifiers, activity logs and notification tokens needed to operate and protect the platform.

CareLeap processes information to:

• Provide secure account access.
• Support young people's independence.
• Manage goals, incentives and achievements.
• Enable young people to express their Wishes & Feelings.
• Manage diaries and reminders.
• Support authorised care home staff.
• Maintain platform security.
• Provide technical support.
• Administer care provider subscriptions.
• Meet applicable legal and regulatory obligations.

CareLeap does not intend to sell young people's personal information or use it for targeted advertising.

The relevant Data Controller is responsible for identifying the lawful basis for processing under UK GDPR.

Depending on the circumstances, this may include contractual necessity, legal obligations, public tasks, legitimate interests or consent where appropriate.

Where special category personal data is processed, an additional lawful condition under Article 9 of UK GDPR must be established.

CareLeap's existing application infrastructure includes:

• PHP-based website and administration dashboard.
• MySQL database associated with Hostinger hosting.
• Database hosting reported to be in the United Kingdom.
• HTTPS connections.
• Securely hashed passwords.
• Individual care home dashboards.
• Role-based permissions.
• Restricted access between care homes.
• Manager-controlled account creation.
• Account deletion functionality.

Each care home is intended to access only the information associated with its own organisation.

CareLeap uses reasonable technical and organisational measures to protect personal information, but no internet-based service can guarantee absolute security.

Personal information may be accessible to:

• The young person to whom it relates.
• Authorised staff and managers within their care home.
• Approved CareLeap technical personnel where necessary.
• Contracted service providers supporting the platform.
• Relevant authorities where disclosure is legally required.

Information is not intended to be accessible to other care homes or the general public.

CareLeap recognises that children's personal information requires particular protection.

We aim to:

• Collect only information necessary for the service.
• Restrict access to authorised users.
• Protect written Wishes & Feelings.
• Keep profile photographs private.
• Apply privacy-by-design principles.
• Support correction and deletion requests.
• Avoid unnecessary sharing of children's information.

Care providers remain responsible for meeting their safeguarding and data protection obligations.

CareLeap's planned subscription cancellation procedure provides a 30-day data export period.

When a care home's subscription ends:

1. The care home receives confirmation of cancellation.
2. Authorised managers are given 30 days to export their organisation's information.
3. The normal export period ends after 30 days.
4. Data is securely deleted according to agreed retention arrangements, subject to lawful retention obligations.
5. The care home receives confirmation of the deletion process.

CareLeap allows authorised care home personnel to manage and delete young people's accounts.

Young people can request deletion of their personal information through their care provider.

Requests will be handled according to applicable data protection rights, safeguarding obligations and lawful retention requirements.

Users may also contact:

contact@careleap.co.uk

Where CareLeap acts as a Data Processor, it will assist the relevant care provider in handling valid deletion requests.

Depending on the circumstances, individuals may have rights to:

• Access their personal information.
• Correct inaccurate information.
• Request deletion.
• Restrict processing.
• Object to certain processing.
• Request data portability where applicable.
• Receive information about how their data is used.
• Exercise applicable rights relating to automated decisions.

Individuals may contact their care provider or CareLeap for assistance.

They may also complain to the Information Commissioner's Office:

Information Commissioner’s Office (ico.org.uk)

CareLeap uses Hostinger for website and database hosting.

The MySQL database has been reported as hosted in the UK.

Other technical services, including Firebase Cloud Messaging or Android development services, may process technical information.

CareLeap may update this Privacy Policy to reflect changes in its services, technology, legal obligations or data protection practices.

The latest version will be available on the CareLeap website.

Where appropriate, care providers will be informed of significant changes.

For privacy enquiries, account deletion requests or questions about personal information, contact:

CareLeap

Website: www.careleap.co.uk

Email: contact@careleap.co.uk

Address: 128 Minor Street, Manchester, M35 9DZ, United Kingdom

Individuals may also contact the UK Information Commissioner’s Office at ico.org.uk.