Skip to main content

Privacy Policy

Effective Date: March 2026

CareVouch is a trading name of JJHSolutions Ltd ("we", "us", or "our"). We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and services.

1. Who We Are

  • Trading name: CareVouch
  • Legal entity: JJHSolutions Ltd
  • Data controller: For the purposes of UK GDPR, JJHSolutions Ltd is the data controller for personal data processed through the CareVouch service.
  • Contact email: support@carevouch.co.uk

2. What Our Service Does

CareVouch is a care visit tracking service for families and small care agencies. Account holders manage one or more client locations, each with its own unique QR code. When a care assistant scans a QR code and taps Check In or Check Out, the event is recorded with a timestamp, the carer's name (selected from a pre-configured list), and the client location. The service is designed to provide transparency, accountability, and peace of mind for families and agencies managing care arrangements.

3. Information We Collect

a. Account Information (Registered Users)

  • Name
  • Email address
  • Account preferences and notification settings

b. Check-In Event Data

Each time a carer checks in or out, we record:

  • Timestamp of the check-in or check-out event
  • Carer name (selected by the carer from a pre-configured list on your account)
  • Client location label (e.g. "Client 12" — a short reference you assign)
  • QR code token (used to link the scan to your account and location)
  • GPS coordinates of the scanning device — only if the carer's phone browser grants location permission. This is a single coordinate captured at the moment of the scan. See section 4 for full details.
  • Location verification status (whether the scan occurred within the expected distance of the client property)

c. Client Location Configuration

When you add a client location, we store:

  • A short location label (e.g. "Client 12", "Flat A"). We strongly recommend not storing full personal names or addresses — see our GDPR data minimisation guidance in the app.
  • An optional internal reference code (for your own records)
  • An optional postcode, used only for approximate on-site distance verification. Not shown to carers, not included in QR codes.
  • GPS reference coordinates (ref_lat/ref_lng), derived from the median position of historical carer check-ins at that location and set by you via the GPS calibration tool. Stored server-side only — never included in QR codes or public-facing responses.

d. What We Do NOT Collect

  • Care assistants do not create accounts or log in
  • We do not store identity documents or credentials for carers
  • We do not collect health data, care notes, or care quality assessments
  • We do not continuously track carer location — GPS is captured once, at the moment of scan only
  • We do not collect full client names or full addresses in the locations table

e. Technical Information

  • IP address
  • Browser type and version
  • Device type
  • Cookies and basic analytics data

4. GPS Location Data — Full Details

When a care assistant scans a QR code, their phone browser may request permission to access the device's GPS location. This is a standard browser permission prompt (the same mechanism used by mapping apps and websites).

  • What is captured: A single GPS coordinate (latitude and longitude) at the moment the carer taps Check In or Check Out.
  • When it is captured: Only at the moment of check-in or check-out — not before, not after, not continuously.
  • Permission: The browser prompts the carer once for location permission. If they deny it, no coordinates are captured and the check-in still records normally with a status of "location unavailable".
  • Purpose: To verify that scans occur at or near the expected client property, providing an additional layer of accountability.
  • Flagging, not blocking: Scans that occur outside the expected area are flagged for review on the account owner's dashboard. They are never blocked — the carer can always check in regardless of location.
  • Access: GPS scan coordinates are accessible only to the account owner and family members of the relevant account. They are never visible to the carer or to other accounts.
  • Carer reference coordinates (ref_lat/ref_lng): The expected location is derived from historical scan data and stored server-side only. It is never included in QR codes or public-facing API responses.

The legal basis for processing GPS scan coordinates is legitimate interests — specifically, the account holder's legitimate interest in verifying that care visits take place at the expected property location, and in maintaining an accurate and trustworthy care visit record.

5. How We Use Your Information

We use your information to:

  • Provide the CareVouch service
  • Record and display care visit events per location and per carer
  • Verify care visits occurred at the expected client property (GPS)
  • Flag scans that occur outside the expected area for your review
  • Send daily summary email notifications
  • Display your visit history on the dashboard
  • Manage your subscription and billing
  • Communicate with you about your account
  • Maintain security and prevent misuse
  • Comply with legal obligations

6. Legal Basis for Processing

We process your personal data under the following lawful bases:

  • Performance of a contract — providing the care tracking service you have subscribed to
  • Your consent — for email notifications (you can opt out at any time)
  • Legitimate interests — security and fraud prevention; verifying care visits occur at the expected location; improving the service. GPS scan coordinates are processed under this basis.
  • Legal obligation — where required to comply with applicable law

7. Data Minimisation

We design the service with data minimisation in mind:

  • Client locations require only a short label — no full name or address is needed or recommended
  • Postcodes are optional and used only for approximate geo-validation
  • GPS reference coordinates are stored server-side only and never exposed in QR codes
  • Carer names are pre-configured by you — care assistants do not enter their own identity data
  • GPS scan coordinates are stored for audit purposes only and are not used for any other profiling

8. Data Retention

We retain your data for as long as your account is active. This includes:

  • Check-in and check-out event history (including GPS coordinates where captured)
  • Client location records and GPS calibration data
  • Family member details and notification preferences

When you delete your account, all associated data including event history, GPS coordinates, location records, carer names, notification preferences, and personal information will be permanently deleted.

9. Sharing Your Information

We only share personal data with trusted third parties necessary to operate the service:

  • Supabase — database storage and authentication (servers in the EU)
  • Resend — transactional email delivery
  • Stripe — payment processing

We do not sell your personal information. GPS scan coordinates and location data are not shared with any third party except as required by law.

10. Your Rights

Under UK GDPR, you have the right to:

  • Access your personal data — including GPS scan coordinates stored on your account
  • Correct inaccurate information
  • Request deletion of your data
  • Restrict or object to processing — including processing of GPS location data
  • Data portability
  • Withdraw consent for email notifications at any time via Settings → Notifications
  • Object to legitimate interests processing — you may object to GPS location capture by contacting us, or by instructing carers to decline the browser location permission when scanning

To exercise your rights, contact us at: support@carevouch.co.uk

11. How to Delete Your Data

You can delete your account and all associated data through your account settings:

  1. Log in to your CareVouch account
  2. Go to Account → Data & Privacy
  3. Click "Delete My Account"
  4. Confirm the deletion

This will permanently and irreversibly delete your account, all visit history, all GPS data, all location records, and all associated personal data.

12. Cookies & Analytics

We use cookies to:

  • Keep you logged in (essential)
  • Remember your preferences (essential)
  • Understand how the website is used (analytics, with your consent)

We use Google Analytics to understand how visitors use our website. This service sets cookies and collects anonymised usage data. Google Analytics is only loaded after you explicitly accept cookies via our cookie banner. If you decline, no analytics cookies are set and no tracking occurs.

You can manage cookies through your browser settings. See our Cookie Policy for more details.

13. Security

We use industry-standard measures to protect your personal information:

  • SSL/TLS encryption in transit
  • Encrypted database storage with row-level access controls
  • GPS reference coordinates stored server-side only — never exposed in QR payloads
  • Authentication required to access any account data

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the website or by email. The effective date at the top of this page reflects when the policy was last updated.

15. Contact Us

If you have any questions about this policy or how we handle your data:
JJHSolutions Ltd
Email: support@carevouch.co.uk

By using our services, you agree to the terms of this Privacy Policy.