Privacy Policy

CareClarity is operated by GFE Tech Group Ltd (“we”, “us”, “our”). We are the data controller for personal data processed through the CareClarity platform.

We are registered with the Information Commissioner's Office (ICO) in accordance with the UK GDPR and the Data Protection Act 2018. Our ICO registration number is ZC153731.

Contact: hello@careclarity.care

We collect the following categories of personal data:

• Account data: Your name, email address, organisation name, and role.
• Usage data: Records of which tools you have used and when, used for billing and analytics.
• Communications: Any messages you send via the feedback or contact forms.
• Technical data: IP address, browser type, and cookies necessary for platform operation.
• Learning Hub activity data: When you complete Learning Hub activities (including quiz stages, mock interviews, scenario walkthroughs, tier certificates, and scenario builder sessions), a record of the completion — including the activity type, role track, and timestamp — is stored securely. This data does not include your quiz answers, interview responses, or scenario inputs. It is used to allow your organisation's administrator to view team training progress. This data is retained for the duration of your organisation's active subscription and deleted upon account or organisation offboarding.
• Clara usage data: When you interact with Clara, anonymous usage metrics are recorded including the timestamp, your organisation, which resolution method was used (tool signposting, Learning Hub signposting, or AI-generated response), and — where an AI response was generated — the number of tokens used. The content of your Clara conversations is not stored by CareClarity. Session conversation history is held in your browser's session storage only and is deleted when your browser session ends or you sign out.

Safeguarding conversation content is not retained beyond your active session. When you close or reset a conversation, the content is not stored.

Several features of the CareClarity platform use AI-generated content, including but not limited to: tool feedback reports, safeguarding guidance, mock interview responses, quiz explanations, scenario builder outputs, and Clara guidance responses. AI-generated content is provided to support professional practice and learning. It does not constitute professional advice and must not replace the professional judgement of qualified practitioners. CareClarity reviews its AI features regularly but cannot guarantee that AI-generated content is error-free, complete, or up to date with the latest regulatory changes.

• Providing and operating the CareClarity platform
• Managing your account and subscription
• Processing billing and payments
• Sending service communications (account updates, security notices)
• Responding to support requests and feedback
• Improving our platform through anonymised usage analytics

We will never sell your personal data to third parties or use it for marketing without your explicit consent.

• Contract: Processing necessary to provide the services you have subscribed to.
• Legitimate interests: Platform security, fraud prevention, and service improvement.
• Consent: Where you have explicitly opted in, such as for testimonials.
• Legal obligation: Where required by law.

• Anthropic: Our AI provider (Anthropic PBC, USA) processes document content in real time via the Claude API. Text is sent directly to Anthropic's API and the response is returned to you — no data passes through any third-party gateway. Anthropic does not use submitted content for model training. Operational API logs are retained for up to 7 days and then automatically deleted. Data is transferred under a Data Processing Agreement incorporating UK Standard Contractual Clauses (UK IDTA). Anthropic holds ISO 27001:2022 and SOC 2 Type II certification. In addition to the document-based tools, Anthropic processes content submitted through the Mock Ofsted Interview and Scenario Builder and generates Clara's AI guidance responses; in all cases, content is not used to train Anthropic's models.
• Supabase: Our database provider, storing account and usage data under GDPR-compliant data processing agreements.
• Stripe: Stripe processes subscription payments. We do not store payment card data. Stripe is PCI-DSS Level 1 certified.
• Vercel: Our platform is hosted on Vercel (London/lhr1 region). Vercel processes request data as part of platform delivery. Vercel is SOC 2 Type II certified.
• Resend: Transactional emails (account invitations, notifications) are sent via Resend. Name and email address are shared for this purpose only.

We retain account data for as long as your account is active, plus 12 months after closure for legal purposes. Usage logs are retained for 2 years. Document content and all AI conversation content processed by our tools is not retained at all. Learning Hub activity completion records (activity type, role track, and timestamp — not content) are retained for the duration of your active account and deleted when your account is permanently closed.

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. To exercise any right, contact us at hello@careclarity.care. We will respond within one calendar month.

We use only cookies strictly necessary for platform operation (authentication, session management). We do not use advertising or tracking cookies.

We use browser session storage to temporarily hold your Clara conversation history within an active session. This data is stored locally in your browser only, is never transmitted to our servers, and is automatically deleted when your browser session ends or you sign out of the platform.

You have the right to complain to the ICO: ico.org.uk · Helpline: 0303 123 1113

We may update this policy from time to time and will notify registered users of material changes by email. The date at the top reflects when this policy was last updated.