Skip to main content

    Privacy Notice

    Caredact — operated by PixelArc Ventures LTD

    Last updated: 28 September 2026

    1. Who we are

    Caredact is operated by PixelArc Ventures LTD, a company registered in England and Wales.

    • Company number: 16305788
    • Registered address: 510 Burnley Road East, Rossendale, England, BB4 9LB
    • Email: hello@caredact.com
    • Website: https://caredact.com
    • ICO registration number: ZB962251

    For the purposes of data protection law, PixelArc Ventures LTD is the data controller for the personal data we collect about you as a user of our service (account information, usage data). When you use Caredact to process documents, you (or your organisation) remain the data controller for the personal data contained within those documents — we act as a data processor on your behalf.

    2. What personal data we collect

    2.1 Account data

    When you create an account, we collect:

    • Full name
    • Email address
    • Password (stored as a bcrypt hash — we never store your plain text password)
    • Organisation name (if you create a new organisation)

    2.2 Document data

    When you use Caredact to process a document, the following data is temporarily processed:

    • The original text you paste into the platform (which may contain personal data about third parties)
    • PII entities detected within that text (names, NHS numbers, dates of birth, addresses, etc.)
    • Anonymised text (with personal data replaced by placeholders)
    • PII mappings linking placeholders to original data (encrypted at rest using AES/Fernet encryption)

    Important: When you mark a document as complete, or when your organisation's retention period ends, we permanently delete its PII mapping, the encrypted link between placeholders and the original details. After that, the placeholders can no longer be turned back into real details. The anonymised text of the document and its AI conversation stays in your account so you can refer back to your work, and is deleted when your organisation's account is closed or when you ask us to delete it. It contains placeholders in place of the personal details that were detected and reviewed.

    Note checks (Provider and Enterprise plans): when your organisation uploads visit notes for checking, each note is anonymised on the way in, in the same way as a document, and an administrator reviews the redaction before anything is sent for checking. The link between placeholders and the original details is encrypted and kept only until the end of your organisation's retention period (default 30 days, configurable up to 90 days), so that administrators can see the original details while they review the results; after that it is permanently deleted and only the anonymised note remains. We also keep the anonymised note, the carer name and client reference your organisation supplied alongside it (kept as supplied, so use references rather than names for the people you support), the counts of what was detected, and the result of the check: what was recorded, what was missing, any hazard or incident language, and the verdict. The check is carried out by the same AI service as the writing assistant, in the United Kingdom, on the anonymised note. These records are kept for the lifetime of your organisation's account so managers can refer back to them, and are deleted when the upload is deleted, when the account is closed, or when you ask us to delete them.

    2.3 AI interaction data

    When you use the AI writing assistant, the anonymised version of your text is sent to Azure OpenAI Service deployed in our Microsoft Azure UK South tenancy. Personal details are detected automatically and you review them before anything is sent, so the AI model receives placeholders in place of the details that were detected and reviewed, not the original details. Inference takes place entirely within the United Kingdom.

    2.4 Billing data

    If you subscribe to a paid plan, payment processing is handled entirely by Stripe. We store:

    • Stripe customer ID
    • Stripe subscription ID
    • Subscription status and billing interval

    We do not store your card number, bank details or any payment credentials. These are held solely by Stripe.

    2.5 Audit and usage data

    We automatically collect:

    • Audit logs of actions performed within the platform (document creation, PII detection, exports, login events)
    • Login timestamps and IP addresses (for security and rate limiting)

    2.6 Cookies

    Caredact uses a single authentication token stored in your browser's local storage. We do not use third-party tracking cookies, analytics cookies or advertising cookies. For full details, see our Cookie Policy.

    3. How we use your data

    PurposeLawful basis (UK GDPR)
    Providing the Caredact service (account management, document processing, AI writing)Performance of a contract (Article 6(1)(b))
    Processing billing and subscriptions via StripePerformance of a contract (Article 6(1)(b))
    Sending transactional emails (password resets, invitations, subscription notifications)Performance of a contract (Article 6(1)(b))
    Maintaining audit logs for regulatory complianceLegitimate interests (Article 6(1)(f)) — enabling our users to meet their Ofsted, ICO and CQC obligations
    Protecting the security of the platform (rate limiting, login monitoring)Legitimate interests (Article 6(1)(f)) — preventing unauthorised access
    Complying with legal obligationsLegal obligation (Article 6(1)(c))

    4. Who we share your data with

    We share personal data only with the following third-party processors, all of whom are bound by data processing agreements:

    ProcessorPurposeData sharedLocation
    Microsoft AzurePrimary cloud infrastructure (hosting, database, caching, file storage, content delivery, AI inference via Azure OpenAI Service)All service data, including anonymised text submitted to AI for writing assistanceUnited Kingdom (UK South region)
    Amazon Web Services (AWS) — SES onlyTransactional email delivery (account verification, password reset, invitations, notifications)Email address and minimal email contentUnited Kingdom (eu-west-2 / London region)
    StripePayment processingEmail, organisation name, subscription dataEU/US (Stripe is certified under EU-US Data Privacy Framework)

    Important regarding AI inference: The AI model only processes the anonymised text you have reviewed, in which detected personal details such as names, NHS numbers and addresses are replaced by placeholders like [PERSON_1] and [NHS_NUMBER_1]. You check every detection before anything is sent and can mark anything that was missed. AI inference takes place entirely within the United Kingdom, in our Microsoft Azure UK South tenancy. This is the core purpose of Caredact.

    We do not sell your data to any third party. We do not share your data with advertisers.

    5. Where your data is stored

    All primary data (accounts, documents, PII mappings, audit logs) is processed and stored exclusively in the United Kingdom, in Microsoft Azure's UK South region (uksouth). Transactional emails are sent via Amazon Web Services Simple Email Service (SES) in the eu-west-2 / London region.

    The only data that leaves the UK is:

    • Billing data sent to Stripe for payment processing — Stripe operates under EU-US Data Privacy Framework adequacy

    AI writing assistance — including the inference itself — happens entirely within the UK Data Boundary, using Azure OpenAI Service in UK South. No anonymised text leaves the UK.

    6. How we protect your data

    • All data in transit is encrypted using TLS 1.2+
    • All data at rest is encrypted using platform-managed AES-256 (Microsoft Azure for databases and storage)
    • PII mappings are additionally encrypted using AES (Fernet) encryption before storage
    • Passwords are hashed using bcrypt
    • Two-factor authentication (TOTP) is available for all users and can be enforced by organisation administrators
    • Login attempts are rate limited (5 attempts per 15 minutes)
    • JWT authentication tokens are invalidated on logout via a Redis blocklist
    • All access to the platform is logged in an audit trail

    7. How long we keep your data

    Data typeRetention period
    Account dataUntil you or your administrator delete your account
    PII mappings (the link between placeholders and original details)Permanently deleted when the document is marked complete, or automatically at the end of the organisation's retention period (default 30 days, configurable up to 90 days)
    Anonymised document text and AI conversationsKept for the lifetime of the organisation account so users can refer back to their work; deleted when the account is closed or on request
    Note checks (anonymised note text, carer name and client reference as supplied, and results; the encrypted placeholder link is deleted at the end of the organisation's retention period)Kept for the lifetime of the organisation account; deleted when the upload is deleted, when the account is closed, or on request
    Audit logsRetained for the lifetime of the organisation account (required for regulatory compliance)
    Billing dataRetained for 7 years after the end of the subscription (HMRC requirement)
    Login and security logs90 days

    8. Your rights

    Under UK GDPR, you have the right to:

    • Access your personal data — request a copy of the data we hold about you
    • Rectification — ask us to correct inaccurate data
    • Erasure — ask us to delete your data (subject to legal retention requirements)
    • Restrict processing — ask us to limit how we use your data
    • Data portability — receive your data in a structured, machine-readable format
    • Object — object to processing based on legitimate interests
    • Withdraw consent — where processing is based on consent (currently not applicable)

    To exercise any of these rights, contact us at hello@caredact.com. We will respond within one month.

    9. Data processed on behalf of your organisation

    When you use Caredact to process documents containing personal data about third parties (such as service users, patients or children), your organisation is the data controller for that data. Caredact acts as a data processor.

    Your organisation is responsible for:

    • Having a lawful basis for processing that data
    • Providing appropriate privacy notices to the individuals whose data is processed
    • Ensuring the data is accurate and necessary

    Caredact's responsibilities as a processor are set out in our Terms of Service.

    10. Children's data

    Caredact is designed for use by adult care professionals. We do not knowingly collect account data from children under 18. If care professionals use Caredact to process documents containing children's personal data, the provisions in Section 9 apply — the care provider is the data controller for that data.

    11. Changes to this notice

    We may update this privacy notice from time to time. We will notify registered users by email of any material changes. The latest version will always be available at https://caredact.com/privacy.

    12. Complaints

    If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

    • Website: https://ico.org.uk
    • Helpline: 0303 123 1113
    • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF