Skip to main content

    Terms of Service

    Caredact — operated by PixelArc Ventures LTD

    Last updated: 25 September 2026

    1. Introduction

    These Terms of Service ("Terms") govern your use of the Caredact platform ("Service") operated by PixelArc Ventures LTD ("we", "us", "our"), a company registered in England and Wales (company number 16305788).

    By creating an account or using the Service, you agree to these Terms. If you are using the Service on behalf of an organisation, you confirm that you have authority to bind that organisation to these Terms.

    2. Description of Service

    Caredact is a web-based platform that:

    • Detects and removes personal identifiable information (PII) from text before it is sent to AI writing tools
    • Provides AI-assisted writing features using anonymised text
    • Maintains encrypted mappings of original personal data so it can be restored to finished documents
    • Provides audit trails for regulatory compliance

    Caredact is not a medical device. It does not provide clinical advice, diagnosis or treatment.

    3. Account registration

    3.1 Eligibility

    You must be at least 18 years old to create an account. The Service is designed for use by professionals in health and social care settings.

    3.2 Account security

    You are responsible for maintaining the security of your account credentials. You must:

    • Use a strong password (minimum 8 characters)
    • Not share your login credentials with others
    • Notify us immediately at hello@caredact.com if you suspect unauthorised access

    If your organisation's administrator enables mandatory two-factor authentication, you must set this up before accessing the Service.

    3.3 Accuracy

    You must provide accurate information when registering. We reserve the right to suspend accounts created with false information.

    4. Subscription plans and billing

    4.1 Plans

    The Service is available on the following plans:

    • Free trial: 14 days from account creation, full access to all features
    • Personal: Monthly or annual subscription for individual users
    • Provider: Monthly or annual subscription for organisations (up to 30 users)
    • Enterprise: Custom pricing by agreement

    Current pricing is displayed at https://caredact.com.

    Note checks, which is included in the Provider and Enterprise plans, covers up to 10,000 notes checked a month per organisation as fair use. If you regularly need more, contact us and we will agree a price.

    4.2 Payment

    Payments are processed by Stripe. By subscribing to a paid plan, you agree to Stripe's terms of service. All prices are in GBP and inclusive of VAT where applicable.

    4.3 Renewal and cancellation

    Subscriptions renew automatically at the end of each billing period. You may cancel at any time through the billing portal. Cancellation takes effect at the end of the current billing period — you retain access until then.

    4.4 Refunds

    We do not offer refunds for partial billing periods. If you believe you have been charged in error, contact hello@caredact.com.

    4.5 Changes to pricing

    We may change our pricing with 30 days' notice. Existing subscriptions will continue at their current price until the end of the current billing period.

    5. Acceptable use

    You must not use the Service to:

    • Violate any applicable law or regulation
    • Process data that you do not have lawful authority to process
    • Attempt to access accounts, data or systems belonging to other users or organisations
    • Reverse-engineer, decompile or attempt to extract the source code of the Service
    • Interfere with or disrupt the operation of the Service
    • Use automated tools (bots, scrapers) to access the Service without our written permission
    • Resell or redistribute access to the Service

    6. Data processing

    6.1 Your data responsibilities

    When you use Caredact to process documents containing personal data about third parties (such as service users, patients or children in care), you (or your organisation) are the data controller for that data under UK GDPR.

    You are responsible for:

    • Having a lawful basis for processing the data
    • Ensuring the data is accurate and necessary for your purpose
    • Complying with your own organisation's data protection policies
    • Providing appropriate privacy notices to the individuals whose data you process

    6.2 Our data processing obligations

    When processing personal data contained in your documents, we act as a data processor on your behalf. We will:

    • Process the data only on your instructions and for the purposes of providing the Service
    • Ensure all staff with access to personal data are bound by confidentiality obligations
    • Implement appropriate technical and organisational measures to protect the data (as described in our Privacy Notice)
    • Not engage sub-processors without informing you (current sub-processors are listed in our Privacy Notice)
    • Assist you in responding to data subject access requests
    • Delete or return all personal data upon termination of the Service, at your choice
    • Make available all information necessary to demonstrate compliance

    6.3 Data location

    All processing — including AI inference — takes place within the United Kingdom. Primary infrastructure is hosted on Microsoft Azure (UK South region), AI writing assistance uses Azure OpenAI Service deployed in our UK South tenancy authenticated by managed identity (no static API keys), and transactional email delivery uses AWS Simple Email Service (eu-west-2 / London region). Anonymised text, in which the personal data detected and reviewed has been replaced with placeholders, is the only data submitted for AI processing, and even that does not leave the UK.

    6.4 Security measures

    We implement the following measures to protect your data:

    • TLS 1.2+ encryption in transit
    • AES (Fernet) encryption for PII mappings at rest
    • Platform-managed AES-256 encryption for databases and storage (Microsoft Azure)
    • Bcrypt password hashing
    • Two-factor authentication (TOTP)
    • Rate-limited login attempts
    • JWT token invalidation on logout
    • Full audit trail of all actions

    6.5 Data breach notification

    In the event of a personal data breach affecting your data, we will notify you without undue delay and in any event within 72 hours of becoming aware of the breach, in accordance with UK GDPR Article 33.

    7. AI writing features

    7.1 How AI processing works

    When you use the AI writing features, only the anonymised version of your text is sent to the AI provider. Personal data detected in your text, and reviewed by you, is replaced with typed placeholders (e.g. [PERSON_1], [NHS_NUMBER_1]) before any text leaves our servers. The AI provider receives the placeholders, not the original details that were detected.

    7.2 AI providers

    We use third-party AI providers (currently OpenAI and Anthropic) to provide writing assistance. We may change providers at our discretion. The anonymised text sent to these providers does not contain personal data.

    7.3 AI output

    AI-generated content is provided as a writing aid. You are responsible for reviewing, verifying and approving all output before use. We do not guarantee the accuracy, completeness or suitability of AI-generated content for any particular purpose.

    8. Intellectual property

    8.1 Our intellectual property

    The Service, including its design, code, features and branding (including the Caredact trademark, UK00004348402), is owned by PixelArc Ventures LTD. You may not copy, modify or distribute any part of the Service.

    8.2 Your content

    You retain ownership of all content you upload to or create using the Service. We do not claim any intellectual property rights over your documents or data.

    9. Service availability

    9.1 Availability

    We aim to provide the Service with reasonable availability but do not guarantee uninterrupted access. The Service may be temporarily unavailable for maintenance, updates or circumstances beyond our control.

    9.2 Modifications

    We may modify, update or discontinue features of the Service at any time. For material changes that reduce functionality, we will provide reasonable notice.

    10. Limitation of liability

    10.1 Exclusions

    To the maximum extent permitted by law:

    • The Service is provided "as is" without warranties of any kind, whether express or implied
    • We do not warrant that the Service will detect all personal data in your documents
    • We do not warrant that AI-generated content will be accurate, appropriate or error-free
    • We are not liable for any decisions made based on AI-generated content

    10.2 Liability cap

    Our total liability to you for any claims arising from or related to the Service shall not exceed the total amount you have paid us in the 12 months preceding the claim.

    10.3 Exceptions

    Nothing in these Terms excludes or limits our liability for:

    • Death or personal injury caused by our negligence
    • Fraud or fraudulent misrepresentation
    • Any other liability that cannot be excluded by law

    11. Indemnification

    You agree to indemnify us against any claims, losses or damages arising from:

    • Your use of the Service in violation of these Terms
    • Your processing of personal data in violation of data protection law
    • Any claim by a third party relating to data you have processed using the Service

    12. Termination

    12.1 By you

    You may close your account at any time by contacting hello@caredact.com or through your account settings. Active subscriptions must be cancelled before account closure.

    12.2 By us

    We may suspend or terminate your account if you breach these Terms, with notice where practicable. In cases of serious or repeated breach, we may terminate immediately.

    12.3 Effect of termination

    Upon termination:

    • Your access to the Service will cease
    • Your documents and PII mappings will be deleted in accordance with our retention policy
    • Audit logs will be retained for the period specified in our Privacy Notice
    • Any outstanding subscription fees remain payable

    13. General

    13.1 Governing law

    These Terms are governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

    13.2 Entire agreement

    These Terms, together with our Privacy Notice and Data Processing Agreement, constitute the entire agreement between you and us regarding the Service.

    13.3 Severability

    If any provision of these Terms is found to be unenforceable, the remaining provisions shall continue in full force.

    13.4 No waiver

    Our failure to enforce any provision of these Terms does not constitute a waiver of that provision.

    13.5 Assignment

    You may not assign your rights under these Terms without our prior written consent. We may assign our rights and obligations to a successor in the event of a merger, acquisition or sale of assets.

    13.6 Changes to these Terms

    We may update these Terms from time to time. We will notify registered users by email of material changes at least 30 days before they take effect. Continued use of the Service after changes take effect constitutes acceptance.

    14. Contact

    For questions about these Terms, contact us at: