Privacy notice — iCare AI Chat
iCare Living Limited · Issued as a supplement to existing staff and service-user privacy information
Who we are
iCare Living Limited (company number 08906351). Service/contact address: 105 Burnham Road, Birmingham, West Midlands, B44 8HX. Telephone: 0800 107 3034. Data Protection Officer: Jason Golding, Data Protection Officer / Head of Finance and IT — jason@icareliving.co.uk.
What this tool does
iCare AI Chat is an internal assistant for iCareLiving staff. You add work documents to your own library and ask questions about them in plain English. If you choose to connect your work Google account, it can also answer questions about your email and calendar. Some answers may draw on a web search. Answers are advisory only — they are not decisions, and the tool makes no automated decisions about any member of staff or service user.
What information is used
- Documents you add — policies, handbooks, rotas and other work files you choose to upload. Depending on what you upload, these may contain personal data, including health and social-care information.
- Email and calendar — only if you connect your Google account, and read-only: the tool can never send email or change your calendar. Access is limited to what is needed to answer the question you asked.
- Your questions and the answers — your chat history, stored encrypted on your device.
- Your account — your work email address, used to sign you in.
- Feedback you send us — only when you choose to. If you use the Feedback button, we receive what you typed and, unless you untick the box shown in the form, the app version, which browser you are using and which part of the app you were in. The form lists exactly what it is about to send before you send it. Feedback is linked to your account so we can follow up on it; it is not anonymous, and unticking the box does not make it so.
- Fault reports — when something in the app fails, it records the technical details of that failure automatically: the error message, which part of the app it came from, the app version and your browser. No documents, filenames, questions, answers, email or calendar content are included, and email addresses and access tokens are stripped out of the technical detail before it is sent.
Where your information is stored
Files you upload are stored on your device only. They are encrypted on the device and are never uploaded to, or stored on, a server. Deleting a file from your library, or clearing your browser data, removes it. To answer a question, the text needed for that answer is sent for processing (below) and is not retained by the AI service afterwards.
Who processes it
Processing takes place in the UK and the European Union / EEA, and each provider acts under a written processor agreement (UK GDPR Article 28):
- Google Cloud (Vertex AI) — generates the answers, in Google's EU region. Google is contractually prohibited from using iCareLiving data to train its AI models. Where an answer uses web search, the search query contains generic terms only — the assistant is instructed never to include personal or confidential details in it.
- Cloudflare — relays requests between the app and the AI service at the datacentre nearest you (London for UK users); it stores no content.
- Supabase — provides sign-in, holds the encryption key for your workspace, and stores the feedback and fault reports described above. Hosted in the UK (London).
Transfers from the UK to the EEA are covered by the UK adequacy arrangements.
Lawful basis
Our lawful basis under UK GDPR Article 6 is legitimate interests: supporting the quality, safety, governance and efficiency of our care and support services by giving staff fast access to the documents and information they already use in their role. Where health or social-care information appears in the documents processed, we rely on Article 9(2)(h) (management and provision of health or social care) with the Data Protection Act 2018 Schedule 1, Part 1, paragraph 2 condition. Staff using the tool owe a duty of confidentiality.
Retention
- Uploaded files and chat history stay encrypted on your device until you delete them.
- Text sent to the AI service to answer a question is processed for that request and not retained.
- Fault reports are deleted after 90 days.
- Feedback is kept until it has been acted on and is no longer needed. You can ask us to delete yours at any time using the contact details below.
Your rights
You have rights under data protection law, including access, rectification, erasure, restriction and objection, subject to legal limits. To exercise a right, ask a question, or raise a complaint, contact jason@icareliving.co.uk or call 0800 107 3034. Complaints are acknowledged within 30 days. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
A note on accuracy
The assistant is AI and can be wrong. Always check the source shown under an answer before acting on it — especially for anything involving medication, safeguarding or a person's care.