Privacy policy

AlphaOmega is a homecare management platform provided by Alpha Omega Technologies Ltd, whose registered office is at 102 Andrewes Street, Leicester. In this policy “we”, “us” and “our” mean Alpha Omega Technologies Ltd.

Questions about this policy or about your personal data can be sent to alphaomegacare94@gmail.com.

Care providers (our “customers”) use AlphaOmega to run their services: rotas, carer records, client care records, visits, training and payroll. Who is responsible for your data depends on how you come into contact with us.

When we act for a care provider (processor)

If you are a client receiving care, a family member or contact of a client, or a carer or member of staff of a care provider, your care provider decides what information is recorded about you and why. They are the controller of that data and we process it on their behalf, under a written agreement and only on their instructions.

To access, correct or delete that information, or to ask a question about it, please contact your care provider. If you contact us instead we will pass your request to them, and help them respond to it.

When we decide how data is used (controller)

We are the controller for:

• visitors to our website and people who contact us or ask for a demonstration;
• the business contact details of people at our customers, used to run our relationship with them;
• our own platform administrators; and
• technical and security data we need to run, secure and improve the service as a whole, such as security logs and crash reports.

Inside the platform, for care providers

• Account data: name, work email address, role, password (stored only as a one-way hash), two-factor authentication settings and the devices you are signed in on.
• Carer and staff records: contact details, employment and availability information, training and compliance records, documents such as right-to-work and DBS evidence, timesheets, mileage and expense claims, and pay information.
• Client care records: contact details, care plans, visit schedules, tasks, medication records, observations, notes, incident reports, photographs and signatures. This includes health information, which is special category data under UK GDPR.
• Visit verification: when a carer checks in or out of a visit in the carer app, the device’s location at that moment, or the scan of a QR code at the client’s home. The app does not track location between visits or in the background.
• Messages and attachments sent through the platform’s messaging features.

Technical and security data

• IP address, browser or device type and app version when you use the service;
• an audit trail of sign-ins and changes made to records, which care providers need to meet their own regulatory obligations;
• push notification tokens for the carer app, so we can deliver notifications to your phone; and
• crash reports when the website or carer app fails unexpectedly: the error, the screen it happened on (with any links or codes removed), the app version and the device type.

From website visitors and prospective customers

• what you tell us when you email us or ask for a demonstration; and
• if analytics are enabled on our marketing website, aggregate page-view statistics collected without cookies (see Cookies and similar technologies).

Where we act for a care provider, we use the data only to provide the platform to them as our agreement with them sets out. Where we are the controller, we rely on these lawful bases:

Care providers process health information to provide health and social care, which UK GDPR permits under Article 9(2)(h) and the Data Protection Act 2018. We do not use care records for our own purposes. We do not sell personal data, use it for advertising, or make decisions about anyone by automated means alone.

We keep these to the minimum the service needs:

• Sign-in cookie (strictly necessary): a secure, HTTP-only cookie that keeps you signed in to the web app. It cannot be read by scripts on the page, and without it you could not stay signed in.
• Preferences (strictly necessary): your choice of light or dark theme, stored in your browser.
• Sign-in session storage (strictly necessary): a short-lived sign-in token kept in your browser’s session storage for the web app (cleared when you close the tab), or in local storage for the family portal, until you sign out.
• Carer app storage: the app stores your sign-in on your device’s secure keychain or keystore, and keeps an encrypted copy of your upcoming visits so it can work without signal. Signing out removes both, and none of it is included in iCloud, Google or computer backups.

We do not use advertising or cross-site tracking cookies. If we measure visits to our marketing website, we do so with an analytics tool that sets no cookies, stores nothing on your device and does not identify you, and only on the public website, never inside the platform. Because these technologies are strictly necessary, or store nothing on your device, we do not show a cookie banner.

We use carefully chosen service providers (“sub-processors”) who handle data only on our instructions and under contracts that protect it:

We may also share data when the law requires it, to protect someone’s vital interests, or with a buyer of our business under the same protections. We tell care providers before we add or replace a sub-processor.

We aim to keep personal data in the UK or European Economic Area. Where a provider handles it elsewhere (for example, delivering a push notification through Google or Apple), the transfer is protected by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, as the law requires.

Care providers decide how long their care and staff records are kept, often for years because health and social care regulations require it. Records are archived rather than deleted when someone leaves, and are then deleted automatically at the end of the provider’s retention period. Unless the provider sets longer periods, these are:

When a care provider stops using AlphaOmega, we give them a full export of their data and files and then delete it, as our agreement with them sets out.

We keep our own records only as long as we need them: account and contract records for the life of the relationship and the limitation period after it; security logs and crash reports for a limited period for investigating problems. Short-lived security data expires by itself: password reset links stop working after a short time, and records of failed sign-in attempts are cleared automatically.

• all traffic to the website, the API and the carer app is encrypted in transit (HTTPS);
• passwords are stored only as salted one-way hashes, and two-factor authentication is available;
• repeated failed sign-ins temporarily lock the account, and administrative actions are recorded in an audit trail;
• each care provider’s data is kept separate from every other’s;
• the carer app encrypts the records it stores on the phone, keeps sign-in details in the phone’s secure storage, can require Face ID, a fingerprint or a passcode to open, and wipes local data on sign-out;
• access to production systems is limited to staff who need it.

Under UK data protection law you have the right to:

• access the personal data held about you;
• have inaccurate data corrected;
• have data deleted, or its use restricted, in some circumstances;
• object to processing based on legitimate interests;
• receive data you provided in a portable format, in some circumstances; and
• withdraw consent, where processing is based on consent.

For care and staff records, send your request to your care provider, because they are the controller (see Our role). Care records may have to be kept for a minimum period by law, so a deletion request cannot always be met in full. For everything else, write to alphaomegacare94@gmail.com. We will reply within one month.

Carer app accounts are created by your employer, not by you, so access is closed by your employer. To have your account closed or your data deleted, ask your care provider. We will act on their instruction.

AlphaOmega is a professional tool for care providers and is not aimed at children. Where a care provider supports a child, that child’s records are processed on the care provider’s instructions like any other client record.

If you are unhappy with how your data has been handled, please contact us first at alphaomegacare94@gmail.com so we can try to put it right. We will acknowledge your complaint within 30 days of receiving it, look into it, keep you updated, and tell you the outcome without undue delay. If your complaint is about records a care provider holds about you, we will pass it to them, because they decide how those records are used. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

We will update this policy when our practices change. The date at the top shows when it last changed, and we will tell our customers about significant changes before they take effect. You can also read our Terms of use.