Privacy and who can see what

The care recipient, the professionals working on the bookings they are attached to, and any family member the care recipient has explicitly authorised — at the level they were given.

Family access is not automatic and not implied by a relationship. Somebody has to grant it, and it can be withdrawn.

Messages, care notes, medical notes and identity documents are encrypted in our systems rather than stored as plain text.

Identity documents are reviewed by our verification team and are never shown to families.

The care recipient invites them and chooses the level of access. There is no default — the level is a deliberate choice each time, because handing someone the care record by accident is not recoverable.

Access can be changed or removed at any time from the family page, and the change takes effect immediately.

Your profile page lists every consent recorded against your account, which version of the policy it was recorded under, and when. If a consent has been withdrawn, that is shown too.

You can withdraw a consent. Withdrawing one that a feature depends on turns that feature off rather than continuing quietly.

No. Real messages and care information are not used for AI development, prompt testing or evaluation. The assistant is tested against synthetic cases written for the purpose.