Privacy Policy

1. Introduction

Verioos Ltd ("we", "our", "us") is committed to protecting your privacy. This policy explains what personal data we process when you use the Verio Care Operating System, why we process it, and the rights and choices you have. We process data for each care organisation in a separately isolated tenant — data from one provider is never mixed with another's.

2. What we collect

• • Account data — name, work email, organisation, and the role you are assigned.
• • Usage data — sign-ins, devices used, pages and features you access, for security and audit purposes.
• • Care data you enter — availability, rota preferences, shift logs, medication records, supervision notes, recognition evidence and feedback. This is processed under your organisation's instruction and control.
• • Device and session data — browser type, approximate location where needed for shift check-in, and session identifiers to keep your sign-in secure.

3. Purpose limitation and field-level permissions

We only collect and use data for the purpose it was given. Access to personal data is limited by field-level permissions: you see only the data your role needs. For example, a Carer sees their own availability, credits and wallet; a Coordinator sees allocation-relevant facts but not sensitive HR adjustments; a Recognition panel sees controlled evidence packs but not a public ranking. Sensitive HR data and private feedback are protected and only reachable through a consent or safety route.

4. Legal basis

We process personal data under: your consent (where you have given it, e.g. for optional feedback); performance of a contract with your organisation; our legitimate interests in security, improvement and fraud prevention; and legal obligations (e.g. safeguarding and records law). Where data includes health or other special-category information, processing is limited to what is necessary for care, employment and social security purposes, under Article 9(2)(h).

5. How we share data

• • We do not sell personal data.
• • Data is shared with your care organisation (the tenant) and, where needed, with sub-processors such as hosting and payment providers, under contract and only to provide the Service.
• • We may share aggregated, anonymised statistics that cannot identify individuals.
• • We may disclose data where required by law or to protect someone's life or safety.

6. Security

We apply least-privilege access controls, encryption in transit and at rest, per-tenant isolation, session and device controls, and continuous audit monitoring. Our staff access is role-limited and logged.

7. Data retention

We keep personal data only as long as needed for the purposes in this Policy or to meet legal, regulatory, safeguarding and tax requirements (for example, payroll and care records retention periods). When data is no longer needed, it is securely deleted.

8. Your rights

You have the right to access, correct, erase or restrict the data we hold about you, to object to processing, to data portability, and to withdraw consent where consent is the basis. To exercise any of these rights, use the data-subject route in your portal, contact your organisation's administrator, or email sboniface@c2flexicare.co.uk. You can also raise a concern with your local data protection authority.

9. Family portal

The Family Portal shares only the updates a family member is authorised to see, such as shift summaries and wellbeing notes. It never exposes other clients' data, internal rankings or payroll information.

10. Cookies and session controls

We use essential cookies and session controls to keep you signed in securely. "Remember this device" is optional and can be changed in your session and device settings at any time.

11. Changes to this Policy

We may update this Policy. Changes are versioned and effective-dated and you will be notified on your next sign-in. Continued use of the Service means you accept the updated Policy.

12. Contact

For privacy enquiries, contact our Data Protection Officer at sboniface@c2flexicare.co.uk or write to: Unit 5, Midshires Business Park, Smeaton Close, Aylesbury HP19 8HL.