Privacy Policy

1. Introduction

Verioos Ltd ("we", "our", "us") is committed to protecting your privacy. This policy explains what data we collect, why we collect it, and what we do with it.

2. What data we collect

We may collect the following types of personal data:

• • Name, email address, phone number and job title
• • Organisation name, role and service type
• • Care records entered into the platform (including special category data)
• • Usage data, device information and IP address
• • Communication preferences and correspondence

3. How we use your data

We use your data to:

• • Provide, maintain and improve our care management platform
• • Process bookings, respond to enquiries and deliver support
• • Comply with legal and regulatory obligations (including CQC)
• • Send service updates, security alerts and product communications
• • Generate anonymised analytics to improve our services

4. Legal basis

We process personal data under the following lawful bases: contract (to deliver our services), legitimate interests (to operate our business), and consent (for marketing communications). Special category data (health and social care records) is processed under Article 9(2)(h) — the provision of health and social care.

5. Data sharing

We never sell your personal data. We may share data with:

• • Regulators (e.g. CQC, Care Inspectorate) where required by law
• • Trusted sub-processors (hosting, analytics, support) under strict contracts
• • Health and social care professionals with consent or in a safeguarding situation

6. Data retention

We retain personal data for as long as needed to deliver our services and comply with legal obligations. Care records are retained per regulatory guidance (typically 8 years after discharge for adults, or until the individual's 27th birthday for children).

7. Your rights

Under UK data protection law you have the right to: access your data, rectify inaccuracies, erase your data (subject to legal retention), restrict processing, data portability, and object to processing. To exercise any right, email sboniface@c2flexicare.co.uk.

8. Security

Data is encrypted in transit and at rest. We follow ISO 27001 and Cyber Essentials Plus standards. Access is controlled by permissions and full audit trails.

9. Contact

For privacy enquiries, contact our Data Protection Officer at sboniface@c2flexicare.co.uk or write to: Unit 5, Midshires Business Park, Smeaton Close, Aylesbury HP19 8HL.