CEVERO Care privacy policy

Last updated: 1 October 2026

1. Who we are

CEVERO Care is a care management app for home care and supported living providers. It is provided by Cevero Groups Ltd, 35 Germander Place, Milton Keynes, MK14 7DW, United Kingdom (“Cevero”, “we”, “us”).

This policy explains what personal information the CEVERO Care mobile app and web portal (together, “the app”) collect, why, and what choices you have. It applies alongside the CEVERO Care terms of use. Our website has its own website privacy policy.

2. Who this policy covers

• Care company staff: administrators, coordinators and managers who use the web portal.
• Care workers: staff who use the mobile app to see their visits, record care and check in and out.
• Family members: relatives or representatives invited by a care company to the family portal.
• People who receive care: clients whose care records a care company keeps in the app.

3. Our role with care records

A care company that uses CEVERO Care decides what information it records about its clients and staff and why. For that information the care company is the data controller and Cevero is its data processor: we hold and process it only on the care company’s instructions and under a written agreement with them.

Cevero is the data controller for the information we need to run the service ourselves: user accounts and sign-in, billing, support requests, security and service logs.

If you receive care, or work for a care company, and have a question about your care or staff record, please contact that care company first. We will help them answer you.

4. Information we collect

Account information

Your name, email address, phone number, role and the care company you belong to. Your password is never stored in readable form. If you turn on two-step verification we store what is needed to check your codes.

Staff records entered by a care company

Employment details, DBS and right-to-work checks, training and supervision records, availability, pay rates and timesheets.

Care records entered by a care company

Client details, care plans, risk assessments, medication and eMAR records, visit notes, incidents and other information about a person’s health and care. This includes special category data about health.

Visit and location information

When a care worker checks in or out of a visit, the app records the time and the device’s location to confirm that the visit took place. Location is used for this purpose only and is not used to track care workers outside their visits.

Messages, photos and files

Messages sent in the app, and photos, documents and signatures that users choose to upload.

Family portal information

A family member’s name, email address, relationship to the client and the client they are linked to, and any visit reviews they submit.

Device and technical information

Device type, operating system and app version, the token needed to send you notifications, IP address, sign-in records, error and crash reports. We use this to keep the app working and secure.

We do not use the app to show advertising and we do not sell personal information.

5. How we use information

• To provide the app: schedules, visits, care records, messages, invoicing and payroll reports for the care company.
• To send notifications you need, such as new or changed visits, messages and alerts.
• To confirm visits took place, using check-in and check-out times and location.
• To keep accounts and data secure, prevent misuse and investigate problems.
• To provide support, and to improve and fix the app.
• To meet our legal obligations.

Under UK data protection law, we rely on these lawful bases: performing our contract with the care company or with you; our legitimate interests in running a secure and reliable service; and legal obligations. Care companies are responsible for the lawful basis for the care records they keep, which for health information is usually the provision of health or social care.

6. App permissions

The mobile app may ask for the following permissions. You can refuse or withdraw them in your phone’s settings, although some features will then not work.

• Location: to confirm check-in and check-out at a visit.
• Camera and photos or files: to attach a photo or document when you choose to.
• Notifications: to tell you about visits, messages and alerts.

7. Who we share information with

• Your care company, and the people it gives access to in the app.
• Service providers who help us run the app, such as cloud hosting, email and text message delivery, and push notification services (Google Firebase Cloud Messaging and Apple Push Notification service). They act on our instructions and must protect the information.
• Authorities and regulators when the law requires it, or to protect someone’s safety.
• A buyer or successor of our business, under the same protections, if the business changes hands.

8. Where information is stored

The app’s data is hosted in the United Kingdom. Where a service provider handles information outside the UK, we make sure there are appropriate safeguards, such as the UK International Data Transfer Agreement or an adequacy decision.

9. How long we keep information

We keep account information for as long as the account is active and for a reasonable period afterwards to deal with questions, disputes and legal requirements. Care and staff records are kept for as long as the care company instructs us, in line with the retention periods that apply to care providers. When a care company stops using CEVERO Care, we return or delete its data as set out in our agreement with them.

10. How we protect information

• Information is encrypted in transit, and sensitive fields are encrypted when stored.
• Each person only sees what their role allows, and each care company’s data is kept separate.
• Two-step verification is available for accounts, and important actions are recorded in an audit log.

No system is completely secure. If we become aware of a breach that affects your information, we will act quickly and tell the care company, you and the regulator where the law requires.

11. Your rights

Under UK data protection law you have the right to ask for a copy of your information, to have it corrected, to have it deleted, to restrict or object to its use, and to receive it in a portable format. Some rights have limits, for example where a care company must keep a record by law.

For care and staff records, contact your care company. For your account, or if you are not sure who to ask, contact us using the details below. We respond within one month.

You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to help first.

12. Deleting your account

You can ask for your CEVERO Care account and its personal information to be deleted at any time:

1. Ask the administrator at your care company to remove your account, or
2. Email info@cevero.co.uk from the email address you use to sign in, with the subject “Delete my CEVERO Care account”.

We will confirm the request and complete it within one month. Your sign-in details, contact details and device information are deleted. Records that a care company must keep by law, such as visit and care records, are kept by the care company for the required period, with your personal details removed where the law allows.

13. Children

The app is for adults. Accounts are only for people aged 18 or over, and we do not knowingly collect information directly from children.

14. Changes to this policy

We may update this policy when the app or the law changes. The date at the top shows when it last changed. If a change is significant, we will tell users in the app or by email.

15. Contact us

Cevero Groups Ltd, 35 Germander Place, Milton Keynes, MK14 7DW
Email: info@cevero.co.uk
Phone: 01332 949721