Privacy Policy

This Privacy Policy explains how CQCLogic Ltd (“CQCLogic”, “we”, “us”, or “our”) collects, uses, stores, and protects your personal data when you use our website at cqclogic.co.uk and our platform at app.cqclogic.co.uk.

We are committed to protecting your privacy and processing your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. What data we collect

1.1 Data you provide to us

When you use CQCLogic, you may provide us with:

• Identity data — your name and job title
• Contact data — your email address
• Organisation data — your care service name, CQC Location ID, and service type
• Payment data — billing details processed by Stripe (we do not store card numbers)
• Communications data — messages you send us by email or through the platform

1.2 Data we collect automatically

When you visit our website or use our platform, we automatically collect:

• Usage data — pages visited, features used, time spent on the platform
• Technical data — IP address, browser type, device type, operating system
• Cookie data — see our Cookie Policy for full details
• Advertising and campaign data — when you arrive from an advert we record the campaign details in the link (such as the source, campaign and landing page) and, only if you have accepted marketing cookies, the advertising click identifier supplied by the ad platform (for example Google’s gclid, gbraid or wbraid, or Microsoft’s msclkid). We use these to measure which adverts lead to sign-ups and purchases.

1.3 Data from third parties

We retrieve publicly available CQC inspection data from the Care Quality Commission’s public register (api.cqc.org.uk) using your CQC Location ID. This data is already in the public domain. We use it solely to generate your improvement plan.

Advertising platforms. Advertising platforms such as Google Ads give us the click identifier and campaign details described above when you click one of our adverts.

2. How we use your data

We will never sell your personal data to third parties or use it for purposes unrelated to providing the CQCLogic service.

3. Who we share your data with

We share your data only with trusted service providers who process it on our behalf:

• Supabase — database and authentication infrastructure (EU data residency)
• Stripe — payment processing (PCI DSS compliant)
• Anthropic — AI processing for plan generation (data is not used to train models)
• Brevo / Resend — transactional and marketing email delivery
• n8n — workflow automation (self-hosted)
• PDFShift — PDF generation for improvement plans
• Hostinger — hosting infrastructure
• Google (Google Ireland Limited / Google LLC) — Google Analytics, Google Tag Manager and Google Ads, used for measurement, conversion tracking and advertising, and only after you accept the relevant cookies
• Microsoft (Microsoft Clarity) — heatmaps and session replays on our website and landing pages, only after you accept analytics cookies. Clarity receives your device and browser type, approximate location from your IP address, the pages you view and how you interact with them. Microsoft acts as our processor.
• CookieYes — our cookie consent tool, which records your cookie choices so we can respect them
• OpenAI — provides the AI assistant inside the app. Only the messages you type into the assistant are sent to OpenAI (not your account details), and we do not keep a record of those conversations. Please do not enter personal information about the people you support. OpenAI handles this data under its API terms, under which API inputs are not used to train its models by default.

All third-party processors are bound by data processing agreements and are required to handle your data in compliance with UK GDPR.

When we report a purchase back to Google Ads, we send only the advertising click identifier, the date and time, and the value of the purchase excluding VAT. We do not send your name, email address or any details about your care service.

We do not transfer your personal data outside the UK or EEA except where Standard Contractual Clauses or equivalent safeguards are in place.

Google and Microsoft may process data outside the UK and EEA. Where they do, they rely on approved transfer mechanisms such as the UK International Data Transfer Addendum or an adequacy decision.

4. How long we keep your data

When your account is deleted, we remove your personal data within 30 days except where we are required to retain it for legal or tax purposes.

5. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data (“right to be forgotten”)
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — request your data in a portable format
• Right to object — object to processing based on legitimate interests, including direct marketing
• Rights related to automated decision-making — request human review of automated decisions
• Right to withdraw consent — you can change or withdraw your cookie choices at any time using the cookie preferences button on our website and app. Withdrawing consent does not affect processing before you withdrew it.

To exercise any of these rights, email us at hello@cqclogic.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

6. Cookies

We use cookies and similar tracking technologies on our website and platform. For full details of the cookies we use and how to manage them, please see our Cookie Policy.

We only set analytics and advertising cookies, and only store advertising click identifiers, after you accept them in our cookie banner. If you reject them, we will not store them, and the free preview, sign-up and purchase still work.

7. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit (TLS) and at rest
• Access controls limiting who can access personal data
• Regular security reviews of our infrastructure
• Magic link authentication to avoid password storage risks

Despite these measures, no system is completely secure. If you believe your data has been compromised, contact us immediately at hello@cqclogic.co.uk.

8. Children

CQCLogic is a business-to-business service intended for use by care providers and their staff. We do not knowingly collect personal data from individuals under the age of 18.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a notice on our platform. The “Last updated” date at the top of this page reflects the most recent version.

11. Associated brands and cross-brand marketing

CQCLogic is part of a group of compliance and care management products operated by the same holding company. Associated brands currently include CareConnect and nestIQ, along with any other products we may develop or acquire in future.

The data controller for all products in this group is the holding company responsible for CQCLogic.

Where you have given your explicit consent — for example by ticking the opt-in checkbox on one of our forms — we may send you information about compliance and care management tools from these associated brands. Your consent covers email communications about products and updates from CareConnect, nestIQ, and other brands in the same portfolio.

How to opt out: You can withdraw your consent at any time by:

• Clicking the unsubscribe link in any marketing email we send you
• Emailing us at hello@cqclogic.co.uk and asking to be removed from cross-brand communications

Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it, and will not affect your access to CQCLogic products.

10. Contact us

For any questions about this Privacy Policy or how we handle your personal data, contact us at:

CQCLogic Ltd
Email: hello@cqclogic.co.uk
Website: cqclogic.co.uk