Legal
Privacy policy
[bracketed] value with your real details and have a solicitor review it — particularly the data
processing sections, which describe a system handling health data about identifiable people.
This policy explains how [Company legal name] ("we", "us") handles personal data when you use the eMAR website and platform. We are registered in England and Wales, company number [number], registered office [address], and registered with the Information Commissioner's Office under reference [ICO number].
1. Two different roles
This distinction matters more than anything else in this policy.
- We are the controller for data about our own customers and website visitors — the people who sign up, log in, contact us and read this site.
- We are a processor for the care records inside the platform. Residents' medication records, care notes and observations belong to the care home. The care home decides what goes in them and why; we process that data on its documented instructions under a data processing agreement.
If you are a resident or a relative and want to know what is held about you, contact the care home — they are the controller and hold the relationship. We will support them in answering you.
2. What we collect as controller
| Data | Why | Lawful basis |
|---|---|---|
| Name, work email, phone, job role, organisation | Creating and running your account, support | Contract |
| Authentication data (hashed password, session tokens, 2FA settings) | Keeping accounts secure | Contract / legitimate interests |
| Billing details and invoices | Taking payment, statutory records | Contract / legal obligation |
| Support correspondence | Answering you and improving the product | Legitimate interests |
| Website analytics and server logs | Security, fraud prevention, understanding usage | Legitimate interests / consent where required |
3. What we process on behalf of care homes
Inside the platform, the care home records health data about identifiable people — special category data under UK GDPR Article 9. That typically includes residents' names, dates of birth, NHS numbers, room and bed, allergies, prescribed medication, administration records, observations, wounds, care notes and movements, plus records of which staff member did what and when.
We do not decide what is recorded, we do not use it for our own purposes, and we do not sell it. We use it to provide the service, keep it secure, and — where we need to diagnose a fault — only to the minimum extent needed and under the care home's instructions.
4. Staff data
Every entry in a care record carries the name of the person who made it. That is a requirement of good record-keeping, not a monitoring feature, and it is why staff cannot share logins. Clock-in and clock-out times are recorded where the care home uses rostering, and are visible to that home's managers.
5. Who we share it with
- The pharmacy your care home links to, for the residents it supplies — this is the point of the platform and the care home controls the link.
- Sub-processors who host and run the service. Current list: [hosting provider, region], [email provider], [payment provider]. We keep this list current and will tell you before we add one.
- Nobody else, unless the law requires it or you ask us to.
6. Where it is stored
Data is stored in [region — e.g. the United Kingdom]. Where any processing happens outside the UK we rely on an adequacy decision or the International Data Transfer Agreement.
7. How long we keep it
Care records are kept for as long as the care home instructs, in line with its own retention schedule and the retention periods expected of health and social care records. Our own customer and billing records are kept for [period] after the account closes. When a care home leaves, we return or delete its data on request.
8. How we protect it
- Encryption in transit, and at rest at the storage layer
- Passwords stored hashed; optional two-factor authentication on every account
- Role-based access — staff see only their own home, pharmacies only the homes they supply
- An audit trail of actions taken in the platform
- Access to production data restricted to named staff and logged
9. Your rights
Under UK GDPR you can ask for access, correction, erasure, restriction, portability, and to object to processing based on legitimate interests. Where we are the processor, send the request to the care home. Where we are the controller, email privacy@emarsystem.com and we will respond within one month.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first.
10. Cookies
The platform sets a session cookie so you stay logged in, and a preference cookie for light or dark mode. These are strictly necessary. [If you add analytics or marketing cookies, list them here and put a consent banner in front of them.]
11. Changes
We will post any change here and, if it materially affects you, tell you by email.
12. Contact
[Company legal name], [address]. Email privacy@emarsystem.com. Data protection contact: [name or role].