Privacy Notice

1. Who we are

Doxa Care Solutions, trading as DoxaCare, provides the DoxaCare platform. For personal data about our own customers and website visitors (account holders, billing contacts, enquiries), Doxa Care Solutions is the data controller.

For staff and service-user records that a care provider uploads into its DoxaCare workspace, the care provider is the controller and Doxa Care Solutions acts as a processor, only handling that data on the provider's instructions.

2. Personal data we collect

• Account data — name, work email, phone number, job title, organisation, login credentials.
• Workspace content — staff records, rotas, training and DBS records, documents, absences, timesheets, supervisions and incident reports uploaded by your organisation.
• Support data — messages, attachments and correspondence you send us.
• Usage and technical data — pages viewed, feature usage, device and browser information, IP address, log and audit records.
• Billing contact data — subscription plan, status and periods. Card details are collected and processed by Paddle, not by us.

3. Why we use it, and our legal basis

• Creating and managing accounts, providing the Service — performance of a contract.
• Subscription management, invoicing and tax compliance — contract and legal obligation.
• Customer support — contract and our legitimate interest in helping users.
• Security, fraud prevention and audit logging — legitimate interests in protecting the platform, and legal obligation.
• Product improvement and aggregated analytics — legitimate interests in improving the Service.
• Marketing emails — consent, or legitimate interests for existing customers. You can opt out at any time.

4. Who we share data with

• Service providers / subprocessors — cloud hosting, database and authentication infrastructure, email delivery, error monitoring and analytics tooling.
• Paddle, our Merchant of Record, for sale of subscriptions, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where we are required to disclose by law or to protect legal rights.

We do not sell personal data.

5. International transfers

Data is hosted in the UK or EEA where possible. Where a provider processes data outside the UK or EEA, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Addendum, or Standard Contractual Clauses.

6. Retention

We keep account and workspace data for as long as your subscription is active. After termination, workspace data is available for export for 30 days and is then deleted or anonymised, unless we must keep it longer to meet legal, tax or audit obligations. Audit logs and billing records are retained for up to 7 years.

7. Your rights

Under the UK GDPR you have the right to access your data, correct inaccurate data, request erasure, restrict or object to processing, request portability, and withdraw consent where processing is based on consent. We respond within one month. If your data sits inside a care provider's workspace, please contact that provider first — we will forward and support such requests.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, per-organisation data isolation enforced at database level, role-based access control, least-privilege access for our staff, and audit logging of sensitive actions.

9. Cookies

We use essential cookies and local storage to keep you signed in and to secure your session — these cannot be switched off. Where we use analytics cookies to understand feature usage, they are set only with your consent. We do not use advertising cookies. You can clear or block cookies in your browser settings, though the Service may not work correctly without essential cookies.

10. Contact

Privacy questions or rights requests: privacy@doxacare.com.