CareFlow AI helps care homes turn staff voice notes into transcribed, triaged, actioned tasks with a full audit trail. This policy explains what personal data we handle, why, and what rights you have. It is written to comply with the UK GDPR and the Data Protection Act 2018.
AHG International ("we", "us") operates CareFlow AI. Contact: kiranaudit@mac.com.
We act in two distinct roles:
| Data | Examples | Why |
|---|---|---|
| Manager accounts | Name, work email, salted password hash | Sign-in, audit trail of manager actions (contract) |
| Staff records | Name, work email/phone, role, language, prompt times | Sending personal recording links and task notifications (customer's instructions) |
| Notes & tasks | Voice recordings, transcripts, translations, AI summaries, task instructions, resolutions | The core service (customer's instructions) |
| Audit events | Who submitted, allocated, resolved and when | Care-quality evidence; nothing is ever silently deleted (customer's instructions) |
| Billing | Subscription status, Stripe customer reference | Payment for the service (contract). We never see or store card numbers — payment is handled by Stripe. |
Sensitive data: voice notes made by care staff may include health and care information about residents or colleagues. That content is processed strictly on the care home's behalf and under its instructions; the care home remains responsible for what belongs in a resident's formal care record.
The database and voice recordings are stored with Supabase on AWS in London (eu-west-2), encrypted at rest and in transit. Every query is isolated per care home organisation; staff access is through unique personal links that reach only that person's own notes and tasks.
| Provider | Purpose | Location |
|---|---|---|
| Supabase (on AWS) | Database, file storage, application functions | UK (London, eu-west-2) |
| Vercel | Website hosting (static pages only — no note content) | Global CDN |
| OpenAI | Speech-to-text transcription of voice notes | US |
| Anthropic | AI translation, summarising and urgency triage of notes | US |
| Resend | Email delivery (prompts, task and alert emails) | US/EU |
| Stripe | Subscription payments | US/EU |
OpenAI and Anthropic process note content under their API data processing terms and do not use API data to train their models. Transfers outside the UK rely on the UK International Data Transfer Addendum / Standard Contractual Clauses and, where applicable, the UK–US Data Bridge.
All traffic is encrypted with TLS. Data is encrypted at rest. Passwords are stored only as salted hashes. Database access is service-role only with per-organisation isolation on every query; there is no public database access. Staff links can be deactivated instantly by a manager if a device is lost. Manager actions are individually attributed in the audit trail.
We use no advertising or analytics trackers. The manager board stores a sign-in session token in your browser's local storage; that is the only thing we place on your device, and it is removed when you sign out.
Under UK GDPR you can ask for access to, correction of, deletion of, or a copy of your personal data, and you can object to or ask us to restrict processing. Email kiranaudit@mac.com and we will respond within one month. If your data is in the service because your employer (a care home) uses CareFlow AI, we may need to refer your request to them as the data controller. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
If we make material changes to this policy we will notify customers by email and update the date at the top of this page.