Privacy Policy

Care Atlas is the application and website available at https://www.careatlas.co.uk. Care Atlas provides care consultancy, recruitment, training, tender navigation, booking and related support for UK care providers, founders, candidates and professionals.

Care Atlas is the controller for personal information collected through this website and application unless a separate customer agreement says otherwise. The Care Atlas application is developed and technically supported by Cosmonaut Labs as a technology provider.

TODO: Confirm and publish the full legal entity name, company number and registered office or registered contact address for the controller. The repository currently exposes the trading/app name "Care Atlas" and contact email admin@careatlas.co.uk, but it does not contain verified company registration details.

For privacy questions, access requests or deletion requests, contact admin@careatlas.co.uk.

We collect information that visitors choose to send through contact forms, booking forms, tender enquiries, checkout flows, recruitment forms, newsletter forms, email, telephone and other communications.

This may include contact details, organisation details, role, location, service requirements, consultation notes, recruitment details, training interests, tender preferences, payment status, consent records and communication history.

We also collect limited technical data needed to operate and secure the website, such as IP address, browser type, device information, pages visited, timestamps, cookie identifiers, form metadata, error logs and security logs.

If account features are enabled, we process account details to create or connect an account, authenticate users, maintain sessions, prevent duplicate accounts, provide account-related support, protect the platform and keep appropriate audit records.

Users are responsible for ensuring that any information, documents or third-party data they submit to Care Atlas is accurate and shared with appropriate authority.

Users may choose to sign in using Google where Google sign-in is enabled. In that case, Care Atlas may receive the user's Google account identifier, name, email address and profile image. Care Atlas uses this information to authenticate the user, create or connect their Care Atlas account, maintain their session, prevent duplicate accounts, provide account-related support and protect the platform.

Care Atlas does not receive or store the user’s Google password.

The current backend implementation also includes an authenticated Google Calendar connection for authorised Care Atlas users. This connection requests Google Calendar permissions for scheduling features: checking free or busy availability, creating consultation or training events, adding attendees, creating a Google Meet conference link, updating booking records and cancelling events when required.

For the Calendar integration, Care Atlas may process the connected Google account email address, calendar identifier, free or busy availability, event title, event description, start and end time, time zone, attendee email addresses, meeting location, Google Meet link, event status and Google event identifiers.

Care Atlas does not access Gmail, Google Drive, Contacts, Photos, Google Cloud resources, BigQuery data, App Optimize data, App Topology data, YouTube data or other Google content through the current implementation.

Google-derived account information and Google Calendar data are not sold. They are not used for targeted advertising, retargeting, credit decisions, unrelated profiling, or to train general-purpose or unrelated AI or machine-learning models.

Google-derived data is shared only with processors necessary to host, secure, maintain and support the application, with Google services required to provide the OAuth and Calendar functionality, with authorised Care Atlas staff or technical support providers where necessary, or when legally required.

Care Atlas's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We may use cookies and similar technologies to operate the website, remember preferences, protect forms from misuse, understand website performance and improve the user experience.

Non-essential analytics or marketing cookies should only be used where appropriate consent has been obtained. More information is available on the Cookie Policy.

We share personal information only where needed to operate Care Atlas, provide requested services, process payments, host and secure the application, provide support, comply with law, protect rights or work with trusted providers acting on our behalf.

Processors and service providers may include hosting providers, database providers, email providers, payment processors, CRM or enquiry tools, booking tools, analytics or error monitoring providers, security tooling, document storage providers, professional advisers and technology support providers including Cosmonaut Labs.

We do not sell personal information or Google user data. We require service providers to protect personal information and use it only for the services they provide to us.

We use appropriate technical and organisational measures to protect personal information and Google user data against unauthorised access, loss, misuse, alteration or disclosure.

These measures include HTTPS, access controls, authentication controls, restricted staff access, secure credential handling, encrypted token storage where implemented by the backend, logging, monitoring, supplier due diligence and limiting access to people or providers who need it for support, security, legal or operational purposes.

No online system is completely risk free. Users should avoid submitting unnecessary sensitive information through general website forms and should connect only the Google accounts or calendars needed for the feature they intend to use.

We keep personal information only for as long as needed for the purpose it was collected, including to provide services, maintain accounts, manage bookings, keep business records, meet legal obligations, resolve disputes and protect legitimate business interests.

Google-derived account information is retained while the account is active and afterwards only where necessary for security, legal, accounting or dispute-resolution requirements.

Google Calendar OAuth tokens and calendar connection records are retained while the Calendar connection remains active or while needed to manage bookings, maintain audit records, troubleshoot issues, meet legal obligations or resolve disputes.

Depending on your circumstances, you may have rights to access your personal information, correct inaccurate information, request deletion, restrict processing, object to processing, request data portability, withdraw consent and complain to a data protection authority.

To exercise these rights, email admin@careatlas.co.uk. We may need to verify your identity before responding.

Users may revoke Google access through their Google Account permissions.

Revoking OAuth permission stops future Google access but may not automatically delete information already lawfully retained by Care Atlas. To request deletion of Google-derived data associated with Care Atlas, email admin@careatlas.co.uk with the Google account email address connected to Care Atlas.

You also have the right to complain to the UK Information Commissioner's Office.

We may update this Privacy Policy from time to time. The latest version will be published on this page with the updated date.

If we make material changes to how we use personal information or Google user data, we will take reasonable steps to notify affected users where required.