Trust centre
How we look after care data
Care and health data is some of the most sensitive information there is. This page explains, in plain language, the controls in the product today and where responsibility sits between us and your organisation.
This page is maintained by Ivy Technology Ltd to answer common security and privacy questions about Ivy Care Connect and Ivy RM. It describes our own practices and is not an independent audit, certification or accreditation. Where a formal assurance document is required for procurement, contact us and we will complete your own information-governance return.
Registrations & assurance
Where we hold a registration or have completed an assessment, we say so plainly — and where we are still working towards something, we say that too.
CQC registered provider
Ivy Care Services Ltd — the homecare service behind Ivy Technology — is registered with the Care Quality Commission as a provider. Provider details are available on request for your procurement pack.
NHS Data Security & Protection Toolkit
We have published a DSPT assessment with a status of Standards Met. This is our own annual self-assessment against the National Data Guardian standards, not an external audit, and we republish it each year.
Cyber Essentials
We are working towards Cyber Essentials certification and are not certified yet. We will update this page and tell existing customers as soon as certification is confirmed.
Controls in place today
Access & authentication
Every account signs in with an individual credential — no shared logins. Provider, professional and family users only see the records their organisation is party to.
Role-based permissions
Permissions are scoped by role (registered manager, care staff, ward or brokerage team, family) so people see the minimum they need to do their job.
Platform & hosting
Ivy Care Connect and Ivy RM run on managed cloud infrastructure with encryption in transit over HTTPS/TLS and encryption of data at rest provided by our hosting platform.
Auditable records
Referrals, placement decisions and financial-threshold outcomes are recorded with a timestamp and the acting user, so decisions can be evidenced later.
Retention & deletion
Records are kept only as long as the commissioning organisation's retention schedule requires, then deleted. We will confirm your specific schedule in writing as part of onboarding.
Incident response
Suspected data incidents are triaged by our team and reported to affected controllers without undue delay so statutory notification duties can be met.
What data we handle
- Contact and enquiry details submitted through our forms, used to respond to you and to arrange demos or onboarding.
- Service-user information entered by professional users — including care needs and, where the financial threshold tool is used, financial means and supporting evidence.
- Operational records created inside Ivy RM, such as rota, incident, audit and training entries.
- Basic technical data needed to keep the service secure and working, such as sign-in events.
We do not sell personal data and we do not use service-user records to advertise to families.
Shared responsibility
Ivy Technology (us)
- · Keep the platform available, patched and access-controlled.
- · Process data only on your instructions and for the purposes agreed.
- · Tell you promptly about incidents affecting your data.
- · Support you with subject access, rectification and deletion requests.
Your organisation
- · Decide the lawful basis for sharing service-user data with us.
- · Manage your own users, roles and leavers.
- · Upload only evidence that is necessary and proportionate.
- · Set the retention schedule we apply to your records.
Privacy requests
To access, correct or delete personal data, email info@ivycareconnect.co.uk. If the data was entered by a provider or local authority, we will pass your request to them as the controller and support them in responding.
Report a security concern
Found a vulnerability? Email info@ivycareconnect.co.uk with steps to reproduce. Please don't access or alter other people's data while testing. We aim to acknowledge reports within one working day.
See also our privacy notice, terms of service and accessibility statement.
Want to see it before you decide?
Book a 20-minute walkthrough and we’ll show the features that matter for your team.