Privacy Policy

This Privacy Policy explains how Ilea Palm Care Ltd (“we”, “us”) processes personal data when you use Halo Care at https://halo-care.uk. We are a UK company (number 12095758) based in Shrewsbury, Shropshire, United Kingdom. For UK GDPR purposes we are the data controller of personal data processed in Halo Care, except where a customer organisation is the controller and we act only as their processor.

1. Who this applies to

Halo Care is a SaaS platform for children’s residential care management. We may process data about:

• staff, managers, and other authorised users of the service;
• job applicants and referees in recruitment workflows;
• young people in placement and people connected to their care (for example family members, social workers, and commissioners), at the level the customer records in the system;
• suppliers and other contacts that appear in operational or finance records.

2. Categories of data

Depending on how an organisation uses the service, this can include:

• identity and contact details (name, work email, role, home or team);
• account and security data (hashed passwords, authenticator enrolment, trusted-device tokens, sign-in logs);
• employment and compliance records (training, supervision, rotas, safer-recruitment checks);
• care-management records entered by authorised staff (placement, reviews, documents, and related notes);
• finance records synced from connected bookkeeping tools (for example invoices and spend metadata);
• technical data such as IP address, browser type, and approximate request times.

Care records can include special category data (for example health information) and data relating to children. We process that data only to provide the service a customer has asked us to operate, and only to authorised users of that organisation.

3. Why we process data (UK GDPR)

Typical lawful bases are:

• Contract — to create accounts, provide Halo Care, and support the organisation that uses it;
• Legitimate interests — to keep the service secure, prevent misuse, and improve reliability, balanced against the rights of the people concerned;
• Legal obligation — where we must retain records or respond to a competent authority;
• Consent — only where we specifically ask for it (we do not rely on consent for core care-management processing).

Where special category data is processed, we do so because it is necessary for the provision of social care or for reasons of substantial public interest in regulated children’s residential care, or because the customer has another Article 9 condition that applies to their use of the platform. Customers remain responsible for the lawfulness of records they choose to store.

4. How we use data

• to operate care, staffing, recruitment, training, and finance features;
• to authenticate users and protect accounts (including two-factor authentication);
• to host, back up, and restore the service;
• to connect optional third-party integrations the customer enables;
• to investigate incidents, abuse, or security events;
• to contact the named administrator about the service.

We do not sell personal data. We do not use care records for advertising.

5. Cookies and authentication

Halo Care uses strictly necessary cookies and similar storage to keep you signed in, protect against cross-site request forgery, and (if you choose) remember a trusted device so you are not asked for an authenticator code on every visit. These are essential to the service. We do not use advertising or third-party analytics cookies on these public pages.

6. Sharing and processors

We share personal data only as needed to run the service, including:

• infrastructure and hosting providers that store or transmit the application;
• Intuit QuickBooks Online, when a customer connects their books — financial records (and any names that already appear on those records) may be exchanged to display invoices, income, and related figures in Halo Care;
• other integrations a customer enables (for example email, document storage, or training platforms);
• professional advisers or authorities where we are legally required to do so.

Third-party services have their own privacy terms. Connecting QuickBooks is optional and is controlled by the customer’s Intuit account.

7. International transfers

Some processors may store or access data outside the UK. Where that happens we use an appropriate transfer mechanism under UK GDPR (for example the UK International Data Transfer Addendum or a UK adequacy regulation) and limit access to what is needed to provide the service.

8. Retention

We keep account and operational data for as long as the organisation uses Halo Care and for a limited period afterwards so we can close the account, resolve disputes, and meet legal retention duties that apply to children’s residential care records. Customers should not treat the platform as their only statutory archive unless they have agreed that with us in writing.

9. Your rights

Under UK GDPR you may have the right to access, rectify, erase, restrict or object to processing, and to data portability, subject to exemptions that apply to social care, safeguarding, and employment records. To exercise a right, email alex.garvin@ileapalmcare.co.uk. If we process data only as a customer’s processor, we will pass your request to that organisation.

You can complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have handled your data. We have not listed an ICO registration number here; ask us if you need our current registration details.

10. Children

Halo Care is not a consumer app for children to sign up to. Children’s data appears only because a regulated care provider records it as part of providing care. Those records are restricted to authorised staff.

11. Contact

Ilea Palm Care Ltd
Company number 12095758
Shrewsbury, Shropshire, United Kingdom
Email: alex.garvin@ileapalmcare.co.uk
Product: https://halo-care.uk

Related: Terms of Use (End User Licence Agreement).