PolicyGuardian
Privacy Policy
Version 2026-07-16 · Last updated 16 July 2026 · See also our Terms of Use
1. Who we are
PolicyGuardian is operated by Care With Intelligence Holdings Limited, company number 15513514, registered office 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. For the personal data described in this policy we act as the data controller, except for personal data contained within the policy documents and records your organisation manages in the Service, for which your organisation is the controller and we act as its processor. Contact: chris.clarke@cherishedcareservices.com.
2. The personal data we process
- Account data — name, email address, role, and authentication identifiers.
- Organisation data — your provider profile, including registration details (for example CQC identifiers), contacts and service information you supply.
- Policy content — the documents and details you enter and the documents the Service generates for you. These may incidentally contain personal data your organisation includes (for example named managers or contacts).
- Staff usage records — read confirmations, reading time, assignment status and understanding-check attempts for your organisation’s staff, created so your organisation can evidence policy distribution and comprehension.
- Technical data — log records including IP address, browser user-agent, timestamps and security events, including the record of your acceptance of our Terms.
3. Why we process it (lawful bases)
- To provide and operate the Service — performance of a contract.
- To secure the Service, prevent abuse, enforce limits and keep evidential records (including Terms acceptance) — our legitimate interests and, where applicable, legal obligation.
- To communicate with you about the Service (for example invitations and approval notifications) — performance of a contract and legitimate interests.
- To improve the Service using aggregated, non-identifying usage information — legitimate interests.
We do not use your data for third-party advertising and we do not sell personal data.
4. Who receives it
We share personal data only with the categories of service providers needed to run PolicyGuardian:
- Cloud hosting and database services (Google Cloud / Firebase), with data stored in UK/EU regions.
- AI text-generation providers, which process policy content in order to draft, review and improve documents. Where such processing involves a transfer outside the UK, it takes place under appropriate safeguards including the UK International Data Transfer Addendum / standard contractual clauses.
- Transactional email delivery providers, for invitations and notifications.
We may also disclose information where required by law or to protect our legal rights. Within your organisation, your administrators and managers can see the staff usage records described above — that visibility is a core function of the Service.
5. Retention
We keep personal data for as long as your organisation’s account is active and for a reasonable period afterwards to allow reactivation and meet our legal obligations, after which it is deleted or anonymised. Evidential records (such as Terms-acceptance records and audit trails) may be retained for up to six years in line with limitation periods. Your organisation may request export of its content before deletion, as described in the Terms.
6. Security
Data is encrypted in transit and at rest, access is restricted by role-based permissions and tenant isolation, and administrative access is limited and logged. No system is perfectly secure; we will notify affected organisations and the ICO of any personal-data breach where required by law.
7. Your rights
Individuals have rights under the UK GDPR including access, rectification, erasure, restriction, portability and objection. Staff members of a customer organisation should normally direct requests to their organisation (the controller of their records); we will assist the organisation in responding. You can also contact us directly at chris.clarke@cherishedcareservices.com. You have the right to complain to the Information Commissioner’s Office (ico.org.uk).
8. Cookies and local storage
We use two categories of cookies and browser storage:
- Essential (always on) — authentication/session tokens, your cookie choice, and offline caching so the app works as a Progressive Web App. These are strictly necessary and do not require consent.
- Analytics (only with your consent) — Google Analytics cookies that help us understand how the site is used. These are set only if you choose “Accept analytics” on the cookie banner. We do not use advertising or cross-site tracking cookies.
Your choice persists for 12 months, after which we ask again. You can change your choice at any time via the Cookies link in the footer — withdrawing consent also removes any analytics cookies already set.
9. Changes and contact
We may update this policy from time to time; the version and date above will change and material updates will be notified through the Service. Questions about this policy or our data practices: chris.clarke@cherishedcareservices.com.