Privacy notice
This notice covers Insight, the Regulation 44 tool, and anything you send us by email or the booking link. If you use Insight as a visitor, you are the data controller for what you record in it.
Last updated [DATE]
Firsthand Social Care Solutions, registered in England and Wales, company number [COMPANY NUMBER], [REGISTERED ADDRESS]. Contact: [YOUR EMAIL].
Firsthand runs a portal of tools for social care. This notice covers Insight — the workspace for independent Regulation 44 visitors — and anything you send us by email or the booking link. Each visitor is the data controller for what they record in Insight; Firsthand Social Care Solutions is the processor. There are no provider accounts, and no provider can read a visitor’s record.
Your account: your name, your email address, and whether your access is in date. Then, in Insight: homes (name, Ofsted URN, provider, region), visits, reports, and an audit log of every change. Fields for children and staff take initials only and refuse a full name.
In a database in London (AWS eu-west-2).
[TO BE CONFIRMED WITH COUNSEL — see the strategy document, Risk 2.]
Submitted reports cannot be edited, and are kept for [RETENTION PERIOD]. To correct one, write to [YOUR EMAIL]. While their access is active, a visitor can download any submitted report as a PDF. [WHAT HAPPENS TO A VISITOR’S REPORTS WHEN THEIR ACCOUNT CLOSES]
Access, rectification, erasure, restriction, portability, and objection, under UK GDPR. Write to [YOUR EMAIL]. Erasure of a submitted report is a deliberate act carried out by hand against the database, and is never something the application can do on its own.
[PROCESSORS — hosting, database, sign-in; owner and counsel to confirm]
[WHAT HAPPENS TO WHAT YOU SEND BY EMAIL OR THE BOOKING LINK]
You can complain to the Information Commissioner’s Office at ico.org.uk.