Privacy Policy
This notice explains at a high level how personal information may be handled when people visit the website, create accounts or use the platform. For care records entered by subscribing agencies, the agency will commonly determine the purposes of that processing and should provide its own privacy information to clients and staff.
| Document owner | ExcelTTC Limited / WorkCura |
| Version / date | Version 1.0 — 25 September 2026 |
| Applies to | WorkCura public website, SaaS platform, agency users, care workers, client/family portal users, demo requesters and support contacts |
Brand colours: Navy #29366A • Gold #D19544 • Coral #FF5151
Document control and publication information
| Item | Current draft |
|---|---|
| Legal entity | ExcelTTC Limited [registered company number and registered office TO CONFIRM] |
| Trading/service name | WorkCura |
| Website / service | workcura.net and associated WorkCura application interfaces |
| Privacy contact | [PRIVACY EMAIL TO CONFIRM] |
| Data Protection Officer | [DPO status / contact TO CONFIRM — if a DPO is appointed or required] |
| ICO registration | [ICO registration number TO CONFIRM, if applicable] |
| Effective date | 25 September 2026 |
| Review cycle | At least annually and before any material new processing or significant service change |
Contents
1. Purpose, scope and status of this policy
2. Who we are and how to contact us
3. Controller and processor roles
4. Who this policy applies to
5. Definitions
6. Data-protection principles
7. Personal information we process
8. Special-category, health and safeguarding information
9. Where information comes from
10. Why we use information and our lawful bases
11. Agency/customer data processed on instructions
12. Service-user/client information
13. Care-worker and workforce information
14. Agency manager and administrative-user information
15. Client and family portal information
16. Public website, enquiries and Book a Demo
17. Subscription, billing and payment information
18. Visit, location, rota and attendance information
19. Medication, care records, incidents and safeguarding
20. Timesheets, payroll and invoicing
21. Messages, notifications, email and SMS
22. Documents, compliance and profile images
23. Cookies, local storage and similar technologies
24. YouTube and third-party embedded content
25. Sharing information and service providers
26. International transfers
27. Data retention and deletion
28. Security and confidentiality
29. Data exports, backups and disaster recovery
30. Individual rights
31. Rights requests where an agency is the controller
32. Automated decision-making and profiling
33. Children and vulnerable people
34. Direct marketing
35. Data breaches and incident response
36. Complaints
37. Changes to this policy
38. Contacting us
Schedule A — Processing-purpose and lawful-basis matrix
Schedule B — Detailed data-category map
Schedule C — Cookie schedule
Schedule D — Retention framework
Schedule E — Controller/processor examples
Schedule F — Pre-publication implementation checklist
Authoritative sources and legal references
1. Purpose, scope and status of this policy
This Privacy Policy explains how ExcelTTC Limited, trading through the WorkCura service ("WorkCura", "we", "us" or "our"), handles personal information in connection with the WorkCura public website and domiciliary-care management web application. It is designed to meet the transparency requirements of UK data-protection law and to help people understand what information is used, why it is used, who receives it, how long it is kept, and what rights may apply. [1][2]
The policy covers both information for which ExcelTTC Limited decides the purposes and means of processing (controller processing) and information processed on behalf of subscribing care organisations under their instructions (processor processing). Those roles are materially different and are explained below.
This policy should be read with the WorkCura Terms and Conditions, any Data Processing Agreement (DPA), Subprocessor list, Cookie Notice, agency-specific privacy information and any just-in-time privacy notices shown at the point information is collected.
2. Who we are and how to contact us
The WorkCura service is operated by ExcelTTC Limited. The following publication details must be completed before this policy is placed into production:
- Legal name: ExcelTTC Limited.
- Registered company number: [TO CONFIRM].
- Registered office: [TO CONFIRM].
- Trading/service name: WorkCura.
- Primary website: https://workcura.net.
- Privacy enquiries: [PRIVACY EMAIL TO CONFIRM].
- Data Protection Officer, if applicable: [TO CONFIRM].
- ICO registration number, if applicable: [TO CONFIRM].
If you are a care worker, service user/client, family member or other person whose information was entered into WorkCura by a subscribing agency, you should normally contact that agency first about access, correction, deletion or other rights relating to the operational care record. We will assist the agency where required under our processor obligations.
3. Controller and processor roles
3.1 When ExcelTTC Limited is a controller
We generally act as controller for our own business and service-administration purposes, including public website enquiries, Book a Demo requests, agency account registration, subscription administration, billing contacts, service security, fraud/abuse prevention, platform-level audit records, our own support correspondence, legal/compliance records and, where applicable, our own direct marketing activities.
3.2 When ExcelTTC Limited is a processor
For most care-delivery and workforce records entered or generated by a subscribing agency, the agency determines the purposes of processing and WorkCura provides the technical service. Examples include client/service-user records, care plans, assessments, medication data, staff compliance documents, visits, rota data, incidents, safeguarding records, visit notes, timesheets, client invoices and internal operational messages. In such cases we process data on the agency’s documented instructions and subject to applicable processor terms.
3.3 Where roles may differ
A single interaction may involve more than one role. For example, an agency may control a care record while ExcelTTC Limited separately controls limited security logs required to protect the service. We assess each processing activity according to its actual purpose rather than applying one label to every dataset.
| Example | Likely controller | WorkCura role |
|---|---|---|
| Public Book a Demo request | ExcelTTC Limited | Controller |
| Agency subscription and billing contact | ExcelTTC Limited | Controller |
| Care plan created by an agency | Subscribing agency | Processor |
| Care-worker compliance file uploaded by agency | Subscribing agency | Processor |
| Security/audit logging needed to protect WorkCura | ExcelTTC Limited for platform-security purpose | Controller |
| Client/family portal information exposed by agency configuration | Subscribing agency | Processor |
| Stripe payment processing | ExcelTTC Limited and/or Stripe depending on activity | WorkCura controller for subscription administration; Stripe acts under its own terms for some processing |
4. Who this policy applies to
- Visitors to the WorkCura public website.
- People who contact us, request information or submit a Book a Demo request.
- Prospective and current agency customers, owners, managers, administrators and billing contacts.
- Care workers and other staff using accounts supplied by a subscribing agency.
- Service users/clients whose records are created in the platform by an agency.
- Family members, representatives or authorised portal users.
- People included in assessments, care plans, incident, safeguarding, medication or visit records.
- Suppliers, professional advisers and business contacts where their personal information is processed in connection with the service.
5. Definitions
| Term | Meaning in this policy |
|---|---|
| Personal information / personal data | Information relating to an identified or identifiable living individual. |
| Special-category data | Particularly sensitive data protected by Article 9 UK GDPR, including health data and certain other categories. |
| Controller | The organisation that determines why and how personal information is processed. |
| Processor | An organisation that processes personal information on behalf of a controller. |
| Agency / customer | A subscribing care organisation using WorkCura. |
| Service user / client | A person receiving care or support whose record is managed by an agency. |
| Care worker / employee | A staff member or worker whose account or record is managed by an agency. |
| Processing | Any operation performed on personal information, including collection, storage, access, disclosure, alteration, retrieval or deletion. |
| Subprocessor | A third party engaged by WorkCura to process customer personal data on behalf of WorkCura when WorkCura acts as processor. |
6. Data-protection principles
We design and operate the service with the UK GDPR principles in mind. These require personal information to be processed lawfully, fairly and transparently; collected for specified purposes; limited to what is necessary; accurate; kept no longer than necessary; and protected with appropriate security. Accountability requires organisations to be able to demonstrate compliance. [1][3]
- Purpose limitation: use data for clear, legitimate purposes and assess new uses before they begin.
- Data minimisation: collect and expose only information reasonably needed for the relevant workflow.
- Accuracy: provide mechanisms for authorised users to correct records and maintain history where appropriate.
- Storage limitation: retain information according to defined business, contractual and legal needs.
- Integrity and confidentiality: apply access controls, tenant separation, secure authentication, audit logging, backups and other safeguards.
- Transparency: provide privacy information at collection points and maintain this policy as processing changes.
7. Personal information we process
The categories below describe information the WorkCura service is capable of processing. Not every category applies to every person.
| Category | Examples |
|---|---|
| Identity and contact | Name, preferred name, email address, telephone number, postal address, organisation, job title. |
| Account and authentication | User ID, role, account status, password hash, access/refresh tokens, password-reset records, authentication events. |
| Agency/customer | Agency name, contact details, subscription plan, tenant configuration, billing contact, operational settings. |
| Care-worker/workforce | Role, availability, employment-related details, compliance status, uploaded documents, profile photo, medication authorisation, visit assignments. |
| Service-user/client | Contact and address details, preferred name, care needs, care plans, assessments, medication, visits, authorised contacts, portal access. |
| Care-delivery records | Visit dates/times, tasks, notes, check-in/check-out, exceptions, cancellations, monitoring alerts and care outcomes. |
| Health and medication | Medication lists, administration/support records, health-related care plan/assessment information. |
| Incident and safeguarding | Incident reports, safeguarding concerns, review notes and outcomes. |
| Finance | Timesheets, scheduled/payable hours, pay-rate snapshots, mileage/expenses, worker payments, client invoices and invoice lines. |
| Communications | Secure messages, notifications, support emails, SMS delivery records, demo correspondence. |
| Website/demo | Book a Demo form responses, organisation details, preferred appointment, onsite address, areas of interest. |
| Technical/security | IP address, user agent, route, timestamps, audit events, application error references, logs, session and security events. |
| Subscription/payment | Stripe customer/subscription identifiers, invoice/payment status, pricing/currency and webhook event references. WorkCura should not store full payment-card details. |
| Media/content | Public-page media uploads, staff profile images and documents uploaded by authorised users. |
8. Special-category, health and safeguarding information
WorkCura is designed for domiciliary-care workflows and can therefore process health information and other sensitive material. Health information is special-category data under UK data-protection law and requires additional protection. Where an agency is controller, the agency is responsible for identifying both an Article 6 lawful basis and an applicable Article 9 condition, providing appropriate privacy information, and satisfying any additional Data Protection Act 2018 conditions or documentation requirements that apply to its processing.
WorkCura does not independently decide that an agency is legally entitled to collect or use particular health, medication, safeguarding or employment information. Agencies must configure and use the platform consistently with their own legal, professional and regulatory obligations.
Sensitive information should not be submitted through ordinary public contact or demo forms. If support requires access to a customer record, access should be limited to what is necessary, authorised, logged where appropriate and handled under confidentiality obligations.
9. Where information comes from
- Directly from you, for example when you register, sign in, contact us, submit a demo request, update your profile or communicate with us.
- From your employing or commissioning care agency, for example when it creates your account or workforce record.
- From authorised agency staff who create client, care-plan, medication, incident, safeguarding, rota, visit, timesheet or invoice records.
- From service users, family members or authorised representatives where they provide information to an agency or through a permitted portal feature.
- Automatically from your use of the service, including authentication, audit, security, device/browser and operational event data.
- From payment, email, SMS, hosting and other service providers where needed to deliver, reconcile or secure the service.
- From public sources or professional advisers where lawfully necessary for corporate administration, fraud prevention, disputes or legal compliance.
10. Why we use information and our lawful bases
When ExcelTTC Limited acts as controller, we identify a lawful basis before processing personal information. The most relevant bases are usually performance of a contract, legitimate interests, legal obligation and consent where consent is genuinely appropriate. [2][4] The exact basis depends on the purpose and context.
| Purpose | Typical data | Likely Article 6 basis when we are controller |
|---|---|---|
| Operate public website and respond to enquiries | Contact details, message content, technical data | Legitimate interests; steps at your request before contract where applicable |
| Book a Demo | Name, organisation, contact details, preferred slot, onsite address, interests | Steps at your request before contract; legitimate interests in sales administration |
| Create/administer agency customer account | Agency contact, administrator identity, account details | Contract; legitimate interests |
| Subscription and billing | Billing contact, plan, Stripe IDs, invoice/payment status | Contract; legal obligation for accounting/tax records where applicable |
| Authenticate and secure accounts | User IDs, cookies, tokens, IP/user agent, security events | Contract; legitimate interests in security and fraud prevention |
| Provide customer support | Identity, contact, support content, relevant logs | Contract; legitimate interests |
| Service monitoring, error handling and audit | Technical logs, audit records, error references | Legitimate interests in resilience, security, accountability and service improvement |
| Transactional email/SMS/in-app notifications | Contact details, notification content/status | Contract; legitimate interests; legal obligation where applicable |
| Legal claims/compliance | Relevant records, communications and logs | Legal obligation; legitimate interests in establishing, exercising or defending legal rights |
| Optional direct marketing | Business contact details and preferences | Consent where required; legitimate interests where lawful and PECR permits |
11. Agency/customer data processed on instructions
Agency customers may use WorkCura to create and manage records across staff, clients, care plans, visits, medication, incidents, safeguarding, timesheets, invoices, messaging and related workflows. We process such data to provide the contracted platform, maintain availability and security, provide authorised support, create backups, send configured notifications and perform other documented service functions.
We do not sell agency care records, use them for unrelated advertising, or permit one agency to access another agency’s tenant data. The application is designed around tenant separation and role-based access. Agencies remain responsible for the data they choose to enter, the users they authorise and the legal/operational basis for access.
12. Service-user/client information
Depending on agency configuration, a service-user record may include identity and contact details, address, preferred name, care assessments and plans, medication, visit schedule and delivery records, notes, authorised contacts, billing information, portal access and incident/safeguarding information. This information is primarily processed on behalf of the agency responsible for delivering or coordinating care.
The platform intentionally limits client/family portal visibility and does not expose internal agency-only records such as staff payroll, staff compliance files, internal incident investigations, safeguarding records or other restricted management notes unless a separate authorised workflow expressly permits it.
13. Care-worker and workforce information
Agency-managed worker records may contain identity/contact details, job role, employment or engagement information, availability, assignments, compliance documentation, profile image, training/verification status, medication-support authorisation, attendance records, timesheets, mileage/expenses, payment records, messages and notifications.
The agency controls who may be activated, assigned to visits, authorised for medication-related workflows and granted access. WorkCura processes the information required to implement those controls.
14. Agency manager and administrative-user information
Agency owners, managers and administrators provide account, identity and contact information. Their actions may be recorded in audit logs because they can create, amend, approve, assign, review, invoice, pay, export or otherwise administer sensitive records. Audit information supports accountability, troubleshooting, fraud prevention and security.
15. Client and family portal information
Where an agency enables portal access, authorised users may receive access credentials or links and may view selected records such as scheduled visits, approved care-plan information or invoices. The agency determines who is authorised and what information should be made available. Portal users must keep access credentials secure and notify the agency if access is no longer appropriate.
16. Public website, enquiries and Book a Demo
The public website may collect information through contact forms and the Book a Demo page. Demo requests may include your name, organisation, email address, telephone number, approximate workforce size, preferred date and time, whether you want an online or on-site demonstration, onsite address where relevant, and optional information about what you want demonstrated.
Demo requests are stored in the WorkCura database and may also be sent or notified to the email address configured by the Super Admin for demo enquiries. The selected date/time is a preferred request rather than an automatic appointment confirmation.
Do not include service-user health information, confidential case notes, medication data or other unnecessary sensitive information in public website forms.
17. Subscription, billing and payment information
Where Stripe billing is enabled, WorkCura exchanges subscription and payment-related information with Stripe, including customer/subscription identifiers, selected plan, billing cycle, currency, invoice/payment status and relevant webhook event identifiers. Card details are handled through Stripe’s payment interfaces and should not be stored in the WorkCura application database.
We retain accounting and subscription records as needed for contract administration, reconciliation, fraud prevention, tax/accounting duties, disputes and legal claims. Stripe may process information as an independent controller or processor depending on the specific activity and under Stripe’s own privacy terms.
18. Visit, location, rota and attendance information
WorkCura processes visit schedules, recurring-visit templates, rota assignments, start/end times, care-worker allocation, cancellations, exceptions, monitoring alerts, check-in/check-out and related operational data. Some visit workflows may use or record location-related information to support attendance verification or operational safety where configured and lawfully used by the agency.
Agencies should ensure workers and service users receive appropriate notice about any location or attendance monitoring, and should avoid collecting more precise location data than is necessary for the stated purpose.
19. Medication, care records, incidents and safeguarding
The platform supports medication lists and medication-support records, care assessments and plans, visit tasks and notes, incident reports and safeguarding case management. These records may contain health information, vulnerability information and other highly sensitive content. Access should be granted strictly on a need-to-know basis by the responsible agency.
Safeguarding and incident information may need to be retained, disclosed or escalated under the agency’s legal, contractual, professional or regulatory duties. WorkCura provides the technical workflow but does not determine whether a safeguarding referral, statutory disclosure or clinical/care decision is required.
20. Timesheets, payroll and invoicing
WorkCura can process scheduled visit duration, payable hours, pay-rate snapshots, mileage, expenses, worker payments, timesheet approvals and client invoices. These records may constitute employment/worker, financial or contractual information. Agency customers are responsible for payroll, tax, employment and invoicing compliance and for deciding what information must be retained.
21. Messages, notifications, email and SMS
The platform includes secure messages, in-app notifications and configurable email/SMS delivery. Message content, sender/recipient identifiers, timestamps and delivery status may be stored to provide the service and maintain an audit trail.
Email delivery uses the SMTP service configured by the operator. SMS delivery can be configured to use Twilio. The precise service providers in production must be listed in the current Subprocessor list. Sensitive care information should be minimised in email/SMS notifications because those channels may be less controlled than the authenticated platform.
22. Documents, compliance and profile images
Agencies may upload staff compliance documents and profile images. Such files are stored in private application storage rather than the public website directory. Agencies must ensure they have a lawful basis to collect the documents, that they request only documents genuinely required for the worker’s role, and that access is appropriately restricted.
23. Cookies, local storage and similar technologies
WorkCura uses essential cookies for authentication, session/security functions, CSRF protection and selected preferences. Under PECR, non-essential cookies generally require clear information and valid consent before they are set. [5]
| Cookie / storage item | Purpose | Typical duration | Category |
|---|---|---|---|
| dc_access | Authenticated access token used to keep a signed-in user logged in securely. | Short-lived; configured by the service | Strictly necessary |
| dc_refresh | Refresh token used to renew authenticated access where permitted. | Configured refresh period | Strictly necessary |
| dc_csrf | Cross-site request forgery protection token used to protect form submissions. | Up to approximately 8 hours in the current application configuration | Strictly necessary |
| workcura_currency | Remembers selected pricing currency on the public site. | Up to approximately 1 year | Preference / functionality |
| workcura_consent_v1 | Local browser storage containing the visitor's saved analytics and advertising consent choices. | Until cleared or replaced by a later choice | Consent/preference record |
| Google Ads / Google tag storage | Advertising measurement, conversion measurement and ads personalisation where the visitor has consented. | Google controlled; depends on the technology used and consent state | Advertising / measurement; optional |
| YouTube storage/cookies | May be set by YouTube only after a visitor chooses to load/play embedded video content. | Controlled by YouTube | Third-party; subject to YouTube/Google terms |
WorkCura uses Google tag AW-18475848381 on public website and public account-entry pages for Google Ads measurement. Google Consent Mode v2 is initialised with advertising, analytics, advertising-user-data and advertising-personalisation consent denied by default. Visitors can accept all, reject non-essential use or manage analytics and advertising choices separately. The saved choice is applied on later public-page visits and can be changed through the Cookie Settings control in the website footer.
When advertising consent is denied, WorkCura does not grant Google permission to use advertising storage, advertising user data or ads personalisation. Google tags may operate in a restricted consent state for consent signalling and privacy-preserving measurement in accordance with Google's Consent Mode behaviour; advertising cookies must not be written until the relevant consent is granted. We do not enable the Google Ads tag on authenticated agency, care-worker or client/family workspaces so sensitive operational care-page activity is not intentionally sent to Google Ads.
Google may process data when consent is granted in accordance with its own terms and privacy responsibilities. See Google's Business Data Responsibility information. The service does not need advertising cookies to provide the core application.
24. YouTube and third-party embedded content
The public homepage can display YouTube video content. The current design defers loading YouTube until the visitor chooses to play a video. Once loaded, YouTube/Google may receive technical information and may use cookies or similar technologies in accordance with their own privacy terms. Visitors who do not choose to play the video should not have YouTube embedded content loaded merely by viewing the page.
25. Sharing information and service providers
We do not sell personal information. We disclose information only where needed for the service, instructed by an agency, required by law, necessary to protect rights/security, or otherwise lawfully permitted.
| Recipient/category | Why information may be shared |
|---|---|
| Hosting/infrastructure provider | Host the Node.js application, storage and supporting infrastructure. |
| Database/storage services | Store and back up platform data as configured. |
| Stripe | Subscription checkout, billing, invoicing/payment status and billing portal. |
| Google Ads / Google tag | Public-website advertising measurement, conversion measurement and ads personalisation where the visitor's consent permits it. Consent Mode v2 communicates the visitor's choices to Google. |
| SMTP/email provider | Send account, notification, support and demo-related email. |
| Twilio or configured SMS provider | Send SMS notifications where SMS is enabled. |
| Professional advisers | Legal, accounting, audit, insurance or security advice where necessary. |
| Authorities/regulators/courts | Where disclosure is required by law or necessary for legal claims, safety or regulatory obligations. |
| Subscribing agency and its authorised users | Access to agency-controlled data according to tenant, role and permission settings. |
| Successor or transaction party | Due diligence or transfer in a corporate transaction, subject to confidentiality and legal requirements. |
26. International transfers
Some suppliers may process or make personal information accessible outside the UK. Where the UK GDPR international-transfer rules apply, a restricted transfer must be covered by a permitted mechanism such as UK adequacy regulations, appropriate safeguards (for example the UK International Data Transfer Agreement or UK Addendum where applicable) or a valid exception. Appropriate safeguards may require a transfer risk assessment/data protection test. [6][7][8]
We will maintain records of relevant transfer mechanisms for live providers and make appropriate information available to agency customers through our contractual documentation or Subprocessor information. The precise countries and mechanisms must reflect the providers actually used in production.
27. Data retention and deletion
We keep personal information only for as long as reasonably necessary for the purposes for which it is processed, taking account of contractual commitments, customer instructions, security/audit needs, legal limitation periods, tax/accounting duties and sector-specific retention obligations.
Where WorkCura acts as processor, the agency’s instructions and applicable contract/DPA govern return or deletion of customer data, subject to legal requirements and technical backup cycles. Deleting or archiving a record from an active user interface may not immediately remove every historical, audit or backup copy where retention is necessary and lawful.
Indicative retention categories appear in Schedule D. Those periods must be validated against production configuration and the agency/customer contract before publication.
28. Security and confidentiality
WorkCura uses technical and organisational measures intended to protect confidentiality, integrity and availability. The current application design includes role-based access controls, agency tenant separation, password hashing, secure authentication cookies, access/refresh token handling, CSRF protection, private file storage, audit logging, application error logging, rate limiting, security headers, operational monitoring, backups and production-readiness checks.
No internet service can guarantee absolute security. Customers must also manage their own users, devices, passwords, staff departures, permissions and internal policies. Users should never share credentials and should report suspected unauthorised access promptly.
- Access should be limited to the minimum necessary role and tenant.
- Production secrets must be held in environment variables or an appropriate secrets system, not source code.
- Sensitive exports should be protected in transit and at rest and deleted when no longer required.
- Support access to live customer data should be exceptional, authorised and limited to the minimum necessary.
- Security events and significant administrative changes should be logged and reviewed where appropriate.
29. Data exports, backups and disaster recovery
The platform includes operational backup and restore functionality. Backups are stored outside the publicly served directory. Backup copies may contain personal information and must therefore receive equivalent access, retention and security controls. Restoration must be authorised and tested to avoid overwriting valid production data or reintroducing data that should no longer be active.
Where a customer requests export, return or deletion at contract end, we will follow the applicable contract/DPA and legal obligations. Backup erasure may occur through controlled rotation rather than immediate physical deletion from every historical backup.
30. Individual rights
Subject to applicable law and the circumstances, individuals may have rights to be informed, access their personal information, correct inaccurate information, request erasure, restrict processing, receive certain information in portable form, object to certain processing, withdraw consent where consent is relied upon, and obtain safeguards in relation to solely automated decisions. [3][9]
| Right | What it generally means |
|---|---|
| Access | Ask for confirmation of processing and a copy of your personal information, subject to exemptions and rights of others. |
| Rectification | Ask for inaccurate personal information to be corrected and incomplete information completed where appropriate. |
| Erasure | Ask for deletion in circumstances where the law gives this right; it is not absolute. |
| Restriction | Ask for processing to be limited in certain circumstances. |
| Portability | Receive certain data you provided in a structured, commonly used, machine-readable format where legal conditions are met. |
| Object | Object to processing based on legitimate interests or to direct marketing. |
| Withdraw consent | Where processing relies on consent, withdraw it without affecting prior lawful processing. |
| Automated decisions | Receive protections where a decision producing legal or similarly significant effects is made solely by automated processing, where the relevant law applies. |
| Complain | Raise a concern with us/the relevant agency and complain to the Information Commissioner’s Office. |
31. Rights requests where an agency is the controller
If your information was entered into WorkCura by a care agency, the agency is usually the appropriate first point of contact for a rights request relating to that operational record. If you contact us directly, we may need to identify the relevant agency and refer the request to it. As processor, we will provide reasonable assistance to the controller in accordance with our contractual and legal obligations.
We may still respond directly in relation to personal information for which ExcelTTC Limited is itself controller, such as our own sales, subscription, security or support records.
32. Automated decision-making and profiling
WorkCura is primarily a workflow and record-management platform. The current service is not intended to make solely automated decisions about individuals that produce legal or similarly significant effects. Rules such as role eligibility, assignment constraints, visit-status transitions, alerts and subscription enforcement are operational controls and are subject to human configuration or review.
If we introduce material profiling or solely automated decision-making in the future, we will assess the legal basis, safeguards, transparency requirements and need for a Data Protection Impact Assessment before deployment, and will update this policy as required.
33. Children and vulnerable people
The public WorkCura service is intended for business users and authorised care-related users, not for children to create their own customer accounts. However, an agency may lawfully manage records relating to children or vulnerable people as part of care delivery. In those circumstances the agency is responsible for ensuring an appropriate legal basis, clear age-appropriate or representative-facing privacy information where required, and suitable access controls.
34. Direct marketing
We may communicate with business contacts about WorkCura where lawful. Electronic marketing is subject to both data-protection law and PECR. Where consent is required, we will seek it before sending the communication. Where a legitimate-interest route is lawful, we will assess that interest and provide a clear way to object. We will honour opt-outs and maintain suppression information as necessary to avoid contacting people who have opted out.
Transactional service communications — for example security alerts, subscription notices, password-reset messages or requested demo correspondence — are not treated as marketing merely because they are sent by email or SMS.
35. Data breaches and incident response
We maintain processes to identify, investigate, contain and document personal-data incidents. Where we act as processor and become aware of a personal-data breach affecting agency-controlled data, we will notify the relevant controller without undue delay in accordance with applicable law and contract. The controller is responsible for deciding whether notification to the ICO or affected individuals is required, although we will provide reasonable assistance.
Where ExcelTTC Limited acts as controller, we will assess notification obligations under applicable law and maintain records of relevant incidents and decisions.
36. Complaints
We encourage you to raise privacy concerns with the organisation responsible for the relevant processing. For ExcelTTC Limited-controlled processing, contact us using the privacy contact details in section 2. For agency-controlled care or workforce records, contact the subscribing agency first.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Current ICO contact and complaint routes are available at ico.org.uk. You may also have rights to seek a judicial remedy.
37. Changes to this policy
We may update this policy when the service, suppliers, legal requirements or processing activities change. We will publish the current version on the website and update the effective/last-updated date. If a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected people before the new processing begins where required. ICO guidance recommends regular review and updates before new purposes are introduced. [1][2]
38. Contacting us
Privacy questions, rights requests and concerns about ExcelTTC Limited-controlled processing can be sent to:
- ExcelTTC Limited — WorkCura
- Registered office: [TO CONFIRM]
- Privacy email: [TO CONFIRM]
- Data Protection Officer (if applicable): [TO CONFIRM]
- Website: https://workcura.net
When contacting us, please avoid sending unnecessary health or care information by ordinary email. We may need to verify identity before acting on a rights request, but we will only request information that is proportionate to the verification need.
Schedule A — Processing-purpose and lawful-basis matrix
| Activity | Data | Purpose | Lawful basis | Special-category? | Role |
|---|---|---|---|---|---|
| Public website delivery | Visitor technical data | Operate and secure website | Legitimate interests | No | ExcelTTC Limited |
| Contact enquiry | Name, contact, message | Respond to enquiry | Legitimate interests / pre-contract steps | Only if user unnecessarily includes it | ExcelTTC Limited |
| Book a Demo | Identity, organisation, contact, preferred date/time, onsite address, interests | Arrange requested demonstration | Pre-contract steps / legitimate interests | Not intended | ExcelTTC Limited |
| Agency registration | Agency and administrator details | Create customer account | Contract / pre-contract steps | No | ExcelTTC Limited |
| Subscription billing | Billing contact, plan, currency, Stripe IDs/status | Charge/administer subscription | Contract; legal obligation for records | No | ExcelTTC Limited |
| Authentication/security | Account, token/cookie, IP/user agent, events | Secure service and prevent abuse | Contract / legitimate interests | Usually no | ExcelTTC Limited |
| Care worker record | Identity, role, compliance, availability, documents | Agency workforce management | Determined by agency | May include special-category data | Agency; WorkCura processor |
| Client/service-user record | Identity, contact, address, care details | Care management | Determined by agency | Yes, often health data | Agency; WorkCura processor |
| Care assessments/plans | Care needs, risk and support information | Plan and document care | Determined by agency | Yes | Agency; WorkCura processor |
| Medication | Medication and support records | Medication support workflow | Determined by agency | Yes | Agency; WorkCura processor |
| Visits/rota | Schedule, worker, client, tasks, attendance | Deliver/manage care visits | Determined by agency | May reveal health/care context | Agency; WorkCura processor |
| Incidents/safeguarding | Incident and safeguarding content | Safety, investigation and escalation | Determined by agency | Often yes | Agency; WorkCura processor |
| Timesheets/payments | Hours, rates, mileage, expenses | Workforce finance | Determined by agency | Usually no | Agency; WorkCura processor |
| Client invoicing | Client/visit claims, charges, invoice details | Agency billing | Determined by agency | May reveal care relationship | Agency; WorkCura processor |
| Messages/notifications | Message content, metadata, delivery status | Operational communication | Controller depends on context | May include sensitive content | Agency and/or ExcelTTC depending on message |
| Platform audit/error logs | User/action/route/IP/error ref | Security, audit, troubleshooting | Legitimate interests | May indirectly relate to sensitive workflow | ExcelTTC Limited for platform-level purpose |
Schedule B — Detailed data-category map
| Data domain | Typical fields / records | Primary users |
|---|---|---|
| Users | Name, email, role, tenant, status, password hash | Super Admin, Agency users, Care workers, portal users |
| Agencies | Organisation details, settings, contact, subscription | Super Admin, Agency managers |
| Staff | Identity/contact, role, status, availability, profile image | Agency managers, worker |
| Staff documents | Compliance document type, file, expiry/verification state | Agency managers |
| Clients | Identity/contact/address, status, authorised contacts | Agency managers; limited portal |
| Assessments/care plans | Needs, risks, goals, care instructions, versions | Agency staff; limited authorised portal |
| Medications | Medication details, authorisation, administration/support records | Agency managers, authorised care workers |
| Visits | Client, worker, date/time, type, status, address, tasks | Agency managers, care workers |
| Visit notes/tasks | Task completion and care notes | Agency managers, care workers |
| Incidents/safeguarding | Reports, severity, review and outcome | Restricted agency management users |
| Timesheets | Visit/date/hours/rates/mileage/expenses/status | Care worker, agency finance/management |
| Payments/invoices | Worker payments, client invoices and claims | Agency finance/management |
| Messages | Thread, participants, body, timestamps/read status | Authorised participants |
| Notifications | Notification type/content/status/channel preference | Relevant account user |
| Audit logs | Actor, action, entity, timestamp, request metadata | Super Admin/authorised operational users |
| Errors | Reference, route, user/tenant context, message/stack | Super Admin/technical operations |
| Demo requests | Visitor/organisation/contact/preference/message/status | Super Admin/sales |
| Subscription | Plan, customer/subscription IDs, payment state, events | Super Admin/agency billing |
| Backups | Encrypted/controlled copies of production records as configured | Authorised operations only |
Schedule C — Cookie schedule
| Name | Set by | Purpose | Duration / expiry | Consent position |
|---|---|---|---|---|
| dc_access | WorkCura | Maintain authenticated session/access | Short-lived, configured access-token period | Strictly necessary |
| dc_refresh | WorkCura | Securely renew authenticated access | Configured refresh-token period | Strictly necessary |
| dc_csrf | WorkCura | Protect state-changing requests against CSRF | Approx. 8 hours in current configuration | Strictly necessary |
| workcura_currency | WorkCura | Remember public pricing currency preference | Approx. 1 year | Functional preference; review PECR classification/consent position |
| workcura_consent_v1 | WorkCura local storage | Remember analytics and advertising consent choices | Until cleared or superseded | Consent/preference record |
| Google Ads / Google tag technologies | Advertising and conversion measurement; ads personalisation where permitted | Google controlled | Advertising/measurement storage and related user-data/personalisation signals denied by default; enabled only where the visitor grants the relevant consent | |
| YouTube cookies/storage | Google/YouTube after visitor chooses to load content | Video playback, preferences and provider functions | Provider controlled | Third-party; disclose and manage consent as required |
Future analytics providers, advertising pixels, session-replay tools or social-media trackers must be added to this schedule and subjected to PECR/UK GDPR assessment before activation.
Schedule D — Retention framework
| Record category | Recommended baseline / decision rule | Notes |
|---|---|---|
| Public enquiries | Typically 12–24 months after last meaningful contact | Longer only where needed for dispute, contract or consent record. |
| Demo requests | Typically 24 months after request or last sales interaction | Delete/anonymise earlier if no longer needed. |
| Agency customer account | Duration of contract plus appropriate post-contract limitation/accounting period | Separate operational and legal/accounting records. |
| Subscription/accounting records | Commonly up to 6–7 years where needed for tax/accounting/legal obligations | Confirm with accountant/legal adviser. |
| Authentication/security logs | Risk-based period, commonly months rather than indefinite retention | Longer where needed to investigate incident or claim. |
| Application error logs | Until resolved plus defined security/diagnostic retention | Avoid retaining unnecessary sensitive payloads. |
| Audit logs | Contractual/security/legal period appropriate to care SaaS accountability | Confirm whether 6 years is operationally/legal appropriate before publishing. |
| Care-worker/client/care records | Determined by agency controller and applicable care-sector retention rules | WorkCura follows customer instructions/contract as processor. |
| Messages/notifications | Agency-defined operational retention; platform notices according to service need | Minimise sensitive content. |
| Backups | Rotating backup schedule; deleted/expired through controlled backup lifecycle | May temporarily retain data after live deletion. |
| Suppression/opt-out record | As long as needed to honour marketing opt-out | Keep minimal identifier and preference only. |
Schedule E — Controller/processor examples
| Scenario | Agency role | ExcelTTC/WorkCura role | Practical effect |
|---|---|---|---|
| Agency enters service-user care plan | Controller | Processor | Agency provides privacy notice and lawful basis; WorkCura processes on instructions. |
| Care worker submits visit note | Controller for employment/care purpose | Processor | Agency determines who can access and retention. |
| Agency uses Stripe subscription checkout | Customer of WorkCura | Controller for WorkCura billing relationship | WorkCura and Stripe process payment/subscription data under their respective roles. |
| Visitor requests a demo | Not involved | Controller | WorkCura gives this privacy notice and manages the enquiry. |
| WorkCura records security audit event | May be separately responsible for own user-management actions | Controller for platform-security log where WorkCura determines purpose | WorkCura retains only what is necessary for security/accountability. |
| Agency asks support to investigate client record | Controller | Processor for customer data; controller for support administration metadata | Support access should be authorised, minimal and confidential. |
| Family portal user views approved care information | Controller | Processor | Agency determines authorisation and data made visible. |
Schedule F — Pre-publication implementation checklist
- ☐ Insert ExcelTTC Limited company number and registered office.
- ☐ Confirm the correct privacy/DPO contact email and whether a formal DPO is required/appointed.
- ☐ Confirm ICO registration number and status.
- ☐ Confirm actual production domain(s) covered by the policy.
- ☐ Confirm the live hosting provider and hosting/data locations.
- ☐ Confirm the live SMTP/email provider and its processing location/contract terms.
- ☐ Confirm whether Twilio SMS is enabled; if not, do not list it as an active subprocessor.
- ☐ Confirm Stripe is enabled and review Stripe role wording against current contract/privacy documentation.
- ☐ Publish and maintain a separate current Subprocessor list.
- ☐ Validate international-transfer mechanisms for each non-UK provider.
- ☐ Complete/refresh transfer risk assessments/data protection tests where required.
- ☐ Validate the retention schedule against actual application jobs, contracts and sector/legal obligations.
- ☐ Create and document a procedure for end-of-contract data export/return/deletion.
- ☐ Verify cookie banner/consent controls against all non-essential technologies actually used.
- ☐ Maintain a cookie scan/inventory and update the Cookie Notice whenever technologies change.
- ☐ Ensure public forms do not solicit unnecessary special-category data.
- ☐ Ensure agency customer DPA contains all mandatory processor terms and subprocessor provisions.
- ☐ Ensure support staff access to customer data is controlled and logged.
- ☐ Maintain a Record of Processing Activities and data map.
- ☐ Assess whether DPIAs are required for sensitive/high-risk processing such as care data, location monitoring or major new features.
- ☐ Document rights-request workflow and identity-verification procedure.
- ☐ Document personal-data breach detection, escalation and notification procedure.
- ☐ Verify backups, restoration tests and backup retention.
- ☐ Review the policy at least annually and before material new processing.
- ☐ Have the final version reviewed by a suitably qualified UK data-protection/legal professional before publication.
Authoritative sources and legal references
This draft was prepared with reference to the following current UK regulatory sources. ICO guidance notes that parts of its privacy-information guidance remain under review following the Data (Use and Access) Act 2025; the policy should therefore be reviewed when updated ICO guidance is issued.
1. ICO — Right to be informed
2. ICO — What privacy information should we provide?
3. ICO — Individual rights guidance and resources
4. ICO — How to write a privacy notice and what goes in it
5. ICO — Cookies and similar technologies (PECR)
6. ICO — International transfers
7. ICO — Appropriate safeguards
8. ICO — Completing a transfer risk assessment
9. ICO — Data (Use and Access) Act 2025: summary of data-protection changes
10. UK legislation — Data Protection Act 2018
Regulatory position as at 25 September 2026: the ICO states that the data-protection provisions of the Data (Use and Access) Act 2025 are fully in force as of 19 June 2026. [9]
Final legal review recommended. Because WorkCura supports domiciliary-care records, health information, workforce records and safeguarding workflows, this policy should be checked against the organisation’s actual hosting/subprocessors, DPA, contracts, retention schedule and care-sector obligations before it is relied upon as the final production privacy notice.