Privacy & Data Protection Policy

1. Privacy & Data Protection Policy

1.1 Our Commitment to Privacy

Heems is committed to protecting the privacy and personal data of all individuals who use our platform. We recognise the importance of handling personal information responsibly, transparently, and in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains how personal information is collected, used, stored, and protected when you interact with Heems.

1.2 Role as Data Controller

Heems acts as a data controller in respect of personal data processed through the platform. This means we determine how and why personal data is collected and used in connection with our services.

The type and amount of personal data we collect depends on how individuals interact with the platform, including whether they are using Heems as a client, family member, independent carer, or organisational user.

We are committed to collecting and processing only personal data that is relevant, necessary, and proportionate to the operation, security, and functionality of the platform.

1.3 Information We Collect

We may collect and process the following categories of personal data:

General Information

Full name, contact details, and account registration information
Login credentials and authentication data
Communications sent through the platform or to Heems support
Payment, billing, and transaction information
Technical and usage data, including IP address, browser type, device information, and log files

Clients and Organisations

Information relating to non-clinical support needs or preferences
Scheduling details and availability information
Reviews, ratings, feedback, and platform usage notes

Heems does not require or request detailed medical records or clinical information.

Independent Carers

Profile information, including experience, availability, and skill descriptions
Identity verification, right-to-work checks, and eligibility confirmations
Disclosure and Barring Service (DBS) status or equivalent background information, where applicable
Bank and payout details required to facilitate payments

Special Category Data

Where necessary, Heems may process limited special category data, such as health-related information, strictly for safeguarding, safety, or essential platform functionality purposes. Such data is processed only where a valid lawful basis exists and with appropriate safeguards in place.

Safety, Verification and Emergency Features

To support platform security, booking transparency, fraud prevention, and user safety, Heems may process information relating to identity verification, booking attendance, location tracking, and emergency contact features.

This may include facial images used for Face Match identity verification, attendance records generated through QR code check-in and check-out functionality, optional location data used for attendance verification, and emergency contact information provided by users.

Such information is used solely for platform operation, identity verification, booking administration, fraud prevention, payment processing, dispute resolution, safety purposes, and legal compliance. Heems does not use facial images or related information for marketing, profiling, advertising, or automated decision-making.

Information collected through these features is retained only for as long as reasonably necessary for the purposes described in this Policy and is protected through appropriate technical and organisational security measures.

1.4 How We Collect Information

Personal data may be collected when you:

Create or manage an account on the platform
Use Heems' features, messaging tools, or booking systems
Communicate with other users through the platform
Contact Heems support or submit enquiries
Participate in surveys, reviews, or feedback requests
Visit or browse our website, including through the use of cookies and similar technologies

1.5 Lawful Basis for Processing

Heems processes personal data only where permitted under data protection law. Lawful bases may include:

Performance of a contract, where processing is necessary to provide platform services
Legal obligations, such as financial, tax, or regulatory requirements
Legitimate interests, where processing is necessary for platform operation, security, fraud prevention, or service improvement and does not override individual rights
Consent, where explicitly provided and capable of being withdrawn

1.6 How We Use Personal Information

Personal data may be used to:

Operate, maintain, and improve the Heems platform
Facilitate communication and coordination between users
Process payments and manage transactions
Provide customer support and respond to enquiries
Monitor platform use to promote safety, prevent misuse, and address breaches
Comply with safeguarding responsibilities and legal obligations
Detect, prevent, and investigate fraud, security issues, or unauthorised activity

1.7 Cookies and Analytics

Heems uses cookies and similar technologies to ensure the website functions effectively, improve user experience, and analyse website traffic and interaction patterns.

Users can manage cookie preferences through browser settings or via cookie consent tools made available on the website. Further details are provided in our Cookie Policy.

1.8 Data Sharing

Heems does not sell, rent, or trade personal data.

We may share personal information with trusted third parties where necessary, including:

Payment processors and financial service providers
Identity verification and background-check providers
Hosting, analytics, and technical service providers
Legal, regulatory, or law enforcement authorities where disclosure is required by law

All third parties are required to handle personal data securely, confidentially, and only in accordance with our instructions and applicable data protection laws.

1.9 Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including legal, contractual, and operational requirements.

Certain records, such as financial and transaction data, may be retained for statutory accounting and compliance periods. When data is no longer required, it is securely deleted or anonymised.

1.10 Your Rights

Under applicable data protection laws, individuals have the right to:

Request access to their personal data
Request correction of inaccurate or incomplete information
Request erasure of personal data where applicable
Restrict or object to certain processing activities
Request data portability
Withdraw consent at any time where processing is based on consent

Requests can be made by contacting Heems directly. Individuals also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if they believe their data has been handled unlawfully.

2. Safeguarding Policy

2.1 Our Safeguarding Approach

Heems is committed to promoting safety, dignity, and respectful treatment for adults and children who may be vulnerable when using the platform. Although Heems does not deliver regulated care services and is not a care provider, we recognise the importance of acting responsibly and proportionately where safeguarding concerns are identified in connection with platform use.

Our approach focuses on early identification of potential risks, appropriate escalation of concerns, and cooperation with relevant authorities where required by law. We aim to create a platform environment that supports safe interactions between clients, families, and independent carers, while respecting individual rights and autonomy.

2.2 Scope

This Safeguarding Policy applies to all individuals and entities interacting with the Heems platform, including but not limited to:

Heems employees and authorised representatives;
Clients, families, and other users of the platform;
Independent, self-employed carers who offer services through the platform.

All parties are expected to act in a manner that supports safety, respect, and lawful conduct when using the platform.

2.3 Safeguarding Principles

Heems’ safeguarding approach is informed by widely recognised safeguarding principles and good practice, including:

Empowerment: supporting individuals to make informed choices and respecting their wishes wherever possible;
Prevention: taking reasonable steps to reduce the likelihood of harm occurring;
Proportionality: responding to concerns in a manner that is appropriate to the level of risk identified;
Protection: supporting individuals who may be at risk of harm, abuse, or neglect;
Partnership: working cooperatively with relevant authorities, professionals, or organisations where legally required;
Accountability: ensuring concerns are recorded, reviewed, and handled responsibly.

These principles guide how safeguarding matters are identified, assessed, and escalated through the platform.

2.4 Recognising Risk

Safeguarding concerns may arise in a variety of ways, including but not limited to:

Direct disclosures from clients, carers, or family members;
Observed behaviours or interactions that raise concern;
Complaints or reports submitted through the platform;
Information received from third parties or relevant authorities.

All safeguarding concerns are taken seriously. Reports are reviewed promptly and handled in line with this policy and applicable legal requirements.

2.5 Types of Abuse and Harm

Safeguarding concerns may relate to a range of potential risks or harms, including (but not limited to):

Physical harm or inappropriate physical treatment;
Emotional or psychological harm;
Financial abuse, exploitation, or coercion;
Sexual abuse or inappropriate conduct;
Neglect or acts of omission, including self-neglect;
Discriminatory abuse;
Exploitation, undue influence, or controlling behaviour.

2.6 Reporting Concerns

Anyone who becomes aware of a safeguarding concern should take appropriate action without delay. This may include:

Contacting emergency services where there’s an immediate risk of harm
Reporting a concern to the relevant local authority or safeguarding body
Notifying Heems where the concern relates to the use of the platform

Heems will escalate concerns to appropriate authorities when legally required.

2.7 Mental Capacity

Where questions arise regarding an individual’s capacity to make decisions, any actions taken by carers or families should be guided by the principles of the Mental Capacity Act 2005.

Presuming capacity unless it is clearly established otherwise
Supporting the individual to make their own decisions wherever possible
Ensuring that any decision made on behalf of an individual who lacks capacity is made in their best interests
Choosing the least restrictive option available when acting or making decisions

Heems does not assess mental capacity and does not make decisions on behalf of clients. Responsibility for complying with the Mental Capacity Act rests with the individuals involved in the care arrangement and any relevant legal representatives or authorities.

2.8 Confidentiality and Information Sharing

Any information relating to safeguarding concerns will be handled with appropriate care and confidentiality.

Shared only where necessary and on a need-to-know basis
Processed in accordance with applicable data protection and privacy legislation, including the UK GDPR and Data Protection Act 2018
Disclosed to relevant authorities or safeguarding bodies only where required by law or where there is a serious risk to an individual’s safety

Heems does not investigate safeguarding matters but may share relevant platform-related information with appropriate authorities when legally obligated to do so.

3. Equality, Diversity & Inclusion Policy

3.1 Our Commitment

Heems is committed to promoting equality, diversity, and inclusion across its platform. We aim to create a respectful and inclusive environment for all users, including clients, families, carers, and partners.

We do not tolerate discrimination, harassment, bullying, or victimisation in any form. All users are expected to treat one another with dignity and respect when using the Heems platform.

3.2 Protected Characteristics

Heems upholds the principles of the Equality Act 2010 and recognises all protected characteristics, including but not limited to age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation.

No user will be treated less favourably or excluded from accessing the platform on the basis of any protected characteristic.

3.3 Fair and Objective Practice

Access to, participation in, and use of the Heems platform is assessed using fair, objective, and transparent criteria. Decisions are based on factors such as platform eligibility, safety requirements, verification standards, availability, and compliance with applicable laws and platform policies.

Heems does not make decisions based on personal characteristics unrelated to platform safety, lawful use, or service suitability.

3.4 Complaints and Concerns

Any concerns or complaints relating to discrimination, unfair treatment, or exclusion may be raised with Heems through the appropriate reporting channels.

Heems will review such concerns promptly, impartially, and in accordance with applicable legislation and internal procedures. Where appropriate, actions may be taken to address breaches of this policy, including restriction or removal of access to the platform.

4. Review & Governance

Heems is committed to maintaining clear, effective, and legally compliant policies that support the safe and responsible operation of the platform.

These policies are reviewed on a regular basis to ensure they remain:

Compliant with applicable laws, regulations, and data protection requirements;
Relevant to the ongoing operation and development of the Heems platform;
Aligned with recognised best practice for online platforms operating within the care and support sector.

Policy reviews may be conducted periodically, or in response to changes in legislation, regulatory guidance, platform functionality, or identified operational risks.

Where updates or amendments are made, revised versions will be published on the Heems website with updated effective and review dates. Continued use of the platform following publication of updated policies constitutes acceptance of the revised terms.