Privacy notice
Last updated: 5 October 2026
Who we are
The Residential Care App is a care-records and compliance service for registered children's homes in England, provided by Orvanta Group Ltd, Trafford, Greater Manchester ("we", "us"). Contact us about privacy at privacy@residentialchildcareapp.co.uk.
Two roles: processor for care records, controller for our own data
Records your organisation keeps in the app (children's records, daily logs, incidents, safeguarding, medication, staff records and similar) belong to the provider that uses the app. For these, the provider is the data controller and we are its data processor: we act only on the provider's instructions under our data processing terms, and we never use this information for our own purposes.
Our own data — people who visit our website, ask for a demo, or hold an account — we are the controller for this, as described below.
What we collect and why
- Account details (name, work email, role, organisation): to provide and secure your account. Lawful basis: contract with your employer and our legitimate interest in running a secure service.
- Sign-in security data (sign-in times, failed attempts, the method used, a one-way coded form of your IP address): to protect accounts against misuse. Lawful basis: legitimate interests and our security duties under UK GDPR Article 32.
- Demo requests (name, organisation, email, phone, your message): to reply and arrange a demo. Lawful basis: legitimate interests; we do not add you to marketing lists.
- Website visits: we count page views without cookies and without storing IP addresses (see the cookie notice).
- Support emails sent to support@ or hello@: to answer you. Kept for 30 days in our mail store and then in our support inbox.
Where data is kept and how it is protected
All app data, files, backups, logs and encryption keys are held in Amazon Web Services' London region (eu-west-2). Data is encrypted in transit (TLS) and at rest, sensitive fields are additionally encrypted with per-organisation keys, and each organisation's records are separated at database level. Every account must use a passkey or an authenticator-app code to sign in. Record changes are written to a tamper-evident audit log.
Who we share data with
- Amazon Web Services EMEA SARL — hosting, email delivery and sign-in, in the UK (London).
- Google Ireland Ltd — advertising measurement on our public website only, and only if you accept advertising cookies. Never inside the app.
We do not sell personal data. We share it with regulators or the police only where the law requires it.
How long we keep it
- Care records: for as long as the provider instructs, in line with the Children's Homes (England) Regulations 2015 record-keeping rules; deleted or returned when the provider leaves.
- Sign-in events: 12 months. App error reports: 90 days. Website visit counts: totals only; daily visitor codes are deleted after 2 days.
- Demo requests: up to 2 years from last contact.
Your rights
You can ask to see, correct or delete your personal data, to restrict or object to its use, or to move it. For records held by a children's home, contact that provider first; we will help them respond. Email privacy@residentialchildcareapp.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.