Plain English summary: Kinward is a communication platform connecting care homes with residents' families. We collect only the personal data necessary to provide this service. We do not sell your data to anyone. We store your data securely on UK/EU servers. You have full rights over your data under UK GDPR.
Kinward ("we", "us", "our") operates the Kinward platform at kinward.uk — a software service that enables care homes to communicate care updates to residents' family members.
For the purposes of UK data protection law:
Contact: [email protected]
| Data | Why we collect it |
|---|---|
| Full name | To identify you within the family portal |
| Email address | To create and secure your account; send notifications |
| Resident's name | To link your account to the correct resident |
| Care home name | To link your account to the correct care home |
| Messages sent | To enable communication with the care team |
| Concerns logged | To record and track concerns you raise |
| Visit notes | To log family visit activity (family-facing only) |
| Wellbeing check-ins | To support family wellbeing tracking |
| Data | Why we collect it |
|---|---|
| Full name | To identify staff within the platform |
| Email address | Account creation, login, notifications |
| Role (Senior Staff / Manager) | To determine access permissions |
| Reviews authored | Audit trail of care communications |
| Messages sent | Communication record with families |
Resident names are stored to link care reviews and family accounts. We do not store clinical records, medical history, diagnoses, medication details, or any other clinical information in structured form. Care notes entered by staff are stored solely for the purpose of generating plain-English summaries for families.
We may collect standard technical information including browser type, device type, IP address, and session data for security and platform performance purposes. We do not use this data for advertising or profiling.
We do not use your data for advertising, marketing to third parties, or any form of profiling unrelated to the provision of the Kinward service.
Under UK GDPR Article 6, we process personal data on the following legal bases:
| Processing activity | Legal basis |
|---|---|
| Providing the platform service | Contract (Article 6(1)(b)) — necessary to perform our agreement with the care home |
| Account creation and authentication | Contract (Article 6(1)(b)) |
| Security and fraud prevention | Legitimate interests (Article 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Article 6(1)(c)) |
| Wellbeing check-ins (optional) | Consent (Article 6(1)(a)) — provided voluntarily by family members |
Important: Care notes entered by staff may contain health-related information about residents. This constitutes special category data under UK GDPR Article 9.
Where special category data is processed:
Our legal basis for processing special category data is Article 9(2)(h) — processing necessary for the provision of social care and the management of social care systems — and our Data Processing Agreement with each care home.
| Data type | Retention period | Reason |
|---|---|---|
| Care reviews and summaries | 8 years from creation | UK care regulations and safeguarding requirements |
| Family messages | 8 years from creation | Care communication records |
| Concerns | 8 years from creation | Safeguarding obligations |
| Family accounts (active) | Duration of residency + 8 years | Ongoing care relationship |
| Family accounts (removed) | 8 years from removal | Legal retention requirements |
| Staff accounts | Duration of employment + 6 years | Employment law requirements |
| Technical/security logs | 90 days | Security monitoring |
Data is never deleted earlier than these periods without a lawful request from the data controller (care home) and confirmation that no legal hold applies.
We implement appropriate technical and organisational measures to protect personal data, including:
In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the relevant data controller within 72 hours of becoming aware, in accordance with our obligations under UK GDPR Article 33.
Some of our sub-processors are located outside the UK and European Economic Area (EEA). Where personal data is transferred internationally, we ensure appropriate safeguards are in place:
Under UK GDPR, you have the following rights in relation to your personal data:
| Right | What it means |
|---|---|
| Right of access | You can request a copy of all personal data we hold about you |
| Right to rectification | You can ask us to correct inaccurate data |
| Right to erasure | You can ask us to delete your data, subject to legal retention requirements |
| Right to restriction | You can ask us to limit processing of your data in certain circumstances |
| Right to portability | You can request your data in a structured, machine-readable format |
| Right to object | You can object to processing based on legitimate interests |
| Right to withdraw consent | Where processing is based on consent, you can withdraw it at any time |
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Some rights may be subject to limitations where legal retention obligations apply.
If you are dissatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
The Kinward platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will take steps to delete that data promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email at least 30 days before taking effect. The "Last updated" date at the top of this page will be revised accordingly. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
Email: [email protected]
General contact: [email protected]
Website: kinward.uk
We aim to respond to all privacy-related enquiries within 5 business days and all formal data subject requests within 30 calendar days as required by UK GDPR.