Privacy notice

What applies now

We already collect personal information from prospective customers through this website. Those parts of this notice are operative today.

• Enquiry forms — your name, organisation, email address, telephone number (if given) and the message you send.
• Callback requests — the same details plus your preferred day and time.
• Consultation and demonstration bookings — the details you provide so we can arrange and confirm the session.
• Marketing subscriptions — your email address, used only until you unsubscribe.
• Ordinary business contact — correspondence with suppliers, advisers and prospective partners.

We use this information to respond to you, arrange the session you asked for and keep a record of the enquiry. Our lawful basis is our legitimate interest in responding to business enquiries, or your consent where you subscribed to marketing. Enquiry records are kept no longer than necessary and are deleted on request.

Please do not send health information, service-user details or other sensitive personal information through the public forms; we ask you not to, and we delete it if it is sent.

The remaining sections cover personal information processed inside the platform on behalf of the care providers who use it.

Who we are

MW CARE 4 U LIMITED provides the MW Compliance Hub platform. Company number 15816816. Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. "MW Compliance Hub" is a product and trading name, not a separate company.

Questions about information handling go to the Data Protection Contact, MW CARE 4 U LIMITED, at the registered office above. The person who holds that role is recorded in our internal governance records and is not named publicly.

When this notice applies

It covers the information we decide the use of: enquiries, demonstration and consultation bookings, consultancy records, the accounts of people who use the platform on behalf of an organisation, our customer and billing records, security administration and service messages.

Where a care provider uses the platform to keep its own records — incidents, complaints, safeguarding concerns, staff training, and information about the people it supports — that provider decides how those records are used and remains responsible for them, and its own privacy notice applies. We hold that information only on its instructions. Hosting it does not make us responsible for deciding how it is used.

What we collect, why, and for how long

These periods are our own retention decisions for information we are responsible for; they are not legal requirements. For records a care provider enters about the people it supports, that organisation decides how long they are kept — where we offer a default period it is only a default, which the organisation can change.

Our grounds for using information

• Enquiries, account administration and platform security: our legitimate interests in running and protecting the service.
• Consultancy work: performance of the contract with the organisation.
• Marketing email and website measurement: consent — and both are switched off, so neither is in use.
• Information you enter about the people you support: your own organisation decides the grounds, as the organisation responsible for those records.

Who else is involved

The platform and its database are hosted by a managed cloud provider in Ireland. Assistant features send your question to an AI service at the moment you ask it. We do not sell information, share it with advertisers, or use customer records to train AI models. The current list is on our sub-processor page.

AI-assisted drafting: the Policy Builder sends the organisation details you enter to the AI service to draft or tailor policy content. You are asked not to enter patient or service-user-identifiable information, staff personal data, or other unnecessary sensitive personal data. Every AI-drafted policy is saved as a draft and is never published automatically; a person in your organisation must review, adapt and approve it first. Each generation is recorded in the platform's audit trail.

Your rights

You can ask for a copy of your information, ask us to correct or delete it, ask us to restrict or stop some uses, object, or ask for it in a portable form. Write to the data-protection contact at the registered office. That is the first route, but you do not have to use it before complaining. We answer within one month, as the law requires; we do not promise anything faster.

If your information sits inside a care provider's own records on the platform, that provider decides those requests. We pass the request to it and help it respond, rather than deciding ourselves.

You can complain to the Information Commissioner's Office at any time, whether or not you have contacted us first.

One limit we will not overstate: some records sit in a tamper-proof audit trail, so compliance evidence cannot be quietly altered. Individual entries in that trail cannot be deleted one by one. Where that affects a deletion request we say so, explain what we can do instead — including correcting a record by adding a superseding entry — and record the outcome. Removing that material entirely is only possible by destroying a whole organisation's records at the end of the contract. These technical limits do not remove your statutory rights.

Things we do not claim

• We give no guarantee about recovering information after loss and state no recovery time or maximum data-loss figure.
• We hold no independent certification and have not been independently audited.
• The platform helps organisations manage their own compliance. It does not give regulatory advice and does not predict any inspection result.