Your data. Your control.
Our responsibility.
Protecting the information entrusted to us is fundamental to everything we do.
Health and social care organisations handle some of the most sensitive information there is. At DataHub.care, we believe data processing should be secure, transparent and built around your organisation's requirements.
Trusted with data.
Accountable for how it's handled.
Our services are designed to help organisations move, transform, clean and connect information without compromising their responsibilities for data protection.
We recognise that our customers may be responsible for employee records, service-user information, care records and other confidential data.
Our approach is to minimise the information we handle, restrict its use to agreed purposes, protect it throughout processing and ensure there is a clear process for returning or deleting it.
Your data belongs here.
And stays under your control.
Our UK data residency commitment is to use UK-based processing and storage for customer datasets, including temporary processing environments and applicable backups.
Before accepting live data, we will confirm the hosting location, relevant suppliers, access arrangements and any exceptions that could affect residency.
We will not arrange an international transfer of customer personal data without appropriate customer authorisation and the safeguards required by applicable data protection law.
Our residency principles
Specific hosting and access arrangements are confirmed as part of service onboarding.
The DataHub.care Security Charter.
Ten principles that guide how we design, deliver and manage our data services.
Your data remains yours
We do not claim ownership of customer data or use it for unrelated commercial purposes.
Only agreed processing
We process customer personal data only for documented, authorised purposes, unless otherwise required by law.
UK residency by design
We prioritise UK-based data handling and verify residency requirements before live processing.
Minimum necessary data
We aim to access and retain only the information needed to complete the agreed task.
Secure access
Access is restricted to authorised individuals and systems with a legitimate need.
Protected transfers
Data must be transferred through approved, appropriately secured channels.
Confidentiality
Everyone authorised to handle customer information must be subject to appropriate confidentiality obligations.
Transparency
We explain how information is processed, which suppliers are involved and what safeguards apply.
Responsible incident handling
Suspected security incidents are investigated promptly, with affected controllers notified without undue delay where required.
Return or deletion
Customer data is returned or securely deleted at the end of processing in accordance with agreed instructions and legal requirements.
Security at every stage.
We establish safeguards appropriate to the information, the processing activity and the risks involved.
Encryption
Appropriate encryption protects information in transit and at rest, supported by secure key and credential management.
Access management
Role-based access, strong authentication and least-privilege permissions help limit unnecessary exposure.
Secure processing
Controlled environments, secure configuration and separation of customer data reduce processing risks.
Logging & monitoring
Appropriate operational logs, monitoring and incident investigation support accountability and security oversight.
Resilience & recovery
Where relevant to the service, backup, recovery and continuity arrangements are defined and periodically reviewed.
Review & improvement
Security arrangements are reviewed as systems, suppliers, threats and customer requirements change.
The specific technical and organisational measures for each service are documented and agreed as appropriate before processing begins.
UK GDPR.
Clear responsibilities.
For customer-directed data transformation and integration services, DataHub.care will generally act as a data processor, while the customer acts as the data controller.
We recognise our responsibilities under the UK GDPR and Data Protection Act 2018. Appropriate contractual arrangements must be in place before personal data is processed.
For services involving personal data, we will agree a Data Processing Agreement covering the purpose of processing, security obligations, subprocessors, retention and deletion, and assistance with relevant data protection obligations.
What this means in practice
Customer personal data is processed only within the agreed scope and instructions.
Subprocessors require appropriate authorisation and contractual protections.
We assist controllers with relevant rights requests, where applicable.
We notify affected controllers of personal data breaches without undue delay after becoming aware of them.
We provide appropriate information to help customers assess our processing arrangements and compliance.
Sensitive information deserves additional care.
We understand that health and social care datasets may include special category personal data, confidential care information, employee details and information relating to vulnerable individuals.
Before accepting this type of information, we assess the proposed processing, the necessity of using identifiable records and the safeguards required.
Where possible, we encourage the use of anonymised, pseudonymised or representative test data during initial development and testing.
Customers remain responsible for establishing their lawful basis and any applicable special category processing condition. We support their compliance obligations within our agreed processor role.
From receipt to secure deletion.
Data protection doesn't end when a transformation or transfer has finished.
Agree
Define the purpose, data categories, security requirements and retention period.
Receive
Use an approved secure transfer method with appropriate access restrictions.
Process
Carry out only the agreed transformation, validation or transfer.
Deliver
Provide the output through an agreed secure destination or delivery method.
Close
Return or delete data in line with documented instructions, including applicable retention and backup arrangements.
Questions about your data?
We believe organisations should understand how their information will be handled before deciding to use a service.
Will my data be stored in the UK?
Our service is designed around a UK data residency commitment. We confirm the locations of relevant processing, storage, backups and supporting services before accepting live customer data. Any exception must be disclosed and appropriately authorised.
Who owns the information I provide?
You retain your rights and control over your data. We do not acquire ownership of customer information through processing it.
Do you use customer data to train AI?
Customer data will not be used for AI model training without explicit, documented authorisation and an appropriate lawful arrangement. Any proposed use of AI services involving customer data must be separately assessed and agreed.
How long do you retain my information?
Retention depends on the agreed service and processing instructions. We define retention and deletion arrangements before processing begins rather than applying an unspecified indefinite retention period.
Can you process patient or service-user records?
Potentially, subject to an appropriate assessment, agreed contractual arrangements and suitable safeguards. We encourage customers to avoid providing identifiable information where it is not necessary.
Do you provide a Data Processing Agreement?
Where we act as a processor of personal data, an appropriate Data Processing Agreement must be in place before processing starts.
What happens if there is a security incident?
Suspected incidents are investigated and contained as appropriate. We notify affected data controllers without undue delay when we become aware of a personal data breach, and provide assistance with their applicable reporting obligations.
Let's talk about your requirements.
Have questions about UK hosting, data processing agreements, confidentiality or the security of a particular integration? We're happy to discuss your requirements before any information is shared.
Contact DataHub.care ↗ Please do not send identifiable patient, service-user or employee records through a general enquiry form.