Policy Version: v1.0 | Last Updated: August 2026
This Privacy Policy is provided by MapMyCare Ltd, a company registered in England and Wales under company number 17346601 with registered office at 128 City Road, London, United Kingdom, EC1V 2NX ("we", "our" or "us") for use of our products and services, including our B2B SaaS web application for children's residential homes to record and track developmental progress known as MapMyCare (Services).
We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data).
It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data is regulated by law, including under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
• Where we act as Controller: We act as controller where we determine why and how personal data is processed for our own business purposes, including personal data relating to prospective customers, customer contacts, Authorised Users, account administration, billing, customer support, security, communications and marketing.
• Where we act as Processor: Residential homes and other organisations using MapMyCare may enter personal data relating to young people and other individuals into the Platform. In relation to this information, the relevant customer will generally act as controller and we process the personal data on its behalf as processor and in accordance with its instructions.
Where we act as processor, the relevant customer's own privacy information will primarily govern how and why that personal data is used. Our processing of that personal data is also governed by our contractual arrangements with the relevant customer.
This Privacy Policy applies to personal data processed by us in connection with:
The Services may link to, integrate with or rely on apps, websites, APIs, software or services operated by third parties. Those third parties may process personal data under their own privacy notices where they act as independent controllers. For more information see the section ‘Who we share your personal data with’ below.
Our customers may use the Platform to record personal data relating to young people in their care and other individuals. Where we process that personal data solely on behalf of a customer, we generally act as processor rather than controller. The relevant customer is responsible for determining the purposes for which that information is used and for providing appropriate privacy information to affected individuals.
If you are a young person, parent, guardian or other individual whose personal data has been entered into MapMyCare by one of our customers, you should normally contact the relevant residential home or organisation in the first instance if you have questions about how your information is being used or wish to exercise your data protection rights.
The personal data we collect about you depends on the particular activities carried out through the Services. We will collect and use the following personal data about you:
| Category of Data | In More Detail |
|---|---|
| Identity and Contact Data | Name, job title, organisation, business address, telephone number and email address |
| Account Data | Username, Account identifier, organisation, residential home, User role, permissions and Account status |
| Customer & Subscription Data | Customer organisation, subscription details, billing arrangements, start and renewal dates and other information relating to the customer relationship |
| Payment and Billing Data | Billing address, payment status, invoices, transaction references and limited payment information provided to us by our payment provider |
| Communications & Support Data | Emails, support requests, enquiries, feedback, complaints and other communications with us |
| Training Data | Records relating to training, onboarding and support provided to customers and Users |
| Technical and Usage Data | Device information, IP address, browser type, operating system, app usage, access times, security logs and cookie or analytics data where applicable |
| Marketing Preference Data | Marketing opt-ins, opt-outs, communication preferences and consent records |
| Specific Function Data | Data you store online with us using the Services including usage history or preferences |
| Automatic Activity Data | Your activities on and use of the Services revealing preferences, interests or manner of use and times of use |
| Enquiry Data | Name and email address provided when making an enquiry |
If you do not provide personal data we ask for where it is required, it may prevent us from providing services and/or the Services to you.
Our customers may enter additional personal data into the Platform concerning young people and other individuals. Depending on how a customer uses the Platform, this may include: names and other identifying information; age and date of birth; information concerning developmental progress; educational information; information concerning social development and skills; assessments and information relating to risks; care-related records, observations and notes; information about Users who create, access or amend records; and Special Category Personal Data where chosen by the customer.
Sensitive personal data means information revealing racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation. We do not generally collect Special Category Data about customer representatives for our own business purposes. Where processed on behalf of a customer, the customer as Controller is responsible for identifying the appropriate UK GDPR Article 6 & Article 9 lawful bases.
MapMyCare uses strictly necessary session tokens and local storage to enable secure user authentication and offline operational features. We do not use third-party advertising or tracking cookies. For a detailed breakdown of all cookies and browser storage tokens used on our platform, please read our dedicated Cookies & Local Storage Policy.
Under data protection law, we can only use your personal data if we have a proper reason (e.g. consent, performance of a contract, compliance with legal obligations, or legitimate interests).
| What We Use Your Personal Data For | Our Legal Reasons |
|---|---|
| Responding to enquiries & prospective customer communications | Pre-contract steps; legitimate interests in responding to business enquiries |
| Create and manage your user account with us | Performance of a contract or legitimate interests in account administration and security |
| Providing services and functionalities of the Services | Performance of a contract (Terms and Conditions of Use) |
| Providing customer support and training | Performance of a contract and legitimate interests in supporting customers |
| Administering subscriptions, invoices and payments | Performance of a contract, legitimate interests and compliance with legal obligations |
| Communicating important updates, terms changes, or notices | Performance of a contract and legitimate interests in administering the Services |
| Enforcing legal rights or defending legal proceedings | Compliance with legal obligations and legitimate interests in protecting business rights |
| Protecting security of systems, audit logs, and fraud prevention | Compliance with legal obligations and legitimate interests in preventing criminal activity |
| Operational efficiency, training, quality control and improvements | Legitimate interests in delivering efficient high-quality service |
| Statistical analysis of performance, app functionality, and offerings | Legitimate interests in developing and enhancing our application |
| Sharing data in connection with corporate restructuring or asset sale | Compliance with legal obligations and legitimate interests in corporate transactions |
We routinely share personal data with service providers we use to help us run our business or provide the Services. We impose strict contractual obligations to ensure service providers can only use personal data to provide services to us and to you.
We will keep your account personal data for as long as you have an active account with us and for a period of up to 6 years thereafter to comply with accounting or legal obligations, including in the event of legal claims. Following the end of the retention period, data is deleted or anonymised.
For Customer Personal Data (young people's care records), the customer as Controller determines the retention period in accordance with statutory care home retention regulations.
Where information has been de-identified, we reserve the right to process such information for analytical or educational purposes. We do not make automated decisions producing legal or significant effects based on data collected by the Services.
Where personal data is transferred outside the UK, we ensure compliance with UK data protection laws by relying on UK Adequacy Decisions, EU Adequacy Regulations, or International Data Transfer Agreements (IDTAs) with appropriate safeguards.
Under UK GDPR, you have rights free of charge including: Access, Correction (Rectification), Erasure (Right to be forgotten), Restriction of use, Data Portability, and the Right to Object to direct marketing or legitimate interest processing. For detailed information, visit the ICO Individual Rights Guide.
We maintain appropriate technical and organizational security measures to prevent accidental loss, unauthorized access or disclosure. For cyber hygiene guidance, visit www.getsafeonline.org (supported by HM Government).
If you have queries, concerns, or wish to exercise your rights, please contact our Data Protection Officer:
Contact Officer: Kirsty Tamplin
Email: info@mapmycare.co.uk
Registered Office: 128 City Road, London, United Kingdom, EC1V 2NX (Company No: 17346601)
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or telephone 0303 123 1113.