Privacy Policy

Curora (the mobile app and web platform) is provided by ALGO IT SOLUTIONS LIMITED (“we”, “us”). Curora helps care organisations run, review and approve compliance audits across their homes and branches.

We provide Curora to organisations (for example care providers). The organisation that gives you an account decides what audits are collected and who can see them; for that information it is the data controller and we act as its data processor. We are the controller only for the limited account and technical data needed to run the service.

• Account details — your name, work email address, role and the organisation and branches you belong to. Accounts are created by your organisation’s administrator.
• Audit content — the answers, comments, photos, signatures and files entered into audits, plus review decisions (approvals, rejections and reasons).
• Activity records — who submitted, reviewed or changed an audit and when, to keep an accurate audit trail.
• Technical data — basic device, app-version and error information used to keep the service secure and fix problems, and a push-notification token if you allow notifications.

We do not use Curora for advertising, we do not sell personal data, and the app does not track you across other apps or websites.

• To sign you in and show you the audits and branches your organisation has given you access to.
• To let your organisation collect, review, approve and report on audits.
• To send service emails (such as account invitations and password resets) and, if enabled, notifications about audits.
• To secure the service, prevent misuse, diagnose errors and improve reliability.

Our legal bases are performing our contract with your organisation, our legitimate interest in running a secure and reliable service, and complying with legal obligations.

We share information only with service providers who help us run Curora, under contracts that require them to protect it:

• Cloud hosting and storage providers that host our servers, database and uploaded files.
• An email delivery provider for invitations, password resets and notifications.
• An error-monitoring provider that receives technical error reports (configured not to include personal data where possible).
• A payment processor, only for organisations on a paid plan arranged with us (we do not store card details).
• Apple and Google, only to deliver push notifications if you turn them on.

We may also disclose information where the law requires it.

Our providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

Audit records are kept for as long as your organisation keeps its Curora account, because care regulators often require audit history to be retained. When an organisation leaves Curora, we delete or return its data within a reasonable period, except where we must keep it by law.

Data is encrypted in transit (HTTPS), access is restricted by role and branch, and uploaded files are stored privately. Sign-in tokens on your device are kept in the device’s secure storage.

Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict its use, and to data portability. Because your organisation controls most audit data, we may pass your request to it.

Deleting your account: ask your organisation’s administrator, or email us at support@curora.co.uk and we will handle it with your organisation.

If you are in the UK you can complain to the Information Commissioner’s Office (ico.org.uk), though we would appreciate the chance to help first.

Curora is a workplace tool for adults. It is not intended for children and we do not knowingly collect data from them.

We may update this policy. We will change the “last updated” date above and tell organisations about significant changes.

ALGO IT SOLUTIONS LIMITED — email support@curora.co.uk.