Last reviewed: July 2026.
Heddfa is a care-management platform for small independent care homes, nursing homes and care practices. This policy explains what personal data we handle, why, and the rights you have. We’ve written it in plain English on purpose — if anything here is unclear, email us at hello@heddfa.co.uk and we’ll explain.
Who we are
Heddfa is a family-run business based in South Wales. In this policy, “we”, “us” and “Heddfa” mean [[Heddfa — registered company name and number to be confirmed]]. We are registered with the UK Information Commissioner’s Office (ICO) under registration number [[to be confirmed]].
The two hats we wear
How data-protection law applies to Heddfa depends on which data we’re talking about, so it’s worth being clear up front:
- Care records — you are the controller, we are the processor. When a care home uses Heddfa to record residents’ care — medication, care plans, assessments, incidents, handovers, family updates — the care home decides what is recorded and why. That makes the care home the data controller. We only process that information on the care home’s documented instructions, to provide the service. This is governed by the data-processing terms in our contract with the home.
- Account and website data — we are the controller. For the information we hold to run our business — the people who sign up, book demos, contact us, or administer a home’s account, plus visitors to this website — we decide the purpose, so we are the controller. The rest of this policy is mainly about that data.
Data we handle as a processor (care records)
On behalf of the care homes that use Heddfa, the platform stores information about residents and the staff who care for them. This can include special-category data such as health and medication records, and information about identified or identifiable people. We only ever access it to deliver, support, secure and maintain the service, or where the law requires it. We do not sell it, we do not use it for advertising, and we do not use it to train third-party AI models. Residents and their families should direct requests about their own care records to the care home holding them, as controller; we will support the home in responding.
Data we hold as a controller
| What | Why (lawful basis) |
|---|---|
| Name, work email, phone, care-home name and role — from sign-ups, demo bookings and enquiries | To respond to you, set up and administer your account, and provide support (contract / legitimate interests) |
| Billing and payment details | To take payment and meet our accounting and tax obligations (contract / legal obligation). Card details are handled by our payment provider — we do not store full card numbers. |
| Support messages and correspondence | To help you and keep a record of what we agreed (legitimate interests) |
| Basic website analytics and server logs | To keep the site secure, working and to understand what’s useful (legitimate interests / consent for non-essential cookies) |
Cookies and analytics
This site uses cookies that are strictly necessary for it to function, and — only with your consent — a small amount of privacy-respecting analytics so we can see which pages help. You can decline non-essential cookies without losing any functionality, and you can change your choice at any time in your browser settings.
Who we share data with
We don’t sell your data. We share it only with the service providers we need to run Heddfa — for example secure cloud hosting, our payment provider, and email delivery — each under a contract that limits them to acting on our instructions. We may also disclose data where the law requires it. We choose suppliers who let us keep personal data in the UK or European Economic Area wherever practical; where any transfer outside the UK is necessary, we put appropriate safeguards in place (such as an adequacy decision or standard contractual clauses).
How long we keep it
We keep account and billing records for as long as you’re a customer and for the period afterwards that our legal and accounting obligations require. Enquiry and demo data is kept only as long as needed to follow up. Care records processed on a home’s behalf are retained and deleted according to that home’s instructions and its own retention obligations, as set out in our contract.
How we protect it
Data is encrypted in transit, access is role-based and least-privilege, actions in the platform are audited, and we hold regular backups. No system is perfectly secure, but security is built into how the product works rather than added on — the audit trail, permissions and tenancy separation are core to Heddfa.
Your rights
Under UK data-protection law you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, and to data portability, in the circumstances the law allows. To exercise any of these, or if you have a concern, email hello@heddfa.co.uk. If you’re not happy with our response you can complain to the ICO at ico.org.uk. If your request is about your care records, please contact the care home that holds them — they are the controller for that information.
Changes to this policy
We’ll update this page when our practices change and revise the “last reviewed” date above. Material changes affecting our customers will be notified directly.