Last updated: 26 October 2026
Carevia is committed to protecting your privacy and handling personal data responsibly and lawfully. This Privacy Policy explains how we collect, use, store and protect personal information when you use our website, services, memberships and digital tools, including Ask Carevia and The Noticing Hub™, and when we contact business professionals about relevant Carevia services.
1. Who We Are
Carevia Quality & Compliance Ltd (trading as Carevia)
Registered in England and Wales | Company No. 17524613
Registered office: 124-128 City Road, London, EC1V 2NX, United Kingdom
Email: info@carevia.co.uk
Carevia is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Personal Data We Collect
We may collect and process the following types of personal data:
a. Information you provide directly
Name
Email address
Organisation name (if provided)
Account login details
Membership and purchase information
Communications you send to us (for example emails or support queries)
b. Information collected automatically
IP address
Browser type and device information
Pages visited and interaction data
Cookies and similar technologies (see Section 9)
c. Payment information
Payments are processed securely by third-party payment providers. Carevia does not store full payment card details.
d. Business contact and outreach information
Where we identify an adult social care provider or other relevant organisation that may benefit from Carevia services, we may collect limited business-related information about its representatives, such as Registered Managers, Nominated Individuals, directors and quality or compliance leads. This may include:
- the person’s name, job title, employer, business email address and publicly listed business contact details;
- the organisation’s name, legal status, website, location and regulatory registration details;
- publicly available Care Quality Commission (CQC) registration, inspection, assessment and quality information relevant to the organisation;
- the public source and date on which relevant details were obtained;
- our business-relevant reasons for contacting the organisation, correspondence history, replies, objections, opt-outs, rejected email notifications and follow-up status.
We obtain this information from public sources, including CQC records and reports, Companies House, organisations’ own websites and published business directories. We may also use business-to-business research and verification services, such as Apollo, where appropriate. An organisation appearing in a public register does not by itself mean that we will contact it. We check relevance, the type of organisation, contact details and previous correspondence before outreach.
3. How We Use Your Personal Data
We use personal data only where there is a lawful basis to do so. This includes:
Providing access to Carevia memberships, toolkits, and resources
Managing user accounts and subscriptions
Responding to enquiries and support requests
Providing access to Ask Carevia and related AI-assisted tools
Improving our services, content, and user experience
Sending service-related communications (such as updates or important notices)
Meeting legal, regulatory, and governance obligations
- Identifying suitable business organisations and sending relevant, personalised business-to-business communications where permitted by law
We do not sell personal data to third parties.
4. Lawful Basis for Processing
Under UK GDPR, we rely on the following lawful bases:
Contract: where processing is necessary to provide purchased services or memberships
Legitimate interests: to operate, improve and secure Carevia services responsibly, and where appropriate to conduct proportionate, relevant business-to-business outreach following a documented balancing assessment
Legal obligation: where required to comply with applicable laws
Consent: where you have explicitly opted in (for example, marketing communications)
You may withdraw consent at any time where consent is the lawful basis.
4A. Business-to-Business Outreach and Direct Marketing
Why we contact business professionals
We may email relevant representatives of adult social care organisations to introduce Carevia’s services, resources and memberships, including The Noticing Hub™, where there is a genuine connection between the organisation’s publicly available activities or regulatory information and the support we offer. Our messages may refer to published CQC findings or organisational strengths. We do not treat a CQC rating as evidence about an individual’s personal circumstances.
Our lawful basis and electronic marketing rules
When we use personal data for relevant business-to-business outreach, we may rely on our legitimate interests in promoting our professional services, subject to an assessment of necessity, proportionality and the rights and reasonable expectations of the individuals concerned. We also assess the Privacy and Electronic Communications Regulations (PECR). Unsolicited marketing emails to corporate subscribers, such as limited companies and limited liability partnerships, generally do not require prior consent under PECR, but UK GDPR obligations continue to apply where personal data is used. We do not assume that a publicly available email address constitutes consent. For sole traders and certain partnerships or other individual subscribers, we do not send unsolicited electronic marketing unless an applicable consent or lawful exception has been established.
How we select and contact organisations
We aim to use a limited, relevant business contact route, check the organisation’s status and prior correspondence, and avoid sending duplicate or excessive messages. We may use published CQC information, business records and publicly available descriptions of the service to tailor a message. We do not use special-category personal data to select prospects. Our prospecting and drafting may be supported by research and digital tools, but no solely automated decision is made about an individual with legal or similarly significant effects.
How we provide privacy information
If we obtain a person’s business contact details from another source, we make this Privacy Policy available and draw attention to it when we first contact them, or otherwise within the timeframe required by UK GDPR. You may ask us which sources we used for your details by emailing info@carevia.co.uk.
Stopping marketing and suppression records
You have an absolute right to object to processing of your personal data for direct marketing at any time. You can reply to an outreach email requesting no further contact, or email info@carevia.co.uk. We will stop using your personal data for direct marketing and maintain a limited suppression record, such as your business email address, organisation, objection date and reason, so we do not contact you again accidentally. We also record permanent delivery failures and invalid or outdated contact routes to prevent inappropriate retries. We do not require you to explain your decision and we do not charge for opting out.
Retention of prospect information
We review prospect records for continuing relevance and accuracy and do not retain them indefinitely without a purpose. Where no business relationship develops, we ordinarily review unengaged prospect records within 12 months of the most recent meaningful activity and delete or anonymise data that is no longer needed. We may retain minimal suppression records for as long as reasonably necessary to honour objections, prevent duplicate outreach and demonstrate compliance. Relevant business correspondence may be retained for a longer period where needed to manage a relationship, resolve a concern or comply with legal obligations.
5. Ask Carevia and AI-Assisted Services
Carevia uses AI-assisted tools, including Ask Carevia, to support users with inspection readiness, governance understanding, and professional reflection in adult social care.
Purpose of AI Use
Ask Carevia is designed to:
Help interpret regulatory expectations and inspection practice
Highlight potential risks and governance considerations
Support reflective thinking and quality improvement
Signpost relevant Carevia resources, toolkits, and guidance
Ask Carevia does not replace professional judgement, clinical decision-making, or regulatory accountability.
How AI Processes Information
Ask Carevia generates responses based on:
Carevia-provided documents and guidance
Pre-defined instructions and governance safeguards
User-submitted queries
Users are explicitly advised not to enter personal, identifiable, or confidential information.
If identifiable information (such as names of people, staff, or services) is entered, Ask Carevia will:
Advise against the use of such information
Request anonymised or role-based descriptions instead
Decline to analyse identifiable data where appropriate
This approach aligns with information governance, confidentiality expectations, and CQC inspection standards.
Data Handling and Retention
Ask Carevia does not intentionally store or profile individuals.
AI interactions may be processed temporarily to generate responses and improve service quality.
Carevia does not use Ask Carevia to make automated decisions about individuals.
Limitations and Safeguards
Ask Carevia:
Does not provide legal advice
Does not provide emergency, safeguarding, or clinical instructions
Does not approve, sign off, or certify compliance
Does not guarantee inspection outcomes
Where queries involve higher risk, complex judgement, or potential enforcement impact, Ask Carevia will recommend escalation to human review. Ask Carevia Ask Carevia+ is not intended for use in emergencies, safeguarding crises, or situations requiring immediate clinical or medical decision-making. In such circumstances, users must follow their service’s escalation procedures and seek appropriate professional or medical advice.
Human Oversight
Carevia maintains human oversight of AI-assisted services. Ask Carevia and Ask Carevia+ is intended as a first layer of expert thinking, not a final authority.
Carevia Pro+ members may request contextual, human-led review via email where appropriate.
Your Responsibility
Users remain responsible for:
Professional judgement
Service-specific decision-making
Compliance with legal and regulatory requirements
Carevia resources including Ask Carevia and Ask Carevia+ are designed to support professional reflection, governance, and inspection readiness.
Responsibility for decision-making, regulatory compliance, and safeguarding always remains with the Registered Provider, Registered Manager, or relevant professional role. AI-generated guidance should always be considered alongside professional expertise, policies, and local context.
6. Sharing Your Data
We may share personal data only where necessary, including with:
Website hosting and IT service providers
Payment processors
Email and communication platforms
Analytics providers (in anonymised or aggregated form where possible)
- Business research, contact verification, email, spreadsheet and record-management services used to administer outreach, where necessary and subject to appropriate safeguards
All third parties are required to process data securely and in accordance with data protection law.
7. Data Retention
We retain personal data only for as long as necessary to:
Provide services
Business prospect and suppression records are handled as described in Section 4A. We periodically review these records to remove outdated or unnecessary information while retaining the minimum information needed to honour marketing objections.
Meet contractual obligations
Comply with legal and regulatory requirements
When data is no longer required, it is securely deleted or anonymised.
8. Your Data Protection Rights
Under UK GDPR, you have the right to:
Access your personal data
Request correction of inaccurate data
Request erasure of your data (where applicable)
Restrict or object to processing
Data portability
Withdraw consent at any time
- Complain to the Information Commissioner’s Office (ICO) if you believe we have mishandled your personal data (see ico.org.uk/make-a-complaint)
Your right to object to direct marketing is unconditional. Contact us at any time and we will stop using your personal data for marketing, although we may retain limited information to record and respect your objection.
To exercise these rights, contact: info@carevia.co.uk
9. Cookies
Carevia uses cookies and similar technologies to ensure the website functions properly and to understand how users interact with our content.
You can manage cookie preferences through your browser settings or cookie banner where applicable.
10. Data Security
Carevia uses appropriate technical and organisational measures to protect personal data, including:
Secure hosting environments
Access controls
Encryption where appropriate
Regular review of data handling practices
No system is completely secure, but we take reasonable steps to protect information against unauthorised access, loss, or misuse.
11. International Transfers
Where data is transferred outside the UK, appropriate safeguards are in place to ensure compliance with UK data protection law.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law, guidance, or our services. The latest version will always be published on our website.
13. Contact Us
If you have questions or concerns about this Privacy Policy or how your data is handled, please contact:
Email: info@carevia.co.uk
Address: Carevia Quality & Compliance Ltd, 124-128 City Road, London, EC1V 2NX, United Kingdom