GDPR Compliance

Institutional Data Protection Statement

Our Commitment to GDPR

FosterFlow is built with "Privacy by Design" at its core. Given the sensitive nature of foster care data, we adhere to the strict requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Protection Oversight

Data protection oversight is managed by our founding team. As we scale, we will appoint a dedicated Data Protection Officer. All data protection enquiries can be directed to support@fosterflow.uk.

Key GDPR Principles in FosterFlow

• Lawfulness and Transparency: We only process data for legitimate professional fostering purposes, clearly detailed in our Privacy Policy.
• Data Minimisation: We only collect the data necessary to provide transcription and reporting services.
• Accuracy: Our "Legal Vault" feature ensures that once a log is finalised, it is frozen to maintain an accurate and immutable historical record.
• Storage Limitation: We retain fostering records only as long as necessary for professional compliance or as dictated by your fostering agency's data retention policy.
• Integrity and Confidentiality: We use industry-standard encryption (AES-256) and secure multi-tenancy isolation to protect data from unauthorized access.

Compliant Foster Care Record Drafting

FosterFlow is designed to keep carers fully compliant with Local Authority (LA) and Independent Fostering Agency (IFA) data guidelines. Because we operate as a secure drafting assistant rather than a primary system of record, carers can use the platform safely under the following safeguards:

• Anonymisation by Design: Carers are prohibited from entering a child's legal name, case numbers, or identifying details. By using initials or a pseudonym (e.g., "Child J."), no Personally Identifiable Information (PII) of the child is stored, satisfying UK GDPR Article 4(5) and Recital 26.
• Optional Fields & Privacy: Storing child Dates of Birth and Social Worker contact numbers is completely optional. If entered, they are secured on your private account partition and are never shared or used for marketing. Carers are welcome to leave them blank or use generic team details (e.g. dutyteam@agency.gov.uk).
• Microphone & Transcripts: Audio recordings are processed transiently in memory for transcription and immediately deleted. The formatting engine automatically detects and replaces any spoken names with their configured pseudonym in the structured text.
• System of Record Compatibility: Once your notes are structured, you copy-paste the finalised, professional text directly into your agency's approved database (such as Charms, Liquidlogic, or Mosaic).

Exercising Your Rights

If you wish to request a copy of your data (Subject Access Request) or exercise your "right to be forgotten," please submit a formal request to: support@fosterflow.uk.