--- title: "GDPR Compliance Statement | FosterFlow.uk | FosterFlow" source_url: "https://fosterflow.uk/gdpr" canonical_url: "https://fosterflow.uk/gdpr" retrieved_by: "AnswerRail Edge Engine v1.1.0-parity-v20 (https://answerrail.com)" provenance: "Compiled for deterministic AI retrieval by AnswerRail Edge (RFC 9110 / RFC 9421)" description: "Read about FosterFlow's commitment to UK GDPR, data minimisation, secure storage, and children's data privacy under the Data Protection Act 2018." rfc_compliance: "RFC 9110 / RFC 9309 / RFC 9421" version: "1.1.0" release_version: "v1.1.0-parity-v20" signing_kid: "ar_ed25519_2026_k1" jwks_uri: "https://answerrail.com/.well-known/http-message-signatures-directory" edge_network: "Cloudflare Workers Anycast (330+ Global PoPs)" verified_latency: "<15ms (Warm Edge Cache HIT) / 80-250ms (Cold AST Compile)" --- > **Canonical Source:** [https://fosterflow.uk/gdpr](https://fosterflow.uk/gdpr) > > *Read about FosterFlow's commitment to UK GDPR, data minimisation, secure storage, and children's data privacy under the Data Protection Act 2018.* # GDPR Compliance Institutional Data Protection Statement — Tearamo Ltd (trading as FosterFlow) | Company No. 16992542 | ICO Registration: ZC089122 ## Our Commitment to UK GDPR FosterFlow is operated by **Tearamo Ltd (trading as FosterFlow)** (Company No. **16992542**, Registered Office: **High Street Road, Faversham, Kent, ME13 9EJ**, ICO Registration: **ZC089122**) and is built with "Privacy by Design" at its core. Given the sensitive nature of foster care records, we adhere strictly to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. ## Data Protection Oversight (DPO) All data protection enquiries, Data Protection Impact Assessment (DPIA) requests, and Data Subject Access Requests (DSARs) can be directed to our Data Protection Officer at [[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#5b3f2b341b3d34282f3e293d37342c752e30) or [[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#7b080e0b0b14090f3b1d14080f1e091d17140c550e10). ## Key UK GDPR Principles in FosterFlow - **Lawfulness and Transparency:** Independent Carers use FosterFlow as a personal reflective and carer-compliance diary using de-identified initials or first-names in accordance with their Supervising Social Worker / Fostering Service's recording policy (**UK GDPR Art. 6(1)(f) Legitimate Interests / Art. 9(2)(h) Health & Social Care provision**). Note: foster carers do not purport to grant Article 9(2)(a) Explicit Consent on behalf of looked-after children. For Agency-linked placements, the Fostering Service or Local Authority acts as the statutory Data Controller under UK GDPR Art. 6(1)(c)/(e) and Art. 9(2)(g)/(h). - **Data Minimisation:** Independent carers record de-identified initials or first-names rather than full legal names, NHS numbers, or case IDs when using FosterFlow as a personal reflective diary. - **Accuracy & Non-Repudiation:** In alignment with **Ofsted Fostering NMS (2011) Standard 26 (Case records)**, our Legal Vault freezes and cryptographically seals daily logs with SHA-256 hashes after 24 hours, preserving an accurate, immutable chronology with append-only amendments. - **Storage Limitation & Statutory Retention:** Independent Carer self-service cancellation or deletion purges data after a **30-day export grace period**. Conversely, Agency-linked institutional placements are retained under the Agency Data Controller's statutory retention schedule (**Fostering Services (England) Regulations 2011 Reg 30** — 75 years from date of birth for child case records; **Reg 22(6)** — 10 years from approval termination for foster carer records). - **Integrity and Confidentiality:** We enforce TLS 1.3 in transit, AES-256 encryption at rest, and strict Row-Level Security (RLS) multi-tenancy isolation. ## Compliant Foster Care Record Keeping & Voice Storage FosterFlow supports both Independent Carers maintaining a reflective compliance diary and Fostering Agencies operating under a signed Data Processing Agreement ([/dpa](https://fosterflow.uk/dpa)): - **De-Identified Reflective Diary for Independent Carers:** Independent Carers use de-identified initials or first-names (e.g., "Child J.") in accordance with their Supervising Social Worker / Fostering Service's recording policy under UK GDPR Article 4(5) (Pseudonymisation), Art. 6(1)(f), and Art. 9(2)(h). - **Optional Metadata Fields:** Recording Dates of Birth and Social Worker contact details is optional for independent carers and secured within your private encrypted account partition. - **Encrypted Audio Storage & Zero-Data-Retention AI:** Voice notes are transcribed via **Deepgram (`nova-2`)** and structured via **Google Cloud Vertex AI / Gemini (`gemini-2.5-flash`)** under strict zero-data-retention enterprise API agreements (never used for AI model training). Encrypted voice recordings are stored in **Cloudflare R2** for carer playback and audit verification until deleted by the carer or governed by the applicable retention policy. - **System of Record Compatibility:** Formatted, human-approved logs and reports can be exported or copied directly into your Fostering Service's primary system of record (such as Charms, Liquidlogic, or Mosaic). ## Exercising Your Rights You can export your data at any time via the self-service 1-Click DSAR Vault in Settings, or submit a formal data protection request to our DPO at [[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#dabeaab59abcb5a9aebfa8bcb6b5adf4afb1) (or [[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#4f3c3a3f3f203d3b0f29203c3b2a3d29232038613a24)). ### Institutional Security FosterFlow is engineered by Tearamo Ltd (Company No. 16992542, ICO Registration ZC089122) to meet the rigorous data protection and audit standards of the UK fostering sector. --- ## 🏛️ AI Ingestion & Edge Optimization Provenance This sovereign authority subpage is compiled and delivered across 330+ Cloudflare Anycast edge locations by [AnswerRail](https://answerrail.com) for [https://fosterflow.uk/gdpr](https://fosterflow.uk/gdpr).