--- title: "Privacy Policy | FosterFlow.uk | FosterFlow" source_url: "https://fosterflow.uk/privacy" canonical_url: "https://fosterflow.uk/privacy" retrieved_by: "AnswerRail Edge Engine v1.1.0-parity-v20 (https://answerrail.com)" provenance: "Compiled for deterministic AI retrieval by AnswerRail Edge (RFC 9110 / RFC 9421)" description: "FosterFlow Privacy Policy — comprehensive details on how we protect, encrypt, and manage Special Category Data for UK foster carers and agencies." rfc_compliance: "RFC 9110 / RFC 9309 / RFC 9421" version: "1.1.0" release_version: "v1.1.0-parity-v20" signing_kid: "ar_ed25519_2026_k1" jwks_uri: "https://answerrail.com/.well-known/http-message-signatures-directory" edge_network: "Cloudflare Workers Anycast (330+ Global PoPs)" verified_latency: "<15ms (Warm Edge Cache HIT) / 80-250ms (Cold AST Compile)" --- > **Canonical Source:** [https://fosterflow.uk/privacy](https://fosterflow.uk/privacy) > > *FosterFlow Privacy Policy — comprehensive details on how we protect, encrypt, and manage Special Category Data for UK foster carers and agencies.* Loading FosterFlow... # Privacy Policy Last updated: April 15, 2026 ## 1. Who We Are **Entity:** Tearamo Ltd (trading as FosterFlow) **Company Number:** 16992542 (Registered in England & Wales) **ICO Registration:** ZC089122 (Information Commissioner's Office) **Registered Office:** High Street Road, Faversham, Kent, ME13 9EJ **Data Protection Officer (DPO):** [[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#0460746b44626b7770617662686b732a716f) **Role:** FosterFlow acts as the **Data Controller** for independent Carers managing their own account and reflective compliance diary. For users and placements managed by a Fostering Agency or Local Authority, FosterFlow acts as a **Data Processor** on behalf of that Agency (the Data Controller). Support Contact: [[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#f2818782829d8086b2949d81869780949e9d85dc8799) ## 2. Special Category Data & Recording Scope Under the UK General Data Protection Regulation (UK GDPR) Article 9 and the Data Protection Act 2018, records relating to foster care, health, welfare, and social care involve **Special Category Data**. Independent Carers use FosterFlow as a personal reflective and carer-compliance diary using de-identified initials or first-names in accordance with their Supervising Social Worker / Fostering Service's recording policy. Agency-linked accounts process placement records under their Fostering Service's Data Processing Agreement ([/dpa](https://fosterflow.uk/dpa)). ## 3. Lawful Basis for Processing We process personal and Special Category Data under the following UK GDPR and Data Protection Act 2018 bases (note: foster carers do not grant Article 9(2)(a) Explicit Consent on behalf of looked-after children): - **Contract (UK GDPR Art. 6(1)(b)):** To provide, bill, and support the software subscription service for the account holder. - **Legitimate Interests & Health / Social Care Provision (UK GDPR Art. 6(1)(f) & Art. 9(2)(h) / DPA 2018 Schedule 1 Part 1):** Independent Carers use FosterFlow as a personal reflective and carer-compliance diary using de-identified initials/first-names in accordance with their Supervising Social Worker / Fostering Service's recording policy. - **Substantial Public Interest & Statutory Duty (UK GDPR Art. 6(1)(c)/(e) & Art. 9(2)(g)/(h)):** For Fostering Agencies and Local Authorities fulfilling their statutory recording obligations under the Fostering Services (England) Regulations 2011 and Ofsted Fostering National Minimum Standards (2011) Standard 26 (Case records). ## 4. "Zero-Access" Support Protocol FosterFlow administrators operate under a strict **Zero-Access Protocol**. We will NEVER access, read, or audit your encrypted care records unless you provide explicit, written authorisation via an active support request (e.g., to debug a specific log). You retain full sovereignty over your unshared data. ## 5. Voice Recordings & Artificial Intelligence Processing Guarantee FosterFlow uses **Deepgram (`nova-2`)** for zero-data-retention voice-to-text transcription and **Google Cloud Vertex AI / Gemini (`gemini-2.5-flash`)** for zero-data-retention AI structuring and summarisation. **We guarantee that ZERO data processed by our platform is used by our AI providers to train, fine-tune, or improve their foundational models.** Encrypted voice recordings are stored in **Cloudflare R2** for carer playback and audit verification until deleted by the carer or governed by the applicable retention policy. ## 6. Sub-Processors & International Data Transfers To provide our services, we engage carefully vetted sub-processors. Whenever data is transferred outside the UK/EEA, it is protected by the UK International Data Transfer Addendum (IDTA), Standard Contractual Clauses (SCCs), or the UK Extension to the EU-US Data Privacy Framework: - **Supabase:** Primary Database (PostgreSQL with Row-Level Security & AES-256 Encryption at Rest) - **Clerk:** Authentication and Identity Management - **Cloudflare R2:** Encrypted Audio & Media Storage - **Deepgram (`nova-2`):** Zero-Data-Retention Voice-to-Text Transcription - **Google Cloud Vertex AI / Gemini (`gemini-2.5-flash`):** Zero-Data-Retention AI Structuring & Summarisation - **Stripe:** PCI-DSS Level 1 Payment Processing - **Mailgun:** Transactional Email Delivery - **Upstash:** Redis Rate Limiting & Abuse Prevention - **GoHighLevel:** Agency CRM & B2B Onboarding Communications (business contact details only; never child care logs) - **Sentry:** Error Monitoring & Telemetry (with 100% DOM Session Replay Text/Media/Input Masking and PII Scrubbers) ## 7. Law Enforcement & Safeguarding Subpoenas FosterFlow respects the confidentiality of your records. We will only release an independent Carer's data under a formal statutory warrant, court order, or lawful compulsion issued by law enforcement, the Local Authority Designated Officer (LADO), or Ofsted. We will NOT release independent account data based on informal requests without the Carer's authorisation. ## 8. Data Retention & Statutory Fostering Archival We retain your data for as long as your account is active, subject to distinct retention rules depending on whether your account is an Independent Carer diary or an Agency-linked institutional placement under the **Fostering Services (England) Regulations 2011 (Regulation 30 & Regulation 22(6))** and **Ofsted Fostering NMS (2011) Standard 26 (Case records)**: - **Independent Carer Self-Service Cancellation / Deletion:** Independent Carers may export their records at any time and delete individual entries or their entire account. Upon self-service subscription cancellation, independent carer data is retained in a read-only export grace period for 30 days and then permanently purged (including encrypted audio files in Cloudflare R2). - **Agency-Linked Institutional Placements (Regulation 30 & Regulation 22(6)):** Where placements are managed by a Fostering Agency or Local Authority (the Data Controller), records are governed by the Agency's statutory retention schedule: **Regulation 30 (Child Case Records)** requires preservation for at least **75 years from the child's date of birth** (or 15 years from date of death if the child dies before age 18), and **Regulation 22(6) (Foster Carer Records)** requires preservation for at least **10 years from the date on which the carer's approval is terminated**. - **Empty Shell Trial Accounts:** Abandoned trial accounts with zero child files, zero daily logs, and zero incidents are automatically purged on Day 91 to enforce data minimisation. - **Safeguarding & LADO Investigation Freezes:** In the event of an active safeguarding concern or Local Authority Designated Officer (LADO) investigation, records are immediately locked and exempt from routine deletion. - **24-Hour Cryptographic Daily Log Locking:** Daily logs are editable for minor typo corrections within 24 hours (recalculating SHA-256 vault hashes and logging audit events). After 24 hours, logs are cryptographically sealed under Ofsted Fostering NMS (2011) Standard 26 non-repudiation standards. Agency Override Rule: If your FosterFlow placement is linked to or sponsored by a Fostering Agency, the Agency is the statutory Data Controller. Because Fostering Agencies have a statutory duty under Regulation 30 (75 years for child case records) and Regulation 22(6) (10 years for carer records), institutional placement records cannot be unilaterally erased by a carer and are retained or exported in accordance with the Agency Controller's instructions. ## 9. Your Rights (UK GDPR) You have the right to: - **Access & Portability:** Download all your data instantly using the 1-Click DSAR Vault in your Settings. - **Rectification:** Correct inaccurate data via the app. For logs older than 24 hours (which are cryptographically sealed), you must append a formal Amendment. - **Erasure:** Request deletion of your independent carer data (subject to the Agency Override Rule for institutional placements). - **Complaint:** Lodge a complaint with the Information Commissioner's Office ([ico.org.uk](https://ico.org.uk), ICO Registration: ZC089122). ## 10. Contact Us & Data Protection Officer For any privacy questions, Data Subject Access Requests, or to contact our Data Protection Officer, email [[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#5d392d321d3b322e29382f3b31322a732836) or [[email protected]](https://fosterflow.uk/cdn-cgi/l/email-protection#a5d6d0d5d5cad7d1e5c3cad6d1c0d7c3c9cad28bd0ce), or write to Tearamo Ltd, High Street Road, Faversham, Kent, ME13 9EJ. --- ## 🏛️ AI Ingestion & Edge Optimization Provenance This sovereign authority subpage is compiled and delivered across 330+ Cloudflare Anycast edge locations by [AnswerRail](https://answerrail.com) for [https://fosterflow.uk/privacy](https://fosterflow.uk/privacy).