Using FosterFlow Privately:
Is It Compliant?
Many foster carers sign up for FosterFlow independently to save time and reduce paperwork stress. If you are paying for your own subscription and your agency isn't sponsoring the app yet, here is the official, legally-backed breakdown of how we protect you, your data, and your compliance.
ICO Registered
ZC136598
Data protection registered
UK Data Residency
London Servers
Supabase & R2 Storage
AES-256 Encrypted
Bank-Grade Security
Secure at rest & in transit
Zero-Training AI
Gemini Enterprise
None of your logs are stored
Is it 100% compliant if my agency hasn't approved it yet?
Yes, provided you follow our Anonymisation Workflow. FosterFlow operates as an administrative writing notebook. Under UK GDPR Article 4(5) (Pseudonymisation), as long as you do not record legal child names, NHS numbers, or identifiable addresses, you do not breach agency data policies or create unauthorised Data Controllership. You simply use FosterFlow to structure your observations using pseudonyms (e.g. Child A), then copy/paste the formatted logs into your agency's official database (Charms, Liquidlogic, Mosaic) where real names are added.
The 4-Step Anonymised Carer Workflow
Follow this workflow to use FosterFlow safely without needing prior agency IT sign-off:
Dictate with Pseudonyms
Speak your notes using "Child A" or initials. Never say full legal names or school names.
AI Structures Draft
FosterFlow structures raw voice notes into Ofsted-ready chronologies & incident reports.
Carer Verifies Log
Review the generated draft, make adjustments, and click Human Verified.
Copy to Official System
Copy verified text into Charms, Mosaic, or Liquidlogic and add real child names there.
Independent Use Safety Matrix
🟢 SAFE (Personal Drafting Notebook)
- ✓ Using pseudonyms (e.g. "Child A") in voice notes.
- ✓ Generating formatted chronologies & daily logs.
- ✓ Copying text into official agency systems (Charms/Mosaic).
- ✓ Asking your agency to sponsor your account for full DPA integration.
🔴 UNSAFE (Breaches GDPR Without Agency DPA)
- ✗ Dictating real full legal names, NHS IDs, or specific home addresses.
- ✗ Using FosterFlow as the sole database without updating official agency files.
- ✗ Unverified copy-pasting without human carer review.
- ✗ Relying on software instead of dialing 999 for emergencies.
The Legal & Security Safeguards
1. You Retain Data Sovereignty
Because you pay for your own account, you own your records. FosterFlow acts as the Data Controller under UK GDPR based on your Explicit Consent (Article 9). You can export your data instantly using the 1-Click DSAR Tool or delete your account at any time, which triggers a complete cascading purge of all children's records.
2. Ofsted-Compliant Hashing
To comply with Ofsted National Minimum Standards (NMS 25), daily logs are automatically sealed and hashed (SHA-256) within 24 hours of creation. This mathematically proves to social workers and Ofsted inspectors that your logs were recorded contemporaneously and have not been altered.
3. Zero-Access Support Policy
Your records contain sensitive, Special Category data about children. FosterFlow staff operate under a strict Zero-Access Protocol—no admin can access or read your diary logs, voice notes, or files unless you provide explicit, written consent to help debug a support ticket.
4. Absolute Agency Privacy
Since you pay for your own account, your agency has no direct visibility over your dashboard. We will never share, sell, or disclose your logs to your fostering agency or local authority without your consent, unless legally compelled under a formal court warrant or subpoena.
Why You Should NEVER Use ChatGPT for Daily Logs
Some carers attempt to write daily logs using general AI tools like ChatGPT or their phone's native notes app. While it seems convenient, this violates UK GDPR regulations for foster carers. Here is how FosterFlow compares:
❌ General AI (ChatGPT / Public Apps)
- Model Training: Public AI tools retain and use your inputted notes to train, fine-tune, and improve their models.
- Non-UK Servers: Data is regularly processed on servers outside the UK/EEA (such as in the US), violating local authority requirements.
- No Legal Chain of Custody: No SHA-256 tamper-proof timestamps to protect against false allegations.
✅ FosterFlow Fostering AI
- Zero-Retention Policy: FosterFlow uses strict enterprise API agreements with Google Gemini. None of your data is ever saved, trained on, or used by the AI model.
- Strict UK Data Residency: All data, media, and records are hosted on secure UK-based servers (Supabase & Cloudflare R2).
- Forensic Audit Trail: Logs feature tamper-proof SHA-256 integrity certificates, protecting you in LADO/Ofsted audits.
Integrating with Fostering Portals
Fostering services use core administrative portals to maintain the statutory record.
FosterFlow is not a replacement for these portals, but a recording and structuring assistant. Carers use our app to dictate their observations, structure daily diaries instantly using AI, and then copy/paste or export the completed text directly into their agency's portal. This saves hours of writing while ensuring the agency remains the statutory Data Controller.
How Do I Share My Logs with My Agency?
Since you are using the app privately, your agency does not have direct access to your database. Instead, you can share records securely using the following tools built directly into the app:
1-Click PDF Export
Generate and download beautiful, chronologically structured PDF reports of daily logs, incident logs, or medication logs for any date range to email directly to your social worker.
Secure Share Links
Generate secure, time-limited read-only web links containing specific daily log ranges or incident reports. Your social worker can view the logs online without needing an account.
Frequently Asked Questions
Do I need my supervising social worker's permission to use FosterFlow?
No. Just like you do not need permission to use Microsoft Word, Apple Notes, or a physical notebook to draft your observations before submitting them, FosterFlow is simply a drafting assistant. It helps you dictate and structure your logs, and you remain in complete control of when and how they are uploaded to your agency.
Who owns the data I put into FosterFlow?
You do. On an independent plan, you pay for your own account and own your records under the UK GDPR Article 9 Explicit Consent basis. You can export or delete all data at any time via your settings.
Where is my data physically stored?
All database records and file uploads are hosted on highly secure, enterprise-grade cloud servers physically located in the UK (London region) to comply with local authority data residency rules.
How does the app protect the child's identity under GDPR?
FosterFlow operates under a strict anonymisation-by-design policy. Carers are required to only enter a child's initials or a pseudonym (e.g., "Child J."). Because no legal names, NHS numbers, or case file IDs ever enter the system, no child-identifying PII is processed or stored. This satisfies UK GDPR Article 4(5) and Recital 26.
Are my voice recordings saved or used for AI training?
No. Voice recordings are processed transiently in memory for transcription and are immediately deleted. Our AI services utilize a strict Zero-Data Retention policy and never train on your observations. Furthermore, the AI formatting engine automatically detects and replaces any spoken legal names with pseudonyms before saving the text.
Why does the form ask for Date of Birth or Social Worker details?
These fields are completely optional. The child's DOB is only used to calculate age for age-appropriate medication alerts, and you are welcome to enter only the birth month and year. Social worker contact fields behave as a private, secure professional address book isolated within your encrypted account partition, and you can leave them blank or use a generic agency address (e.g. duty@agency.gov.uk).
What if my Social Worker asks about the app?
If your Supervising Social Worker (SSW) asks about the app, you can copy/paste this template to reassure them about your data compliance:
Subject: Note regarding my record-keeping setup Hi [Social Worker Name], I wanted to let you know that I am using a secure UK-based digital assistant called FosterFlow (fosterflow.uk) to help structure my daily logs and recordings. For reassurance: - It acts strictly as my private diary/drafting assistant; my official logs will continue to be uploaded directly to our agency system as usual. - The system is fully UK GDPR compliant and registered with the ICO (ZC136598). - None of the AI transcription is stored, trained on, or used by public AI providers (it uses private enterprise API contracts). - All records are hosted in secure UK datacenters and are fully encrypted (AES-256). I will be sending my reports over to you via [PDF / secure share links] as usual. Please let me know if you would like me to share a copy of their compliance statement.
Reclaim your evenings, securely.
Start your 7-day free trial as an independent carer today. No commitment, cancel in 1 click.
What if my agency decides to pay for it later?
If your fostering provider eventually purchases a corporate license for their carers, you don't have to worry about re-entering anything. We can transition your private, self-paying account to their organization dashboard in seconds. You will immediately stop being billed privately, and all of your historical records, children's profiles, and settings will remain fully intact.