Using FosterFlow Privately:
Is It Compliant?
Many foster carers sign up for FosterFlow independently to save time and reduce paperwork stress. If you are paying for your own subscription and your agency isn't sponsoring the app yet, here is the official, legally-backed breakdown of how we protect you, your data, and your compliance.
ICO Registered
ZC136598
Data protection registered
UK Data Residency
London Servers
Supabase & R2 Storage
AES-256 Encrypted
Bank-Grade Security
Secure at rest & in transit
Zero-Training AI
Gemini Enterprise
None of your logs are stored
Is it 100% compliant if my agency hasn't approved it yet?
Yes. FosterFlow is a digital recording and writing assistant—it does not replace your agency's official database. Under UK GDPR, you have the right to keep secure, private notes to help you remember events (just like using a paper diary or phone notes). You simply use FosterFlow to structure your observations, then copy/paste or export the completed reports directly into your agency's system. This satisfies your recording duties while maintaining absolute GDPR compliance.
The Legal & Security Safeguards
1. You Retain Data Sovereignty
Because you pay for your own account, you own your records. FosterFlow acts as the Data Controller under UK GDPR based on your Explicit Consent (Article 9). You can export your data instantly using the 1-Click DSAR Tool or delete your account at any time, which triggers a complete cascading purge of all children's records.
2. Ofsted-Compliant Hashing
To comply with Ofsted National Minimum Standards (NMS 25), daily logs are automatically sealed and hashed (SHA-256) within 24 hours of creation. This mathematically proves to social workers and Ofsted inspectors that your logs were recorded contemporaneously and have not been altered.
3. Zero-Access Support Policy
Your records contain sensitive, Special Category data about children. FosterFlow staff operate under a strict Zero-Access Protocol—no admin can access or read your diary logs, voice notes, or files unless you provide explicit, written consent to help debug a support ticket.
4. Absolute Agency Privacy
Since you pay for your own account, your agency has no direct visibility over your dashboard. We will never share, sell, or disclose your logs to your fostering agency or local authority without your consent, unless legally compelled under a formal court warrant or subpoena.
Why You Should NEVER Use ChatGPT for Daily Logs
Some carers attempt to write daily logs using general AI tools like ChatGPT or their phone's native notes app. While it seems convenient, this violates UK GDPR regulations for foster carers. Here is how FosterFlow compares:
❌ General AI (ChatGPT / Public Apps)
- Model Training: Public AI tools retain and use your inputted notes to train, fine-tune, and improve their models.
- Non-UK Servers: Data is regularly processed on servers outside the UK/EEA (such as in the US), violating local authority requirements.
- No Legal Chain of Custody: No SHA-256 tamper-proof timestamps to protect against false allegations.
✅ FosterFlow Fostering AI
- Zero-Retention Policy: FosterFlow uses strict enterprise API agreements with Google Gemini. None of your data is ever saved, trained on, or used by the AI model.
- Strict UK Data Residency: All data, media, and records are hosted on secure UK-based servers (Supabase & Cloudflare R2).
- Forensic Audit Trail: Logs feature tamper-proof SHA-256 integrity certificates, protecting you in LADO/Ofsted audits.
Integrating with Fostering Portals
Fostering services use core administrative portals to maintain the statutory record.
FosterFlow is not a replacement for these portals, but a recording and structuring assistant. Carers use our app to dictate their observations, structure daily diaries instantly using AI, and then copy/paste or export the completed text directly into their agency's portal. This saves hours of writing while ensuring the agency remains the statutory Data Controller.
How Do I Share My Logs with My Agency?
Since you are using the app privately, your agency does not have direct access to your database. Instead, you can share records securely using the following tools built directly into the app:
1-Click PDF Export
Generate and download beautiful, chronologically structured PDF reports of daily logs, incident logs, or medication logs for any date range to email directly to your social worker.
Secure Share Links
Generate secure, time-limited read-only web links containing specific daily log ranges or incident reports. Your social worker can view the logs online without needing an account.
Frequently Asked Questions
Do I need my supervising social worker's permission to use FosterFlow?
No. Just like you do not need permission to use Microsoft Word, Apple Notes, or a physical notebook to draft your observations before submitting them, FosterFlow is simply a drafting assistant. It helps you dictate and structure your logs, and you remain in complete control of when and how they are uploaded to your agency.
Who owns the data I put into FosterFlow?
You do. On an independent plan, you pay for your own account and own your records under the UK GDPR Article 9 Explicit Consent basis. You can export or delete all data at any time via your settings.
Where is my data physically stored?
All database records and file uploads are hosted on highly secure, enterprise-grade cloud servers physically located in the UK (London region) to comply with local authority data residency rules.
What if my Social Worker asks about the app?
If your Supervising Social Worker (SSW) asks about the app, you can copy/paste this template to reassure them about your data compliance:
Subject: Note regarding my record-keeping setup Hi [Social Worker Name], I wanted to let you know that I am using a secure UK-based digital assistant called FosterFlow (fosterflow.uk) to help structure my daily logs and recordings. For reassurance: - It acts strictly as my private diary/drafting assistant; my official logs will continue to be uploaded directly to our agency system as usual. - The system is fully UK GDPR compliant and registered with the ICO (ZC136598). - None of the AI transcription is stored, trained on, or used by public AI providers (it uses private enterprise API contracts). - All records are hosted in secure UK datacenters and are fully encrypted (AES-256). I will be sending my reports over to you via [PDF / secure share links] as usual. Please let me know if you would like me to share a copy of their compliance statement.
Reclaim your evenings, securely.
Start your 7-day free trial as an independent carer today. No commitment, cancel in 1 click.
What if my agency decides to pay for it later?
If your fostering provider eventually purchases a corporate license for their carers, you don't have to worry about re-entering anything. We can transition your private, self-paying account to their organization dashboard in seconds. You will immediately stop being billed privately, and all of your historical records, children's profiles, and settings will remain fully intact.