01
Who we are
Caseload is operated by BespokeWorks.ai Ltd. We provide AI documentation tools for UK social housing and adult social care providers. We are the data processor; your organisation is the data controller.
02
What data we process
- Voice recordings (temporarily, for transcription only - deleted immediately after processing)
- Transcribed notes and generated records
- Resident information entered by support workers (names, dates of birth, case references)
- Quality scores and review records
- User account information (name, email, role)
- Audit logs (actions taken within the system)
03
Lawful basis
We process personal data under Article 6(1)(b) (contractual necessity) for providing the service, and Article 6(1)(f) (legitimate interests) for security and quality improvement. Special category data (health, social care) is processed under Article 9(2)(h) (health or social care purposes) with appropriate safeguards.
04
Data residency
Application services run on Google Cloud Run in europe-west1 (Belgium). Database hosting is on Cloud SQL in europe-west1. Audio is transcribed in-memory by Deepgram (UK / EU region) and is not retained after the live session. No personal data leaves the UK / EU. Where the legacy single-document generator is used, personal identifiers are tokenised before any model call and re-inserted in the response. PII tokenisation in the live KWSN pipeline is on the v1.1 plan; until that ships, controllers should treat KWSN generation as model-visible for the worker's rawNote and rely on Aspect's OpenRouter + Anthropic data-processing agreements for residency.
05
Data retention
Social care records are retained for 8 years in line with the NHS Records Management Code of Practice 2021. Audio recordings are deleted immediately after transcription. Audit logs are retained for the lifetime of the service.
06
Your rights
- Access (Article 15): request all data held about a resident via Subject Access Request
- Erasure (Article 17): request deletion of resident data (audit log structure preserved, identifiers removed)
- Rectification (Article 16): correct inaccurate data via the editing interface
- Portability (Article 20): export case files as structured JSON or PDF
07
Security measures
- TLS in transit between the browser, web service and API service
- Google-managed encryption at rest (Cloud SQL default)
- Tenant-id partitioning enforced at the application layer; PostgreSQL Row-Level Security on the roadmap for the Cloud SQL cutover
- Append-only audit log per organisation; cryptographic hash-chain integrity is on the v1.1 plan
- PII tokenisation for legacy document generation; KWSN-pipeline tokenisation is on the v1.1 plan
- JWT-based authentication with role-based access control (worker, supervisor, admin)
- Audit trail of every approval, return, erasure request, and consent capture
08
Cookies
Caseload uses only essential session cookies for authentication. No analytics cookies, no advertising trackers, no third-party tracking. No cookie consent banner is required under the Privacy and Electronic Communications Regulations 2003 as we use strictly necessary cookies only.
09
Contact
For privacy queries or to exercise your rights, contact our Data Protection Officer at privacy@bespokeworks.ai.