CareComm+ · Your community takes care of you

Draft Privacy Notice

Version 1.0 · Prototype review copy · 24 July 2026

No real-data collection on this prototype. Do not upload identity documents, professional licences or health information. Controller roles, lawful bases, retention periods, DPO contact details and processor agreements must be finalized before production.

Why information would be used

To process an application, verify the relevant role and authority, coordinate a requested care journey, schedule available capacity, support benefit routing, maintain safety and security, and produce permitted operational or aggregate reporting.

Progressive collection

Application: name or preferred name and contact channel.
Role verification: only evidence relevant to the role, such as identity, professional credential, facility licence, organization authority or family proxy.
Care coordination: appointment, attendance, task and exception status.
Clinical information: remains under the accountable clinical route and is not exposed to every network participant.

Who can see what

Access is based on verified identity, verified role, current relationship, assigned purpose and the minimum information needed for the task. Sponsors and community logistics roles do not receive personal clinical results merely because they participate in a program.

Your choices and rights

The production service must provide appropriate channels to ask what is held, request correction, exercise applicable data-subject rights, withdraw a revocable family proxy, change communication choices and raise a privacy concern. Withdrawing consent does not necessarily affect processing supported by another valid legal basis; the controller must explain this clearly.

Security and retention

Production requires a privacy impact assessment, documented data map, encryption, strong authentication, least privilege, access reviews, audit logging, secure deletion, incident response, breach procedures, tested recovery and purpose-specific retention schedules. Full ID images should not be retained when an authoritative yes/no check or assisted proofing record is sufficient.

Separate decisions

This notice is informational. A Terms acknowledgement is separate from health-data consent, a caregiver proxy grant, a partner contract, a medical consent and a clinician’s professional duties. Each decision must be presented at the appropriate time and recorded separately.