Privacy notice

• Part A: you are visiting this website or have sent us an enquiry.
• Part B: you work for a care home, a GP practice or a community service and you sign in to Aurly.
• Part C: you live in a care home, or are the relative or representative of someone who does.

Who we are. Aurly is provided by Aurly Care ("we", "us").

How to reach us about your data. support@aurly.care.

A1 · What we collect

When you ask for a walkthrough or talk to Ask Aurly: your name, work email address, role, organisation, the kind of organisation, and anything you write.

Please do not write anything about a resident or a patient. An enquiry is checked before it is kept, and one that looks as though it identifies a resident or a patient is refused: it is not stored, and you are told so at once.

When you email us: your email address and what you send.

When you browse: we do not use advertising trackers, session recording or analytics cookies.

A2 · Why, and on what lawful basis

We do not add you to a mailing list because you sent an enquiry. If we ever start a newsletter, we will ask first.

A3 · Who sees it

Our own staff, and the suppliers who run the website and our email. They act on our instructions and may not use your details for their own purposes. We do not sell personal data.

A4 · How long we keep it

We have not yet set how long enquiries are kept. You can ask us to delete yours at any time, at support@aurly.care.

A5 · Cookies

This website sets no cookies that need your consent, so there is no consent banner. If you leave a conversation with Ask Aurly unfinished, your answers are kept in your own browser so you can pick up where you left off. They are not sent anywhere until you press Send, and you can clear them with "Start again".

B1 · Whose data it is

You use Aurly because the organisation you work for has chosen to.

B2 · What Aurly holds about you

• Your identity: name, work email address, and the seat you hold: your role, organisation and, in a community service, your team.
• Your sign-in details: a one-way hash of your password, which nobody at Aurly or your organisation can read. Each time you sign in we email you a 6-digit code; Aurly keeps a scrambled form of it for up to ten minutes and never the code itself. Platform administrators also have a secret for their authenticator app. Nobody can set your password for you.
• What you do in Aurly: every action on a request is recorded against your seat with the time. Each is also written to a tamper-evident ledger. The ledger records what happened and who did it. It never holds your written words.
• What you write: request descriptions, notes and replies, which are part of the care record of the request.
• Session and security records: when you signed in, failed attempts, and lockouts.
• Push notification subscriptions, if you switch notifications on for a device.

What Aurly does not hold: your personal telephone number. Texts and calls go to a team's duty handset, and Aurly does not collect personal numbers.

B3 · Why

To let you do your job in Aurly; to show colleagues in the three organisations who holds a request and who acted on it; to remind and escalate when a request is running out of time; and to keep a record that can be relied on afterwards. The lawful basis is set by your organisation as controller.

B4 · Messages we send you

B5 · On your device

• One cookie, which keeps you signed in. It is strictly necessary, cannot be read by scripts, and is not used for tracking.
• The app itself is stored on the device so that it opens quickly. Nothing Aurly's server sends about a resident or a request is stored on the device.
• Unsent drafts. If you write a request while offline, it is kept on that device until you send it or discard it. It is never sent without you. If you sign out, or someone else signs in on that device, the draft is wiped; the next person is told a draft was left and is never shown it.

B6 · Where it is held and who processes it

Aurly runs on Google Cloud in London (europe-west2): the database, the application and its secrets. Our processors are:

B7 · How long

When you leave or change role, your seat is ended and your access stops at once. Your account is deactivated, not erased, because the record of who did what must still make sense.

B8 · Who can see what you did

Colleagues in the care home, the practice and the team that currently owns a request can see your actions on that request. Your organisation's administrator can see the audit trail for your organisation. Aurly's platform administrators can see that you have an account and which seats you hold. They cannot open a resident, a request or a note.

C1 · What Aurly is

Aurly is a tool that your care home, your GP practice and your community health or social care team use to pass non-emergency requests about your care between them, and to make sure each one is answered. It is not your medical record and does not replace it.

C2 · Who is responsible for your information

Your care home, your GP practice and the community service share it with each other through Aurly under a data-sharing agreement between them.

To see your information, correct it, or object to how it is used, ask your care home manager or your GP practice. They hold the relationship with you and are responsible for answering. If you write to us instead, we will pass your request to them promptly and tell you that we have.

C3 · What is held

• Your name, the care home you live in and the practice you are registered with.
• Requests staff have raised about your care: what they noticed, how soon it was needed, which team dealt with it, and the outcome.
• Notes that staff added to those requests.
• If you leave the home, move, or die, that fact and its date.

This is information about health, which the law treats as a special category.

C4 · Who can see it

Only staff in your care home, your GP practice, and the one community team that currently holds a request. If a request is passed to a different team, the first team can no longer see it. Some notes are visible only to the practice.

The people who run Aurly's platform cannot see your information. This is built into the software and checked automatically every time it changes.

C5 · What never contains your information

Emails, notifications, text messages and telephone calls from Aurly never contain your name, your condition or what was decided. They contain a reference number only.

Nothing about you is stored on staff phones or tablets. The one exception is a request a member of staff has written while offline and not yet sent, which stays on that one device until it is sent or discarded.

C6 · Automated agents

Two automated agents work inside Aurly. One reads the words a carer has written and suggests which team a request should go to; a person at the practice decides. One sends reminders. Neither sees your medical record, and neither makes any decision about your care.

Your rights

Under data protection law you may ask for a copy of your personal data, ask for it to be corrected, ask for it to be erased or its use restricted, object to its use, and ask for it in a portable form. These rights have limits. In particular, a care record and an audit trail cannot always be erased.

• Website visitors and enquirers: ask us, at support@aurly.care.
• Staff who sign in: ask your own organisation first; it decides how your data is used.
• Residents and representatives: ask your care home or GP practice.

We reply within one month.

Complaints

Please tell us first, so we can put it right. You may also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

We will post any change here with the date. If a change affects how staff or residents' data is handled, we will tell each organisation before it takes effect.