Trust centre
What we hold, what we are working towards, and what we do not claim
Care software is sold on badges. This page is the roadmap instead: each standard is marked held, in progress, planned or not claimed, with a note you can check.
Assurance roadmap
Lawful basis and roles
Care records are special category data under UK GDPR. Kindround processes them on behalf of each provider under Article 9(2)(h), the provision of health and social care, with the provider as controller and Hibba Ltd as processor under a written data processing agreement. A data protection impact assessment is completed before any provider goes live and reviewed at every gate.
Your data stays in the UK/EEA, you are the data controller, and everything is exportable in open formats at any time.
Where the data lives
Kindround runs on Cloudflare. The database and file storage carry Western Europe location hints with EU jurisdiction, recorded in the technical specification and reproduced on the security page. Backups are taken nightly, kept as 35 daily and 12 monthly copies, and a restore drill is run before go-live and every quarter after, with each result recorded.
Retention defaults
These ship as configuration and are adjusted to each provider's policy before go-live. Deletion at the end of retention is a reviewed batch action, never silent erasure.
| Data | Default |
|---|---|
| Care records (adult) | 8 years from end of care |
| Medication administration records | 8 years from end of care |
| Incidents and safeguarding | 8 years, or longer where advised on specific cases |
| Financial records, invoices, timesheets | 7 years |
| Audit log | Tenant lifetime, at least as long as the underlying record |
| Family portal access logs | 2 years |
| Carer HR-adjacent data (skills, time off) | 6 years after employment ends |
| Photos not attached to any record | 90 days, then removed |
Subject access and erasure
A subject access export is assembled within five working days, covers every module, and flags third-party content for redaction review. Erasure is honoured where the law allows; where it does not, the record notes the request, the decision and the legal basis.
Medication records and clinical safety
Medication records ship in phase 3 with a clinical risk assessment signed off with your registered manager, and a parallel paper run before cutover.
The medication module follows a DCB0129-style clinical risk management process: a hazard log naming the specific hazards, mitigations mapped to requirements, a named clinical reviewer, and a parallel paper run of at least four weeks before cutover.
Digital Social Care Records and grant funding
This is a bespoke system built for you, not an NHS-assured Digital Social Care Record. If you intend to use Digitising Social Care grant funding, that funding requires an assured supplier and this project would not qualify.
CQC
CQC regulates the provider, not the software. Kindround's job is that every record is attributable, timestamped, tamper-evident and exportable, so the provider can evidence safe care and good governance.
Accessibility
WCAG 2.2 AA is the target for this site, the office app, the carer app and the family portal. The accessibility statement records the test method and date.
Ask the questions your DPO would ask
Request the data processing agreement, the DPIA outline and the sub-processor list.