ENSEAK Solutions Ltd owns and operates the ACT360 platform, a digital compliance and audit intelligence solution for care providers and related organisations.

ENSEAK Solutions Ltd acts as:

• Data Controller for: Our marketing website and digital platforms, customer account information and billing, and employee and supplier data.
• Data Processor for: Resident, patient, and service user data entered into ACT360 by customer organisations, in accordance with their instructions and applicable Data Processing Agreements.

Customer organisations (e.g. care homes, healthcare providers) act as Data Controllers for any resident/patient/service user data they enter into ACT360. ENSEAK Solutions processes that data strictly in accordance with their documented instructions.

This Privacy Policy applies to customers and users of ACT360, employees, contractors, suppliers of ENSEAK Solutions Ltd, and visitors to our websites and digital platforms.

It covers personal data processed in connection with provision and use of the ACT360 platform, our marketing website and communications, and our internal business operations.

We may collect and process the following categories of personal data:

We rely on the following lawful bases under UK GDPR:

• Contractual necessity (Article 6(1)(b)): To deliver ACT360 services you have subscribed to and manage your account.
• Legal obligation (Article 6(1)(c)): To comply with data protection, financial, tax, and sector-specific regulations.
• Legitimate interests (Article 6(1)(f)): To improve our services, ensure security, maintain usage logs, and manage business relationships.
• Consent (Article 6(1)(a)): For optional communications, marketing, and non-essential cookies.

Where your organisation is the Data Controller for resident/patient data, it is responsible for determining the appropriate lawful basis for that processing. ENSEAK Solutions processes such data under contractual necessity and documented instructions as a Data Processor.

To provide core functionality and a better user experience, we use:

• Essential cookies and local storage: To maintain session state, save application settings, and record your consent status.
• Analytics and performance data: To collect details of visits to our website, including traffic and location data, for analytical purposes to improve our service.

Where required, we obtain consent for non-essential cookies and provide options to manage your preferences.

ACT360 utilizes Artificial Intelligence (AI) to enhance the efficiency, safety, and quality of care management. The AI features process data entered into the system to provide the following capabilities:

• Automated Data Analysis & Insights: Identifying trends, highlighting recurring risks, and generating proactive safety insights.
• Document & Report Processing: Reading, summarizing, and analysing uploaded documents, such as official CQC reports and policies.
• Generative Content & Administrative Assistance: Drafting structural templates, generating outbreak response plans, and summarizing shift handoff notes.
• Data Extraction & Structuring: Converting unstructured text into structured data profiles to ensure accurate record-keeping.
• Interactive AI Assistants: Chatbots to query internal data, search user guides, or ask questions regarding CQC regulations.

AI features do not constitute solely automated decision-making with legal or similarly significant effects on individuals under UK GDPR. They are designed to support—not replace—regulatory decision-making and clinical or managerial judgment.

Throughout the ACT360 platform, we utilize various scoring systems and metrics to assist in quality monitoring, including but not limited to dashboard scorecards and CQC framework Quality Statement scoring.

These scoring systems are provided solely for internal representation, benchmarking, and continuous improvement tracking. They do not equate to, nor should they be interpreted as, a real or official regulatory rating from the Care Quality Commission (CQC) or any other regulatory body.

We may share personal data with suppliers and sub-processors:

• Google Firebase: Backend infrastructure (database, authentication, file storage).
• Cloudflare: Security, performance, and content delivery services.
• Brevo (formerly Sendinblue): SMTP relay for transactional emails.
• Stripe: Payment processing partner for subscriptions.
• Google Gemini: AI services used to generate compliance insights.

All suppliers are subject to Data Processing Agreements (DPAs) and compliance checks. We may also disclose personal data to regulators and authorities (ICO, CQC, NHS) or auditors and certification bodies where required by law.

Some data may be stored or processed outside the UK, including in the European Economic Area (EEA) and the United States, particularly via Google Firebase (US-based) and Stripe (US-based).

We rely on appropriate safeguards for international transfers, including Standard Contractual Clauses approved by the European Commission or UK-approved equivalents, and technical and organisational measures to protect data in transit and at rest.

We implement administrative, technical, and physical security measures to protect personal data, including:

• Encryption at rest and in transit.
• Role-based access control (RBAC) and multifactor authentication (MFA).
• Regular vulnerability scans and penetration testing.
• Supplier risk assessments and SLA monitoring.

While we take appropriate measures to protect your data, transmission of information via the internet can never be completely secure.

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law. Typical retention periods include:

We periodically review stored data and anonymise or delete records that are no longer necessary for operational or legal purposes.

Under UK GDPR, individuals have the right to:

• Access their personal data.
• Rectify inaccurate or incomplete data.
• Request erasure ("right to be forgotten") in certain circumstances.
• Restrict processing in specific situations.
• Object to processing based on legitimate interests or direct marketing.
• Data portability, where applicable.

Requests can be made by contacting our Data Protection Officer. Where ENSEAK Solutions acts as Data Processor, we will assist the relevant customer organisation in responding to such requests.