Last updated: 11 September 2026
Who we are
MyCarePal is provided by Varley Software Limited, registered number 13792362, registered address: 3 Trent side Business Village, Farndon Road, Newark, NG24 4XB.
Our Data Protection Officer can be reached by emailing help@varleysoftware.co.uk.
Our role
Varley Software plays a dual role when it comes to processing. In some situations we act as a Controller, and in others we are the Processor. When we are a Processor of personal data, we are doing so purely on the instruction of another company (the Controller). If you are a service user or healthcare professional, that company is likely to be the care provider. To find out more about how your data is protected by them, you should contact them directly.
Varley Software does on occasion act as a Controller. That will usually be the data of potential and existing employees, suppliers or website users, and technical data when you use our app. Being a Controller means that we are trusted to look after and deal with your personal information in accordance with this notice. We determine the ways and means of processing your data and must therefore be accountable for it. This privacy notice refers to the data we process as a Controller only.
Where your data is stored
MyCarePal and the care records it holds are hosted in ISO 27001 certified data centres in the United Kingdom. Any AI processing used by MyCarePal takes place on endpoints hosted in the United Kingdom.
A small number of the services we use to run our software are provided by companies based outside the United Kingdom. We use a mapping service to work out mileage between work locations, which receives only the addresses of those locations and no personal data. We use a text message provider to deliver multi-factor authentication codes, which receives the work mobile number of the person signing in. Where a service like this involves personal data, we only use it where UK data protection law allows the transfer, relying on an approved safeguard such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
We have data processing agreements in place with the providers we use. We do not sell your data, and we do not share it with anyone other than our contracted processors. A current list of the processors we use is available on request from help@varleysoftware.co.uk.
How we use AI
MyCarePal includes AI features that summarise information already recorded in the app, such as care notes, behaviours and incidents. When we provide these features to a care provider, we act as a Processor and only do so on that provider's instruction.
- AI processing takes place on endpoints hosted in the United Kingdom.
- Data sent for AI processing is not used to train AI models.
- Where the provider supports it, we use zero data retention, so prompts and responses are not stored once a request has been answered. Where a provider keeps a short-term copy for abuse monitoring, that copy stays within the United Kingdom.
- AI features support the professional judgement of your team. MyCarePal does not make decisions about people receiving care by automated processing alone.
Technical and operational security
All data is password protected, access controlled, backed up securely and encrypted when appropriate. All employees are trained in data protection and are aware of their obligations to ensure the privacy of all data subjects. Data privacy by design and default is an integral part of our development processes.
Your rights
As a data subject, you have rights over your personal data under data protection laws. If you wish to exercise any of your rights, please contact us at help@varleysoftware.co.uk.
- Right of access: you can request access to a copy of the personal data we hold about you, as well as details about why and how we use it.
- Right to rectification: you can ask us to change or update any personal data we hold about you which is inaccurate or incomplete.
- Right to erasure: you have a right, under certain circumstances, to ask us to delete any personal data we hold about you. There may be situations where we must retain your personal data after a request for erasure where we have a lawful basis for doing so.
- Right to restriction: you can ask us to restrict (prevent) the processing of your personal data where you have objected to our use of it and we have no lawful basis to continue processing it.
- Right to data portability: in certain circumstances, you can ask us to transfer the data we hold about you to another organisation, in a structured, commonly used, electronic form.
- Right to object: you can object to us using your personal data for particular purposes. Where we use your data for direct marketing, we will always stop when you ask us to.
- Right to withdraw consent: where we rely on your consent, you can withdraw it at any time. This does not affect any processing that took place before you withdrew it.
- Rights about automated decisions: we do not make decisions that have legal or similarly significant effects on you by automated processing alone.
If you are a service user of a care provider that uses MyCarePal, we usually act as a Processor for your data. Please contact that care provider to exercise your rights, and they will contact us if they need our help.
You also have the right to lodge a complaint about our processing with the supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.
Website enquiries
When you contact us using the form on this website, we collect the details you give us: your name, email address, organisation and message, and optionally your phone number, job title and number of registered beds. We use this information only to respond to your enquiry and, where relevant, to provide information or a quote about MyCarePal. Giving us these details is voluntary, but we need your name, email address and message in order to reply.
Our lawful basis for processing this data is Legitimate Interest: responding to people who have asked us about our services. Results of a legitimate interest balancing test indicate that this use is necessary to answer your enquiry and is unlikely to cause you risk or harm. Your enquiry is sent to our team by email and is not used for marketing unless you ask us to keep in touch.
We keep enquiry details for up to 12 months, and then delete them. If you become a customer, our customer privacy notice below applies instead.
Cookies
Cookies are small text files stored on your device when you visit a website. They help websites function properly, for example by enabling secure access.
We only use first-party cookies that are strictly necessary. These are:
- on this website, a security cookie that protects our contact form from misuse
- in our web applications, authentication cookies for signing in, session management and secure access to user-specific features
We do not use:
- third-party cookies
- advertising or marketing cookies
- analytics or tracking cookies
This means we do not track your browsing behaviour across other websites, and we do not collect data for advertising or profiling purposes. Because these cookies are strictly necessary for security and core functionality, they cannot be switched off without affecting how the site works. If you have any questions about our use of cookies, please email help@varleysoftware.co.uk.
Customer privacy notice
Data that we hold and how we use it
As a customer, we hold the contact and payment details required to carry out our contract with you, manage our relationship and keep you up to date with changes and improvements to our services. This data will have been provided by you directly.
Lawful basis for processing
Our lawful basis for processing your data is a combination of Contract and Legitimate Interest. We use legitimate interest when we use your data to keep you up to date with changes and improvements to our goods and services. Results of a legitimate interest balancing test indicate that this use is pursuing a legitimate interest, is necessary for the purpose of keeping you updated and growing our business, and is unlikely to cause you risk or harm.
Data sharing and transfers
Like most companies, we use other companies as part of our data processing, for example cloud hosting. Your data is stored as described in Where your data is stored above. We do not sell your data, and we do not share it with anyone other than our contracted processors.
Retention periods
We hold customer data for the length of time that you are a client of ours, and then for a further 7 years in case of any dispute.
App user privacy notice
Data that we hold and how we use it
As an app user, you provide some data to enter a contract with us and use the app. This will be your contact details. We also process data about the way you use our app, including your IP address and browsing time. This helps us to optimise the performance of our app, monitor it for security purposes and drive improvements for our users. We also use essential cookies for our in-app customer service capability to work, and we process your data to drive improvements to the app and to allow bug reporting and analysis. We use your contact details to send you service updates. If your organisation uses multi-factor authentication, we send a security code to your work mobile number through a text message provider each time you sign in, so that we can check it is really you.
Lawful basis for processing
Our lawful basis for processing your data is a combination of Contract, Legitimate Interest and Consent. We use your contact details to provide you with the app and the appropriate technical support as needed, as well as service messages; this is our contract with you. We use legitimate interest when we use your data to improve the performance of the app, process your data for marketing purposes, and protect it from illegal use. Results of a legitimate interest balancing test indicate that this use is pursuing a legitimate interest and is unlikely to cause you risk or harm.
When we send marketing messages to you, we rely on consent under the Privacy and Electronic Communications Regulations (PECR). This consent is collected via the app. We are aware that, as an employee of a customer subscriber, we could send you marketing messages without consent, but we feel consent is a better option for you. You can withdraw this consent at any time.
Data sharing and transfers
We use other companies as part of our data processing, for example cloud hosting, AI services and text messaging. Your data is stored as described in Where your data is stored above, and AI processing works as described in How we use AI. We do not sell your data, and we do not share it with anyone other than our contracted processors.
Retention periods
We hold data used to fulfil the contract for 12 months after the termination of the contract. We delete log data 12 months after you stop using the app. When you opt out of receiving communications from us, we remove you from our marketing database and add you to a suppression list.
Supplier privacy notice
Data that we hold and how we use it
As a supplier, we hold the contact and payment details required to carry out our contract with you, manage our relationship and keep you up to date with changes to our services. This data will have been provided by you directly.
Lawful basis for processing
Our lawful basis for processing your data is a combination of Contract and Legitimate Interest. We use legitimate interest when we use your data to keep you up to date with changes to our goods and services. Results of a legitimate interest balancing test indicate that this use is pursuing a legitimate interest, is necessary for the purpose of keeping you updated and growing our business, and is unlikely to cause you risk or harm.
Data sharing and transfers
We use other companies as part of our data processing, for example cloud hosting. Your data is stored as described in Where your data is stored above. We do not sell your data, and we do not share it with anyone other than our contracted processors.
Retention periods
We hold supplier data for the length of time that you are a supplier of ours, and then for a further 7 years in case of any dispute.
Employee privacy notice
If you are an employee of Varley Software Limited, please refer to the Fair Processing Notice stored in the Employee Handbook.
Changes to this privacy notice
We may change this privacy notice from time to time, for example if the law changes. We recommend that you check this page regularly to keep up to date. If we make any material changes to the way we process and use your personal data, we will contact you to let you know about the change.