Privacy Policy

PenielSense is committed to protecting the privacy and security of everyone who uses our platform. This Privacy Policy explains how we collect, use, protect and share personal information when providing our care-home monitoring and resident visibility platform.

PenielSense is designed to support care staff by providing resident visibility, device monitoring, shift handovers and operational insights. The platform is intended to assist care professionals in making informed decisions and does not replace clinical judgement, emergency procedures or the care provider's own care-record systems.

This Privacy Policy applies to:

• Residents whose rooms or assigned devices are connected to PenielSense.
• Family members, representatives or advocates who may receive information about a PenielSense deployment from their care provider.
• Care-home managers, carers and authorised staff members who use the platform.
• Business contacts, suppliers and organisations that communicate with PenielSense.

For resident information collected within a care home, the care provider generally determines why and how personal information is processed. In these cases, the care provider acts as the Data Controller, while PenielSense acts as a Data Processor, processing information only on the care provider's instructions.

For our own business operations, account management, platform security, customer support and legal compliance, PenielSense acts as the Data Controller.

Depending on how PenielSense is used, we may collect the following information:

Information processed by PenielSense may come from:

• Care providers and authorised staff.
• Connected resident devices and room sensors.
• Approved third-party device manufacturers and platforms.
• Integrated care systems where enabled.
• Users accessing the PenielSense platform.
• Technical systems that generate security and audit logs.

We use information to:

• Provide resident visibility across the care home.
• Generate shift handover summaries and operational insights.
• Monitor connected devices and their health.
• Highlight review prompts where patterns suggest additional staff attention may be appropriate.
• Support troubleshooting and customer support.
• Improve the reliability and performance of the platform.
• Protect platform security through audit logging and access controls.
• Manage customer relationships and business operations.

When processing resident information on behalf of a care provider, PenielSense acts under the instructions of the care provider, who is responsible for determining the lawful basis for processing under applicable data protection laws.

For our own business operations, account security and compliance activities, we rely on lawful bases such as contractual necessity, legitimate interests and legal obligations where appropriate.

We may share information with:

• Authorised care-home staff and managers.
• Approved technology providers supporting the PenielSense platform.
• Hosting, database, email and security service providers.
• Professional advisers, auditors and insurers where necessary.
• Public authorities or regulators where legally required.

PenielSense does not sell personal information.

Where personal information is processed outside the United Kingdom or European Economic Area, PenielSense uses appropriate contractual or legal safeguards to protect that information.

Resident information is retained for the period agreed with the care provider. At the end of that period, information is securely deleted, returned or anonymised unless retention is required for legal, security, safeguarding or compliance purposes.

Staff accounts, audit logs, support records and business information are retained only for as long as necessary to provide the service and meet legal or operational obligations.

We use a range of technical and organisational measures to protect information, including:

• Role-based access controls.
• Secure authentication and password management.
• Multi-factor authentication where available.
• Device assignment validation.
• Security monitoring and audit logging.
• Incident management procedures.
• Ongoing security and compliance reviews.

Depending on applicable data protection laws, individuals may have the right to:

• Be informed about how their information is used.
• Request access to their personal information.
• Correct inaccurate information.
• Request deletion of information in certain circumstances.
• Restrict or object to certain types of processing.
• Request data portability where applicable.
• Not be subject to decisions based solely on automated processing that have legal or similarly significant effects.
• Lodge a complaint with the relevant data protection authority.

For resident information processed as part of a care-home deployment, requests should normally be directed to the relevant care provider, who acts as the Data Controller.

PenielSense may generate resident summaries, review prompts and operational insights using information received from connected devices and care records.

These summaries are intended to support carers and care-home managers during routine care, monitoring and shift handovers.

They are not medical diagnoses, emergency alerts or automated care decisions. Final care decisions remain the responsibility of qualified care staff.

This Privacy Policy is available through the PenielSense website and may also be provided by participating care providers as part of resident or staff information packs. Alternative formats may be made available where required.

If you have questions about this Privacy Policy or how personal information is handled, please contact the PenielSense team through the contact information provided on our website.

If your enquiry relates to resident information held by a care home, you should contact the relevant care provider in the first instance. You may also have the right to raise concerns with your local data protection authority if you believe your information has not been handled appropriately.