Privacy policy
Last updated 21 September 2026
1. Who we are
Atara Care is care home software for residential care homes in the United Kingdom. It is a service of Digital Care Home Ltd, registered in England and Wales, company number 16972485, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
Website: www.ataracare.com. Contact: through the form at www.ataracare.com/contact, or by post to the registered office above.
2. Who this policy applies to
This policy applies to:
- Care home organisations that subscribe to Atara Care
- Care home staff and administrators who use the platform
- Residents and family members whose data is entered into the platform by care homes
- Visitors to www.ataracare.com
3. Our role: processor and controller
For personal data stored inside the Atara Care platform, namely resident records, staff records and family portal data, the care home is the Data Controller and Digital Care Home Ltd is the Data Processor.
We process that data only on the documented instructions of the care home. We do not use it for our own purposes, we do not sell it and we do not use it to train general purpose models.
Each customer has a Data Processing Agreement with us, as required by Article 28 UK GDPR.
For data collected through our website, our marketing and account administration, Digital Care Home Ltd is the Data Controller.
4. Data care homes enter into the platform
The care home decides the lawful basis for the data it enters into Atara Care, and is responsible for informing residents, staff and families how that data is used. Much of that data is special category data, in particular health data, under UK GDPR Article 9.
Care homes may enter these categories of personal data:
- Resident data: identity, contact details, mental capacity and consent records, health and care records, risk assessments, care plans, medication records, incident reports and daily notes
- Staff data: identity, contact details, employment details, training and compliance records, rostering, attendance and user account information
- Family and representative data: identity, contact details, relationship to the resident, portal access logs and messages
5. What we collect in our own right
As a controller we collect the following:
- Account data: name, work email, job title, organisation name and sign-in activity
- Billing data: organisation details, billing contact and invoice history
- Support data: the content of support tickets and emails, and any screenshots or exports shared with us
- Website data: IP address, browser type, device type, pages visited and session duration, collected only if you accept analytics cookies
- Enquiry data: name, email address, organisation and message content sent through the contact form or by email
6. Why we use personal data
As a processor, we use customer platform data for three purposes only: to provide and operate the Atara Care service and its modules; to provide technical support and resolve incidents; and to maintain the security, backups and performance of the platform.
We do not rely on the recognised legitimate interests lawful basis introduced by the Data (Use and Access) Act 2025.
As a controller, we use personal data for these purposes, on these lawful bases:
- Providing and managing Atara Care subscriptions and accounts: contract, Article 6(1)(b) UK GDPR
- Responding to enquiries and support requests: contract or legitimate interests, Article 6(1)(b) and 6(1)(f)
- Sending service and security communications: contract or legitimate interests, Article 6(1)(b) and 6(1)(f)
- Improving our website and platform from usage analytics: legitimate interests, Article 6(1)(f)
- Meeting tax, accounting and legal obligations: legal obligation, Article 6(1)(c)
- Marketing emails to existing customers and prospects: consent where it is required, or legitimate interests, Article 6(1)(f)
7. Automated decision making
Atara Care does not make automated decisions about residents, and no decision with a legal or similarly significant effect on you is made by automated means.
Signals charts a resident's recorded observations over time for staff to read.
There is therefore no solely automated decision making, and no profiling with legal or similarly significant effects, under Article 22 UK GDPR.
9. Sub-processors and sharing
To deliver Atara Care we use a small number of suppliers who process personal data on our behalf. All are bound by written data processing agreements, and our current sub-processor list is available on request.
Amazon Web Services hosts the platform and delivers its email, in the AWS London region.
Google Analytics is used on this website only, and only after you accept analytics cookies.
We do not sell personal data to anyone. We share personal data only:
- With the care home and its authorised users
- With our sub-processors, as described above
- With professional advisers, legal and financial, under confidentiality obligations
- Where required by law, by regulation or by valid legal process
10. Where data is stored
Care platform data and resident data are stored and processed in the United Kingdom, in the AWS London region. We do not transfer resident health data, or other care platform personal data, outside the UK.
This applies to the Atara Care application and to the customer data hosted for care homes. It does not cover the optional analytics on our public website, which are described in our Cookie Policy.
11. How long we retain data
We retain customer platform data for the duration of the contract and as instructed in the Data Processing Agreement.
We retain enquiry emails only for as long as we need them to reply and to follow up.
Care homes remain responsible for their own retention schedules for resident and staff records. They are guided by the NHS Records Management Code of Practice in England and the Welsh records management code in Wales.
Inside the platform each kind of record has its own retention period, and each night the records that have passed it are purged. These periods are the minimum, and a care home can lengthen them for its own records. The periods of the sign-in, medicines, risk, care plan, staff and incident trails are fixed. Before a purge, a care home can preview the records it would take. The defaults follow the records management code of the home's nation and are the same in England and Wales:
- Resident records: 8 years
- Medicines records, including prescriptions and the eMAR: 8 years
- Care logs, care plans and risk assessments: 8 years
- Incidents: 10 years, and 20 where someone died or was seriously harmed
- Audit events, sign-in events and access logs: 7 years (8 for the medicines and care log trails)
- Staff HR records: until the person's 75th birthday, and at least 6 years after the record is closed
- Complaints: 10 years
- Email delivery logs: 90 days
- Scheduler job logs: 30 days
12. Security
We apply technical and organisational measures appropriate to care records, and the Why Atara page of this website describes them in more detail. They include:
- Encryption at rest for the database and the cache, and encryption in transit over TLS 1.2 or better
- Role based access control across fourteen roles, with a separate account for every user
- Two-factor sign-in with an authenticator app, which a home can require for chosen roles and which group accounts must use
- A signature PIN on every dose recorded, and a second person's PIN to witness a controlled drug
- Audit trails written by Atara alone, with the controlled drugs register and the sign-in and medicines trails locked in the database against any change
- Daily database backups, retained for thirty-five days
- A web application firewall in front of the application, and container images scanned for known vulnerabilities on every push
- Access to production systems limited to authorised personnel
13. Your rights
For resident, staff or family data held in Atara Care, please contact your care home. The care home is the Data Controller and handles your request. We support them as their processor.
For the data we control, namely our website, accounts and marketing, you have the right of access, rectification, erasure, restriction, portability and objection under UK GDPR and the Data (Use and Access) Act 2025.
To exercise a right, use the form at www.ataracare.com/contact or write to our registered office, with your name and a description of your request. We will respond within the one month that UK GDPR allows. Where we reasonably need clarification to identify the data, that period is paused until you reply.
Under the Data (Use and Access) Act 2025 you also have a right to complain to us directly. We will acknowledge a complaint within the 30 days the Act allows and respond without undue delay.
You may also complain to the Information Commissioner's Office at www.ico.org.uk, or on 0303 123 1113. We ask that you contact us first, so that we can try to resolve the matter.
14. Children
Atara Care is sold to organisations. Our website and our marketing are not directed at anyone under 18.
Where a care home uses the platform for a resident under 18, the care home, as Data Controller, is responsible for applying the safeguards for children's data under UK GDPR and the Data (Use and Access) Act 2025.
15. Changes to this policy
We update this policy when the law, regulatory guidance or our own services change. The date at the top of this page shows the current version. For a material change we notify customers by email with reasonable notice.
The current version is always available at www.ataracare.com/privacy.
16. Contact us
Use the form at www.ataracare.com/contact, or write to our registered office, for anything in this policy, including a rights request or a complaint.