Privacy notice.
Kithra · Chronix Health Group Ltd
Effective 7 September 2026 · Version 1.6 — the product is renamed from Care Vault to Kithra. The CONTROLLER IS UNCHANGED: Chronix Health Group Ltd, company number 16663224, registered at 11-13 Upper High Street, Epsom, Surrey, KT17 4QY, remains the data controller and is rendered “Chronix Health Group Ltd (trading as Kithra)” where the entity is named beside the product. ICO registration ZB962513 is unchanged. No purpose, lawful basis, retention period, supplier, transfer or right changes. Supersedes v1.5 (the paragraph about counting page views removed), v1.4 (Railway added to the supplier table), v1.3 (the Cloudflare R2 backup’s location corrected to the European Union), v1.2 (support-access sentence corrected), v1.1 (child date of birth corrected; Speechmatics and Cloudflare R2 added) and v1.0.
In short
We are Chronix Health Group Ltd. We hold the care records you keep in Kithra and we are responsible for them.
Only the people you choose can see them. We do not sell information and we do not use care records for advertising. Care records are stored in the United Kingdom.
You can see it, correct it, take a copy, or have it deleted. Ask us and we answer within a month.
Who we are
Chronix Health Group Ltd — the controller for information held in Kithra.
Registered in England & Wales, company no. 16663224
11-13 Upper High Street, Epsom, Surrey, KT17 4QY
support@careworld.app
What we hold, and where it comes from
About you — you give us this. Your name, email address and password. Your plan and payments. A record of when you signed in.
About the person you care for — a family member gives us this, usually you. Their name and date of birth, conditions and allergies, medicines, appointments, visit notes, documents you upload, photographs, an NHS number if you add one, and who you have allowed to see each of those.
About a child — deliberately less. Initials or a first name, their date of birth, and the first part of a postcode. We do not hold a child’s full name, photograph or address.
If you are the person a record is about, that information came from the family member who created it. You can ask us who they are.
Why we are allowed to hold it
| The situation | Lawful basis | Condition for health data |
|---|---|---|
| The person can decide and has agreed | Contract | Their explicit consent |
| Someone holds a health-and-welfare LPA or deputyship | Contract | Their explicit consent, given on the person’s behalf |
| A child under 13 | Contract | Explicit consent from someone with parental responsibility |
| Aged 13 or over | Contract | Their own explicit consent |
| The person cannot decide and nobody holds authority | Legitimate interests | Vital interests, with a recorded family best-interests declaration under section 4 of the Mental Capacity Act 2005 |
| The emergency card | Vital interests | Vital interests |
Where we rely on legitimate interests, ours is to let families coordinate care for someone who cannot arrange it themselves. We have weighed that against the person’s own interests and you can ask to see the assessment.
The emergency card rests on vital interests alone. It can be read without signing in because a paramedic cannot be asked for a password, and it carries only what a responder needs.
Telling someone a record exists
A person has the right to know we hold information about them.
Where they use Kithra, they see it. Where they do not, we ask the account holder to tell them and we record that they did. Where a person cannot be told — because they would not understand — we record that, and why.
A young person is told by us, directly. Three months before their sixteenth birthday we email them. On that birthday the record becomes theirs, and they choose what happens to it. If they do not answer, it is paused until they do.
Who else sees it
Only the people you choose. You set what each person in your circle can see and changes take effect immediately.
You may share a time-limited view of one person with another family’s circle. Both sides must agree and either can stop it.
We share with nobody else, unless the law requires it or a child is at risk.
The organisations that run Kithra for us
| Who | What they do | Where |
|---|---|---|
| Supabase | Database and file storage — where care records live | United Kingdom |
| Vercel | Runs the website and app | United Kingdom |
| Cloudflare | Protects against attack, serves images | Global, UK-first |
| Stripe | Takes card payments. We never see your card number | Ireland, United States |
| Resend | Sends our emails | United States |
| Twilio | Sends text messages and voice reminders | United States |
| Google Cloud | Calendar connection, where you turn it on | United Kingdom, United States |
| Anthropic | Provides the model behind Chronicus. What you type is not used to train it | United States |
| Speechmatics | Turns speech into text when you dictate. Processed as you speak and not kept | European Union |
| Railway | Checks every file you upload for viruses, and strips hidden location data from photographs | European Union |
| Cloudflare R2 | A second, separate copy of your uploaded files, so a restore returns them | European Union |
Care records are stored in the United Kingdom. The one exception is the backup: the second copy of your uploaded files is held in the European Union, so that a fire or a fault in one place cannot take both copies with it. Where a service above sits elsewhere, it handles only what it needs — an email address to send an email, a payment to take a payment — under the UK’s approved transfer terms, the International Data Transfer Agreement or the UK Addendum.
If we change this list we will tell you before it takes effect.
Security
Encrypted with AES-256 in transit and at rest. Access is closed by default — nobody sees a care record unless you have chosen it.
Every access to a care record is logged, including by us. Our support staff can open a record when helping you with it.
How long we keep it
| Your account and its records | While the account is open |
| After you close it | Hidden at once, deleted after 60 days |
| Who opened a care record, and when | 7 years, including after deletion |
| Payments | 6 years, as tax law requires |
| Reports about a child’s safety | As long as the concern requires |
| Support messages and complaints | 6 months |
| Emails and texts we sent | 90 days |
| Sign-in records | 12 months |
Your rights
You can see what we hold, correct it, take a copy in a portable form, have it deleted, restrict how we use it, object to us using it, and withdraw consent where we relied on it.
Ask from your account, or email support@careworld.app. We answer within one month.
A young person’s right to deletion is stronger where the information was collected while they were a child — including anything a parent entered about them.
If you are unhappy, tell us. You can also complain to the Information Commissioner’s Office — ico.org.uk, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Chronicus
Chronicus is an AI assistant inside Kithra. It sees only what you type to it.
It does not read care records, cannot summarise them, and does not give medical, medication, benefits or safeguarding advice.
It drafts and suggests. Nothing is sent, changed or deleted until you confirm it. We do not make decisions about you by machine alone.
Children
Kithra holds information about children and children may use it.
We hold less about a child than about an adult. Sharing is off unless you turn it on. We do not profile children, use their information to advertise, or track where they are.
If you are a young person reading this: the information about you belongs to you. You can ask to see it, ask for it to be changed, or ask for it to be deleted — even if a parent put it there. Email support@careworld.app and we will help.
Changes
If we change how we use your information we will tell you before it takes effect.