Privacy notice
Version 2026-10 · Last updated 29 October 2026
About this notice
This notice explains how Teulu uses your information.
Teulu lets you see updates that a care company chooses to share with you about someone it cares for.
Teulu is run by [Nathan to confirm: legal entity name, company number and registered address]. In this notice, "we" means that company.
Who is responsible for your information
The care company decides what care information you can see. It is the controller of its care records. We hold and show those records for the care company, on its instructions. [LEGAL REVIEW]
We decide how your Teulu account works and how we count use of Teulu. For that information, we are the controller. [LEGAL REVIEW: confirm these roles]
For questions about care records, contact the care company first.
What we hold about you
Teulu shows care information, such as visit times and care notes. It belongs to the care company's records. Teulu does not keep it on your phone.
- Your name, email address and mobile number. The care company gives us these when it invites you.
- Your preferred language, and the version of the terms of use you agreed to.
- Your sign-ins: when they happened, the type of device or browser, and a scrambled code made from your internet address.
- The care company's record of the access it gave you. This says who you are to the person, why you have access and what you can see.
- If you allow it, counts of how Teulu is used, linked to your account by a reference number. See "Analytics" below.
How we use it, and why
We use your information for these reasons. Each one has a lawful basis. [LEGAL REVIEW: confirm each lawful basis]
- To set up your account and let you sign in. We need this to provide Teulu to you. [LEGAL REVIEW]
- To text you sign-in codes, and to email you invites and set-up links. [LEGAL REVIEW]
- To keep accounts safe. For example, we lock sign-in after too many wrong codes. This is in our legitimate interests, and yours. [LEGAL REVIEW]
- To show you the care information the care company shares with you. We do this for the care company. It relies on its own lawful basis, including the condition for health and social care. [LEGAL REVIEW]
- To count how Teulu is used, only if you allow it. This is based on your consent.
Analytics
We ask before we count how Teulu is used on your device. Nothing is counted until you choose "Allow".
If you allow it, we count which screens are opened, and when something goes wrong.
Counts from a signed-in browser, and some counts on our server, are linked to your account by a reference number, never by your name. Counts for a sign-in code request and a locked account are anonymous.
Counts from your browser also carry your device type and name, your browser and operating system with their versions, your screen and window size, your time zone, a session reference, and a reference for your device that stays the same between visits.
For an error, a count carries the type of error and where in Teulu's code it happened, with record numbers and links removed.
We also count four steps on our server: a sign-in code was asked for, someone signed in, an account was locked, and an invite was accepted. These are counted only from a device that said "Allow".
We never send care details, names, email addresses or phone numbers.
Teulu sends every count through its own server first. PostHog receives our server's internet address, not yours.
Our analytics provider is PostHog. It keeps the counts in its EU data centre in Frankfurt, Germany. [Nathan to confirm: PostHog's EU data centre is in Frankfurt]
You can switch analytics off at any time in Profile. Teulu then stops counting and clears its analytics data from your device. Logging out does the same, so the next person on the device is asked.
When something goes wrong on our server, our hosting platform writes an error report to its logs. The report can include technical details of the error. This happens whether or not you chose "Allow". Without your "Allow", nothing about the error goes to PostHog. [Nathan to confirm how long Vercel keeps runtime logs]
Deleting your account deletes your analytics data too. We ask our analytics provider to delete your analytics data within 24 hours. They then delete it, which can take some weeks. [LEGAL REVIEW: check against PostHog's stated timing] [Nathan to confirm: the care app's PostHog erasure keys are set in production]
What we never do
We never sell your information. We never use it for advertising.
Texts and emails from Teulu never include care details.
We share information with others only when the law requires it. [LEGAL REVIEW]
How long we keep it
We keep information only as long as we need it. These are the periods. [LEGAL REVIEW: confirm every period]
- Your account: until you delete it. We then remove your name, email address and mobile number straight away. A closed record of the account is kept with no end date. [LEGAL REVIEW: set a period]
- Sign-ins: a sign-in lasts up to 30 days. We delete its record 90 days after it ends. [LEGAL REVIEW]
- Sign-in codes: a code works for a few minutes. We delete used and expired codes after 24 hours.
- Sign-in security events, such as wrong codes: 30 days.
- Counters that limit how often codes are sent: 1 day.
- The history of your account, such as when it opened and closed: 8 years. [LEGAL REVIEW: confirm when the period starts] [Nathan to confirm: the purge is a tracked follow-up, not built yet]
- Proof that we deleted an account: 1 year after the deletion finished. [LEGAL REVIEW]
- The care company's record of the access it gave you: 8 years. [LEGAL REVIEW: default taken from the NHS Records Management Code for adult social care. Confirm when the period starts] [Nathan to confirm: the purge is a tracked follow-up, not built yet]
- Records of actions by care office staff: 2 years. [LEGAL REVIEW]
- Notification settings in the app: 30 days after notifications stop, or straight away when you delete your account. [Nathan to confirm: keep this only if the app ships with notifications]
- Text message logs at Twilio: [Nathan to confirm Twilio's log retention setting].
- Email logs at Resend: [Nathan to confirm Resend's log retention].
- Hosting and database logs at Vercel and Supabase: [Nathan to confirm each plan's log retention].
- Analytics counts at PostHog, if you allowed them: [Nathan to confirm the PostHog project's retention]. We ask for them to be deleted when you delete your account.
- Request counters at Upstash: a few minutes.
Deleting your account
You can delete your account in Teulu. Go to Profile, then "Delete my account". You can also use the "Delete your account" page on the Teulu website.
If you cannot sign in, contact your care office or email [Privacy email to be confirmed].
What deleting your account removes
We delete or remove these at once. [LEGAL REVIEW]
- Your name, email address and mobile number.
- Your preferred language.
- Your access to every person you could see in Teulu.
- Your sign-ins end. We sign you out on every device. We also remove the device type and the scrambled internet address code from each sign-in record.
- Your sign-in codes, used or not.
- The count of codes texted to your mobile number.
- Your notification settings, and any notification not yet sent. [Nathan to confirm: keep this only if the app ships with notifications]
- On the device you use, Teulu removes its sign-in and invite cookies, and the one for the person you looked at last. It sets the analytics answer on that device to "no" and asks the next person again.
- The Teulu app also clears its data from your phone. If it cannot, it says so.
What we keep after you delete your account
Some records stay after you delete your account. [LEGAL REVIEW]
- The care company's record of the access it gave you. That record holds the name and email address it had for you. It stays linked to your deleted account by a reference number. It is kept for 8 years. [LEGAL REVIEW: confirm the period and when it starts] [Nathan to confirm: the purge is a tracked follow-up, not built yet]
- An entry in the care office's activity log for each access that ended. We delete it after 2 years. [LEGAL REVIEW]
- The history of your account, such as when it opened and closed. It is kept for 8 years. [LEGAL REVIEW: confirm the period and when it starts] [Nathan to confirm: the purge is a tracked follow-up, not built yet]
- A closed record of your account. It shows when the account opened and closed. It shows which terms of use you agreed to and when, and when you confirmed you are 18 or over. It is kept with no end date. [LEGAL REVIEW: set a period]
- Your sign-in records, without the device type or the internet address code. We delete each one 90 days after it ends. [LEGAL REVIEW]
- Sign-in security events, such as a wrong code. They hold scrambled codes made from your email address and internet address. We delete them after 30 days.
- Counters that limit sign-in attempts. They are kept under scrambled codes or reference numbers. We delete them after 1 day.
- Records of past notifications, and of any that were cancelled. We delete them 30 days after they were sent or cancelled. [Nathan to confirm: keep this only if the app ships with notifications]
- Proof that we deleted your account. It includes the reference numbers our analytics provider used for you. We delete it 1 year after the deletion finished. [LEGAL REVIEW: the year starts only once our analytics provider confirms its deletion. Until then the proof is kept]
- Analytics counts, if you allowed them. We ask our analytics provider to delete them within 24 hours. They then delete them, which can take some weeks. [LEGAL REVIEW: check against PostHog's stated timing] [Nathan to confirm: the care app's PostHog erasure keys are set in production]
- Logs at the companies that run Teulu for us, such as text message, email and hosting logs. Each company deletes them on its own schedule. [Nathan to confirm each provider's log retention]
Your rights
You can ask for a copy of your information. You can ask us to correct it or delete it.
You can object to how we use it, ask us to limit it, or ask for it in a form you can move.
Where we rely on your consent, you can withdraw it at any time. This does not affect what happened before.
For care records, the care company decides. We will pass your request to it.
To use a right, email [Privacy email to be confirmed]. We reply within one month. [LEGAL REVIEW]
Contact us
Email [Privacy email to be confirmed].
[Nathan to confirm: data protection contact or officer, and a postal address]
Complaints
If you are unhappy with how we use your information, please tell us first.
You can also complain to the Information Commissioner's Office (ICO). Visit ico.org.uk or call 0303 123 1113.
Changes to this notice
We will tell you in Teulu before a change that affects you. The version and date are at the top of this page.