Privacy
Policy
Integrated Care Solutions Ltd (Halo, we, us, our) is committed to protecting the privacy and security of personal information. This policy explains who we are, what data we collect, why we collect it, how we use it, and your rights under UK data protection law.
Halo operates in the social care sector. Some of the personal data we process — such as care needs, health information, and support plans — is classified as special category data under UK GDPR and is subject to heightened protections.
1. Who we are
Integrated Care Solutions Ltd is the data controller for the personal data described in this policy. We are registered in England and Wales.
Our registered office is:
Integrated Care Solutions Ltd
Unit 29 Highcroft Industrial Estate
Enterprise Road, Horndean
Waterlooville, PO8 0BT
Email: admin@haloics.com
Phone: 0330 043 1390
Where Halo processes personal data on behalf of a care provider organisation (for example, a registered care provider using the Halo platform to manage service user records), that organisation acts as the data controller and Halo acts as a data processor. In those circumstances, our processing is governed by a Data Processing Agreement with that organisation.
2. Data we collect
2.1 Website visitors
When you visit haloics.com, we may collect:
- Contact details you submit voluntarily (name, work email address, organisation name) via our interest registration form.
- Technical data such as IP address, browser type, operating system, pages visited, and access times, collected automatically through server logs or analytics tools.
- Cookie preferences you record via our cookie banner.
2.2 Platform users (staff and managers)
When you use the Halo platform — including Halo Command, Halo HR, Halo Rota, Halo Staff, and Halo Chat — we may collect:
- Account and identity data: name, job title, role, work email address, and login credentials.
- Employment data: contract details, employment history, training records, qualifications, right-to-work documents, and onboarding information (processed through Halo HR / Halo People).
- Operational data: rota entries, shift records, attendance logs, and availability (processed through Halo Rota / Halo Shift).
- Communication data: messages and group conversations sent through Halo Chat.
- Usage data: actions taken within the platform, login times, and feature usage.
- Device data: device type, operating system, and app version (particularly for Halo Staff mobile).
2.3 Service users
Where a care provider organisation uses Halo to manage service user records, personal data about those individuals — including special category data — may be processed through the platform. This includes:
- Name, date of birth, contact details, and next-of-kin information.
- Care plans, support plans, and individual risk assessments.
- Daily logs, incident reports, and welfare notes.
- Health, medical, and disability information.
- Feedback and preferences recorded through Halo Voice.
In these cases, the care provider is the data controller and Halo processes this data only on their documented instructions under a Data Processing Agreement.
3. How we use your data
We use personal data for the following purposes:
- To provide, maintain, and improve the Halo platform and its applications.
- To create and manage user accounts and authenticate users securely.
- To enable care teams to manage service user records, incidents, rotas, and communications through the platform.
- To respond to support queries, feedback, and requests from users and organisations.
- To send product updates, release information, and early-access communications (where you have registered interest or consented).
- To detect and prevent fraud, security incidents, and platform misuse.
- To comply with our legal obligations.
- To analyse aggregate platform usage and improve product features (using anonymised or pseudonymised data where possible).
4. Legal bases for processing
We rely on the following legal bases under UK GDPR Article 6:
| Purpose | Legal basis |
|---|---|
| Providing the platform and user accounts | Contract (Article 6(1)(b)) — necessary to perform our agreement with you or your employer |
| Processing service user care records on behalf of a care provider | Legitimate interests of the data controller (the care provider), or compliance with a legal obligation — assessed under their controller role |
| Interest registration and marketing communications | Consent (Article 6(1)(a)) — you may withdraw at any time |
| Security, fraud prevention, and platform integrity | Legitimate interests (Article 6(1)(f)) — to protect our systems and users |
| Compliance with legal obligations | Legal obligation (Article 6(1)(c)) |
| Analytics and product improvement (anonymised/aggregated) | Legitimate interests (Article 6(1)(f)) — to develop and improve our services |
5. Special category data
Health information, disability data, and other special category data (as defined in UK GDPR Article 9) may be processed through the Halo platform in connection with social care delivery. Where Halo processes this data as a processor on behalf of a care provider controller, the legal basis and conditions for processing are the controller's responsibility.
Where Halo processes special category data in its own right (for example, health information about a member of our own staff), we rely on Article 9(2)(b) (employment obligations) or, where relevant, Article 9(2)(h) (health or social care purposes).
Special category data is handled with strict access controls, encrypted at rest and in transit, and accessible only to authorised personnel with a legitimate need.
6. Who we share data with
We do not sell personal data. We may share data with:
- Cloud infrastructure and hosting providers — to run and store the platform securely (for example, Microsoft Azure).
- Authentication and identity services — to manage secure login.
- Analytics providers — to understand aggregate usage patterns (configured to minimise personal data sharing).
- Email and communication service providers — to send notifications and support messages.
- Professional advisers — legal, financial, and compliance advisers who are bound by confidentiality.
- Regulators and law enforcement — where required by applicable law or lawful authority.
- Successor organisations — in the event of a merger, acquisition, or business transfer, subject to the same privacy protections.
All third-party processors are bound by data processing agreements and are required to handle data securely and only as directed.
7. How long we keep data
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.
| Data type | Typical retention period |
|---|---|
| Website enquiry / interest registration data | Up to 2 years from last contact, or until you ask to be removed |
| Platform user account data | Duration of the account plus up to 12 months after closure |
| Employment and HR records (Halo HR) | As required by employment law — typically 6 years from end of employment |
| Service user care records (processed on behalf of care providers) | As directed by the data controller (care provider), subject to applicable care sector regulations |
| Incident and log records | As directed by the data controller; minimum periods may apply under care regulations |
| Chat / communication data | As configured by the organisation's administrator |
| Security and access logs | Up to 12 months |
8. International transfers
We aim to store and process personal data within the UK and European Economic Area. Where data is transferred outside the UK — for example, through a cloud service provider with global infrastructure — we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs), or we confirm that the recipient country has an adequacy decision.
9. Your rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
- Right of access — to obtain a copy of the personal data we hold about you.
- Right to rectification — to have inaccurate or incomplete data corrected.
- Right to erasure — to request deletion of your data in certain circumstances ("the right to be forgotten").
- Right to restriction — to ask us to restrict how we use your data in certain circumstances.
- Right to data portability — to receive your data in a structured, machine-readable format where processing is based on consent or contract.
- Right to object — to object to processing based on legitimate interests, including profiling.
- Rights related to automated decision-making — to not be subject to solely automated decisions that have a significant effect on you.
- Right to withdraw consent — where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at admin@haloics.com. We will respond within one calendar month. We may need to verify your identity before fulfilling a request.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
10. Cookies
We use the following types of cookies and similar technologies on our website:
| Category | Purpose | Consent required |
|---|---|---|
| Essential | Keep the site functioning — session management, security, and cookie preference storage | No — necessary for operation |
| Analytics | Understand how visitors use the site so we can improve it (e.g. page views, session duration) | Yes — opt-in via our cookie banner |
You can accept or reject optional cookies through the banner shown when you first visit our website. You can also change your preference at any time by clearing your cookies or adjusting your browser settings. Your choice is stored in your browser so we remember it on future visits.
11. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, and disclosure. These include encryption of data in transit and at rest, role-based access controls, audit logging, and regular security reviews.
No internet transmission is completely secure. If you believe your data has been compromised, please contact us immediately at admin@haloics.com.
12. Changes to this policy
We may update this policy from time to time to reflect changes in our practices, the law, or our services. We will update the "Last updated" date at the top of this page when we do. For significant changes, we will notify platform users through the Halo application or by email.
13. Contact us
If you have any questions about this policy or how we handle your data, please contact us:
- Email: admin@haloics.com
- Phone: 0330 043 1390
- Post: Integrated Care Solutions Ltd, United Kingdom
If your query relates to personal data held by a care provider organisation that uses Halo, please contact that organisation directly as they are the data controller for that data.