TERMS AND CONDITIONS

---

Effective Date: 1/8/2023

Last Updated: 9/5/2026

1. ABOUT US

1.1. Shadow Healthcare Ltd ("we," "us," or "our"), a private limited company registered in England and Wales (Company Number: 17149901), operates the website www.shadowhealthcare.co.uk and provides care plan generation services and Basic Life Support (BLS) and AED training services for care home providers primarily in the United Kingdom.

1.2. Company Details:

• Company Name: Shadow Healthcare Ltd
• Company Registration Number: 17149901
• Registered in: England and Wales
• Date of Incorporation: 10th April 2026
• Registered Office: Fernbrae Lodge, The Long Road, Rowledge, Farnham, Surrey, GU10 4EB, United Kingdom
• Contact Email: support@shadowhealthcare.co.uk

1.3. These Terms and Conditions ("Terms") govern your use of our web application, services, and training provision ("Service").

2. ACCEPTANCE OF TERMS

2.1. By accessing or using Shadow Healthcare, you acknowledge that you have read, understood, and agree to be bound by these Terms and our Privacy Policy.

2.2. If you do not agree to these Terms, you must not use our Service.

2.3. You must be at least 18 years old to use Shadow Healthcare.

2.4. By using our Service, you represent and warrant that you have the legal capacity to enter into these Terms.

3. DESCRIPTION OF SERVICE

3.1. Shadow Healthcare provides a web-based platform that assists care home providers and caregivers in generating personalised care plans for residents in the United Kingdom and the Republic of Ireland.

3.2. The web application Service includes:

• Care plan generation tools
• Document scanning functionality (available on all paid plans)
• AI-powered editing capabilities (available on AI-Powered and Premium plans only)
  • Privacy Protection: Resident names are automatically anonymized before AI processing and restored afterward
• PDF generation and email delivery
• Access to 28 different care plan templates

3.3. The care plans generated are templates intended to be customized by qualified healthcare professionals for individual residents.

3A. TRAINING SERVICES

3A.1. Shadow Healthcare Ltd also provides in-person Basic Life Support (BLS) and AED training services to care homes within approximately 20 miles of Farnham, Surrey.

3A.2. Training is delivered by a GMC-registered doctor and NMC-registered nurse who holds a Resus Council UK BLS Instructor qualification.

3A.3. Training Enquiries: Submitting a training enquiry via our website does not constitute a binding contract. A separate Training Agreement must be agreed and signed by both parties before any training session is confirmed and delivered.

3A.4. Training Agreement: Prior to any training session taking place, a Training Agreement will be provided to the care home setting out:

• The agreed date, location, and scope of the training session
• The agreed fee and payment terms
• Cancellation and rescheduling terms
• Limitations of liability specific to training provision

3A.5. Certificates: Shadow Healthcare certificates will be issued to participants who attend and complete the full training session. Certificates are issued by Shadow Healthcare Ltd and are not Ofqual-regulated qualifications. They evidence attendance and completion of BLS and AED training delivered by a qualified instructor.

3A.6. Training Liability:

• Training is provided in good faith by a qualified instructor using evidence-based techniques consistent with Resus Council UK guidelines
• The care home remains responsible for ensuring its staff maintain competency and for the clinical decisions made by its staff in practice
• Shadow Healthcare Ltd is not liable for outcomes arising from a staff member's application or non-application of skills taught during training
• The care home is responsible for ensuring its own insurance arrangements cover the receipt of in-person training

3A.7. Cancellation of Training Sessions: Cancellation terms will be set out in the Training Agreement provided prior to each session. Shadow Healthcare Ltd reserves the right to reschedule a session in the event of trainer illness or other circumstances beyond our reasonable control.

3A.8. Coverage Area: Training is currently offered to care homes within approximately 20 miles of Farnham, Surrey. Shadow Healthcare Ltd reserves the right to decline training bookings outside this area at its discretion.

4. ACCOUNT REGISTRATION

4.1. To use Shadow Healthcare, you must create an account by providing:

• Your full name
• Valid email address
• Secure password
• Date of birth (to verify you are 18+)

4.2. You agree to provide accurate, current, and complete information during registration.

4.3. You are responsible for:

• Maintaining the confidentiality of your account credentials
• All activities that occur under your account
• Notifying us immediately of any unauthorized use

4.4. We reserve the right to suspend or terminate accounts that provide false information.

4.5. Generated care plans will be sent to the email address provided during account registration. You must ensure this is the correct email address.

5. SUBSCRIPTION PLANS AND PRICING

5.1. Available Plans

5.1.1. Training services are priced separately and are not included in any web application subscription plan. Training pricing is provided upon enquiry and confirmed in the Training Agreement.

5.2. Pricing Changes

5.2.1. We reserve the right to change our pricing at any time.

5.2.2. Existing subscribers will be notified at least 30 days before any price increase affecting their subscription.

5.2.3. Price changes will not affect your current billing cycle but will apply upon renewal.

5.2.4. If you do not agree to a price increase, you may cancel your subscription before the renewal date.

6. PAYMENT TERMS

6.1. Payment Methods: We accept payment via Stripe, which supports major credit and debit cards, for web application subscriptions. Training service invoices are issued separately and payment terms are set out in the Training Agreement.

6.2. Billing Cycles:

• Monthly subscriptions are billed every 30 days from the subscription date
• Annual subscriptions are billed every 365 days from the subscription date

6.3. Authorization: By providing payment information, you authorize us to charge the applicable fees to your payment method.

6.4. Failed Payments:

• If a payment fails, we will notify you via email
• Your access may be suspended until payment is received
• We will attempt to process payment up to 3 times over 10 days
• After 3 failed attempts, your subscription will be cancelled

6.5. Taxes: All prices are in GBP and inclusive of VAT where applicable.

7. AUTO-RENEWAL AND CANCELLATION

7.1. Auto-Renewal

7.1.1. All paid subscriptions automatically renew at the end of each billing cycle unless cancelled.

7.1.2. You will be charged the then-current subscription fee unless you cancel before the renewal date.

7.1.3. We will send you a reminder email at least 7 days before each renewal.

7.2. Cancellation

7.2.1. You may cancel your subscription at any time through your account dashboard or by contacting support@shadowhealthcare.co.uk.

7.2.2. Upon cancellation:

• You will retain access until the end of your current billing period
• No refund will be provided for the remaining days of the current period
• Auto-renewal will be disabled
• Your account will revert to the Free Trial limits (if applicable) or be deactivated

7.2.3. 14-Day Cooling-Off Period (Consumer Contracts Regulations 2013):

• If you are a consumer (not purchasing for business use), you have the right to cancel within 14 days of purchase
• If you have used the Service during this period, you will be charged proportionately for the services you received
• To exercise this right, email support@shadowhealthcare.co.uk with your cancellation request
• Refunds will be processed within 14 days to your original payment method

8. REFUND POLICY

8.1. 14-Day Cooling-Off Period: Under UK Consumer Contracts Regulations 2013, you have 14 days from purchase to cancel. If you have used the Service during this period, you will be charged a proportionate amount for services received, and the remainder will be refunded.

8.2. No Refunds After 14 Days: After the 14-day period, subscription fees are non-refundable, except:

• Service downtime exceeding 48 consecutive hours (pro-rata refund)
• Billing errors (full correction and refund of overcharge)

8.3. Partial Month Refunds: We do not provide pro-rata refunds for cancelled subscriptions outside the 14-day window.

8.4. Training Service Refunds: Refund terms for training sessions are set out in the Training Agreement. Generally, cancellations made with sufficient notice as specified in the Training Agreement will not be charged. Cancellations made with insufficient notice may be subject to a cancellation fee as detailed in the Training Agreement.

8.5. Exceptional Circumstances: Refund requests for exceptional circumstances will be considered on a case-by-case basis.

8.6. How to Request a Refund: Email support@shadowhealthcare.co.uk with:

• Your account email
• Reason for refund request
• Date of purchase

8.7. Refunds are processed within 14 business days to your original payment method.

9. FREE TRIAL TERMS

9.1. New users receive a 7-day free trial with 5 care plan generations.

9.2. No payment information is required for the free trial.

9.3. At the end of the trial:

• You will be prompted to choose a paid plan to continue
• No automatic charge will occur
• Your account will be limited until you subscribe

9.4. Free trials are limited to one per user/email address.

9.5. We reserve the right to refuse free trial access if we suspect abuse or fraudulent activity.

10. USAGE LIMITS AND RESTRICTIONS

10.1. Care Plan Generation Limits:

• Free Trial: 5 care plans total
• Standard: Unlimited
• AI-Powered: Unlimited
• Premium: Unlimited

10.2. AI Editor Limits (per care plan):

• Free Trial: 0 edits
• Standard: 0 edits
• AI-Powered: 3 edits
• Premium: 5 edits

10.3. Fair Use Policy: While most plans offer "unlimited" care plans, we reserve the right to contact users generating excessive volumes (>1,000 care plans per month) to ensure compliance with our intended use.

10.4. Attempting to circumvent usage limits (e.g., creating multiple accounts) is prohibited and may result in account termination without refund.

11. USER OBLIGATIONS

11.1. You agree to use the Service only for lawful purposes and in accordance with these Terms.

11.2. You agree NOT to:

• Use the Service for any illegal or unauthorized purpose
• Interfere with the proper functioning of the Service
• Attempt to gain unauthorized access to other users' accounts
• Transmit or store harmful or malicious code
• Violate any applicable laws, regulations, or third-party rights
• Use the Service to generate care plans for residents outside the UK or Ireland without proper adaptation
• Share your account credentials with others

11.3. Clinical Responsibility:

• The care plans generated are templates based on information you provide
• You are solely responsible for verifying the accuracy, appropriateness, and clinical safety of all care plans before implementation
• Care plans must be reviewed and customized by qualified healthcare professionals
• You must ensure care plans comply with CQC standards and relevant regulations

11.4. Resident Name Protection:

• Generated care plans are for the named resident only
• You may alter care plan content for the named resident
• You MUST NOT change the resident name on a generated care plan to use it for a different resident
• Doing so constitutes plagiarism and breach of these Terms
• We reserve the right to pursue legal action for such violations

11.5. Training Obligations:

• Care homes receiving training are responsible for ensuring an appropriate venue and space is available at the agreed location on the agreed date
• Care homes are responsible for ensuring the correct staff attend the session as agreed
• Care homes are responsible for the clinical decisions and actions of their staff following training

12. INTELLECTUAL PROPERTY RIGHTS

12.1. Our Rights:

• Shadow Healthcare Ltd retains all rights, title, and interest in the Service
• All content, including text, graphics, logos, software, templates, and training materials, is protected by UK copyright law
• Our trademarks and branding may not be used without express written permission

12.2. Your License:

• You are granted a limited, non-exclusive, non-transferable license to use the Service for its intended purpose
• This license terminates upon account cancellation or termination

12.3. Your Content:

• You retain ownership of data you input into the Service
• By using the Service, you grant us a limited license to process your data solely to provide the Service
• We do not claim ownership of resident information or customized care plans you generate

12.4. Generated Care Plans:

• You may download, print, and use generated care plans for your care home operations
• You may not resell, redistribute, or commercialize our templates or generated plans

12.5. Training Materials:

• All training materials, course content, and certificates provided during or after training sessions remain the intellectual property of Shadow Healthcare Ltd
• Training materials may not be reproduced, shared, or used for commercial purposes without written permission

13. DATA PROTECTION AND PRIVACY

13.1. We process personal data in accordance with UK GDPR and the Data Protection Act 2018.

13.2. Data We Collect:

• Account information (name, email, date of birth)
• Usage data (how you interact with the Service)
• Training enquiry data (name, email, phone number, care home name and location) submitted via the training enquiry form — collected solely for the purpose of responding to training enquiries
• We do NOT store resident data entered into care plan generation forms

13.3. Important: Shadow Healthcare Ltd does not retain or store resident/service user information entered into care plan forms. This data is processed in real-time and not saved to our servers.

13.4. Training Enquiry Data: Personal data submitted via the training enquiry form (including name, email address, phone number, and care home details) is used solely to respond to your enquiry and arrange training services. This data is not used for marketing purposes without your consent and is not shared with third parties. It is retained for a period of 6 years for accounting and contractual purposes following any training engagement, or deleted upon request if no training engagement takes place.

13.5. Full details of our data practices are in our Privacy Policy below.

13.6. You are responsible for ensuring your use of the Service complies with UK data protection laws regarding resident data.

13.7. Your Rights: Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent

13.8. To exercise these rights, contact support@shadowhealthcare.co.uk.

14. DATA SECURITY

14.1. We implement industry-standard security measures including:

• Encrypted data transmission (SSL/TLS)
• Secure password storage (hashing and salting)
• Regular security audits
• Access controls and authentication

14.2. However, you acknowledge:

• No internet service is 100% secure
• We cannot guarantee absolute security
• You are responsible for maintaining secure passwords

14.3. Your Responsibilities:

• Use a strong, unique password
• Do not share your login credentials
• Log out after each session on shared devices
• Notify us immediately of any suspected security breach

15. SERVICE AVAILABILITY

15.1. We aim to provide 99.9% uptime but cannot guarantee uninterrupted access.

15.2. We reserve the right to:

• Perform scheduled maintenance (with advance notice where possible)
• Suspend the Service for emergency maintenance
• Modify or discontinue features with reasonable notice

15.3. We are not liable for service interruptions caused by:

• Circumstances beyond our control (force majeure)
• Third-party service failures
• Internet connectivity issues
• Your equipment or software

16. LIMITATION OF LIABILITY

16.2. Service Provision:

• The Service is provided "as is" and "as available"
• We make no warranties regarding accuracy, reliability, or fitness for a particular purpose
• We do not warrant that the Service will be error-free or uninterrupted

16.3. Clinical Liability:

• Generated care plans are templates requiring professional review and customization
• You are solely responsible for the clinical appropriateness and safety of implemented care plans
• We are not liable for any clinical errors, omissions, or adverse outcomes resulting from care plan use
• You must ensure all care plans are reviewed by qualified healthcare professionals before implementation

16.4. Training Liability:

• BLS and AED training is delivered in good faith by a qualified instructor using evidence-based techniques consistent with Resus Council UK guidelines
• Shadow Healthcare Ltd does not guarantee that trained staff will successfully perform BLS or AED use in a real emergency situation
• The care home remains solely responsible for the clinical decisions and actions of its staff in practice
• Shadow Healthcare Ltd is not liable for any outcomes arising from the application or non-application of skills taught during training sessions
• Our liability in respect of any training session shall not exceed the fee paid for that session

16.5. Limitation of Damages:

To the maximum extent permitted by UK law:

16.5.1. We are not liable for:

• Indirect, consequential, or incidental damages
• Loss of profits, revenue, or business opportunities
• Loss of data (except as caused by our negligence)
• Regulatory penalties or sanctions
• Harm to residents resulting from care plan implementation
• Harm to residents or others arising from staff actions following training

16.5.2. Our total liability to you for any claims arising from these Terms or the Service shall not exceed:

• For Free Trial users: £0
• For paying subscribers: The total amount paid by you in the 12 months preceding the claim
• For training services: The fee paid for the specific training session giving rise to the claim

16.6. Professional Indemnity:

• You should maintain appropriate professional indemnity insurance
• Our Service does not replace professional judgment or clinical expertise
• You remain solely responsible for compliance with CQC and other regulatory requirements

16.7. Third-Party Services:

• We are not responsible for third-party services (e.g., Stripe, email providers)
• We are not liable for issues caused by your internet service provider or device

17. INDEMNIFICATION

17.1. You agree to indemnify, defend, and hold harmless Shadow Healthcare Ltd, its directors, employees, and agents from any claims, damages, losses, or expenses (including legal fees) arising from:

• Your use of the Service
• Your violation of these Terms
• Your violation of any applicable laws or regulations
• Any claim that your use of the Service caused harm to a resident
• Your breach of data protection laws
• Any claim arising from the actions or omissions of your staff following training delivered by Shadow Healthcare Ltd

17.2. This indemnification obligation survives termination of your account.

18. TERMINATION

18.1. Termination by You:

• You may cancel your subscription at any time as described in Section 7
• Account deletion requests can be made to support@shadowhealthcare.co.uk

18.2. Termination by Us:

We may suspend or terminate your account immediately if:

• You breach these Terms
• You engage in fraudulent activity
• You abuse the Service or other users
• Your payment fails repeatedly
• Required by law or regulatory authority

18.3. Effect of Termination:

• Your right to use the Service ceases immediately
• You will not receive a refund for any remaining subscription period (except within 14-day cooling-off period)
• We may delete your account data (excluding data required for legal or accounting purposes)
• Sections that should survive termination (liability, indemnification, etc.) will remain in effect

18.4. Data Retention After Termination:

• We will retain your personal data for 6 years for accounting purposes (HMRC requirement)
• You may request earlier deletion subject to our legal obligations
• Resident data is not retained (as it is not stored during generation)

19. MODIFICATIONS TO TERMS

19.1. We may update these Terms at any time to reflect:

• Changes in law or regulation
• Changes to our Service or features
• Security or operational improvements

19.2. Notice of Changes:

• Material changes will be notified via email at least 30 days in advance
• The "Last Updated" date at the top will be revised
• Continued use after changes constitutes acceptance

19.3. If you do not agree to updated Terms:

• You may cancel your subscription before the changes take effect
• Refunds will only be provided as per Section 8

20. GOVERNING LAW AND JURISDICTION

20.1. These Terms are governed by and construed in accordance with the laws of England and Wales.

20.2. Any disputes arising from these Terms or the Service shall be subject to the exclusive jurisdiction of the courts of England and Wales.

20.3. Consumers: If you are a consumer (not purchasing for business use), nothing in this clause affects your statutory rights.

21. DISPUTE RESOLUTION

21.1. Before initiating legal proceedings, you agree to attempt to resolve disputes informally by contacting support@shadowhealthcare.co.uk.

21.2. We will endeavor to resolve complaints within 30 days.

21.3. If you are a consumer and remain dissatisfied, you may refer the matter to:

• Citizens Advice Consumer Service: 0808 223 1133

22. SEVERABILITY

22.1. If any provision of these Terms is found to be invalid or unenforceable under UK law:

• That provision will be modified to the minimum extent necessary to make it valid
• The remaining provisions will continue in full force and effect

23. ENTIRE AGREEMENT

23.1. These Terms, together with our Privacy Policy and any Training Agreement entered into separately, constitute the entire agreement between you and Shadow Healthcare Ltd.

23.2. These Terms supersede any prior agreements or understandings.

24. WAIVER

24.1. Our failure to enforce any provision of these Terms does not constitute a waiver of that provision.

24.2. Any waiver must be in writing and signed by an authorized representative.

25. ASSIGNMENT

25.1. You may not assign or transfer your rights under these Terms without our written consent.

25.2. We may assign or transfer our rights and obligations under these Terms without your consent in the event of:

• A merger, acquisition, or sale of assets
• Corporate restructuring

26. FORCE MAJEURE

26.1. We are not liable for delays or failures in performance resulting from circumstances beyond our reasonable control, including:

• Acts of God (floods, earthquakes, pandemics)
• War, terrorism, civil unrest
• Government actions or restrictions
• Internet or telecommunications failures
• Cyber attacks or data breaches affecting third parties
• Trainer illness or incapacity (in respect of training services)

27. CONTACT INFORMATION

27.1. For questions, complaints, or support:

• Company Name: Shadow Healthcare Ltd
• Company Number: 17149901
• Registered Office: Fernbrae Lodge, The Long Road, Rowledge, Farnham, Surrey, GU10 4EB, United Kingdom
• Email: support@shadowhealthcare.co.uk
• Response Time: We aim to respond within 2 business days

27.2. For data protection inquiries:

• Email: support@shadowhealthcare.co.uk
• Subject Line: "Data Protection Request"

28. ACKNOWLEDGMENT

By using Shadow Healthcare, you acknowledge that:

• You have read and understood these Terms
• You agree to be bound by these Terms
• You understand that care plans generated are templates requiring professional review
• You are solely responsible for the clinical safety and appropriateness of implemented care plans
• Training services are subject to a separate Training Agreement and these Terms apply to both the web application and training services

---

PRIVACY POLICY

---

Effective Date: 1/8/2023

Last Updated: 9/5/2026

1. INTRODUCTION

1.1. Shadow Healthcare Ltd ("we," "us," or "our") is committed to protecting your privacy and personal data.

1.2. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)

1.3. Data Controller: Shadow Healthcare Ltd is the data controller responsible for your personal data.

1.4. Contact Details:

• Company Name: Shadow Healthcare Ltd
• Company Number: 17149901
• Registered Office: Fernbrae Lodge, The Long Road, Rowledge, Farnham, Surrey, GU10 4EB, United Kingdom
• Email: support@shadowhealthcare.co.uk

2. INFORMATION WE COLLECT

2.1. Information You Provide

Account Information:

• Full name
• Email address
• Password (stored securely with encryption)
• Date of birth (for age verification)

Payment Information:

• Payment card details (processed by Stripe, not stored by us)
• Billing address
• Transaction history

Training Enquiry Information:

• Full name of the enquirer
• Email address
• Phone number (if provided)
• Care home name and location
• Approximate number of staff to be trained
• Any additional information provided in the enquiry form

This information is collected solely for the purpose of responding to training enquiries and arranging training sessions. It is not used for marketing purposes without your consent and is not shared with third parties except where required by law.

Communications:

• Messages sent to customer support
• Feedback and survey responses
• Training enquiry correspondence

2.2. Information We Collect Automatically

Usage Data:

• Pages visited on our website
• Features used within the Service
• Time and date of access
• Browser type and device information
• IP address
• Cookies and similar technologies (see Section 9)

Technical Data:

• Device type and operating system
• Browser type and version
• Screen resolution
• Language preference

2.3. Resident Data

Your Responsibility: You are the data controller for resident data and must ensure compliance with UK GDPR when collecting and using resident information.

3. LEGAL BASIS FOR PROCESSING

We process your personal data under the following legal bases:

3.1. Contract Performance: To provide the Service you've subscribed to and to fulfil training agreements (UK GDPR Article 6(1)(b))

3.2. Legitimate Interests: To improve our Service, prevent fraud, ensure security, and respond to training enquiries (UK GDPR Article 6(1)(f))

3.3. Legal Obligation: To comply with accounting, tax, and regulatory requirements (UK GDPR Article 6(1)(c))

3.4. Consent: For marketing communications (you may withdraw consent at any time)

4. HOW WE USE YOUR INFORMATION

We use your personal data to:

4.1. Provide the Service:

• Create and manage your account
• Process care plan generation requests
• Deliver generated care plans via email/PDF
• Process payments and maintain billing records

4.2. Training Services:

• Respond to training enquiries submitted via our website
• Arrange and confirm training sessions
• Issue Training Agreements and invoices
• Issue certificates to training participants
• Maintain records of training delivered for accounting and contractual purposes

4.3. Customer Support:

• Respond to inquiries and support requests
• Troubleshoot technical issues
• Provide guidance on Service use

4.4. Service Improvement:

• Analyze usage patterns to enhance features
• Identify and fix bugs
• Develop new functionality

4.5. Communication:

• Send service updates and important notices
• Notify you of subscription renewals and billing
• Send marketing communications (with your consent)

4.6. Legal and Security:

• Comply with legal obligations (tax, accounting, court orders)
• Prevent fraud and abuse
• Protect our rights and property
• Ensure Service security

5. DATA SHARING AND DISCLOSURE

5.1. Third-Party Service Providers

We share data with trusted third parties who help us operate the Service:

Stripe (Payment Processing):

• Purpose: Process subscription payments
• Data Shared: Payment card details, billing address, email
• Location: EEA/UK (GDPR-compliant)
• Privacy Policy: https://stripe.com/privacy

Email Service Provider:

• Purpose: Deliver care plans and service emails
• Data Shared: Email address, name
• Location: Namecheap, USA

Hosting Provider:

• Purpose: Host our web application and database
• Data Shared: Account data (excluding resident data, which is not stored)
• Location: Namecheap, USA

Anthropic (AI Processing):

• Purpose: Power AI Editor features (AI-Powered and Premium plans only)
• Data Shared: Care plan text for editing
• Privacy Protection: Resident names are automatically removed before sending to AI and restored after editing
• No identifiable resident data is sent to Anthropic
• Location: USA (adequate safeguards in place)
• Privacy Policy: https://www.anthropic.com/privacy

5.1.1. All third parties are bound by data processing agreements and process data only as instructed by us.

5.1.2. Training enquiry data is not shared with any third party except where required by law or as necessary to fulfil a training agreement (for example, issuing invoices through accounting software).

5.2. Legal Disclosures

We may disclose your data if required by law to:

• Comply with court orders, subpoenas, or legal processes
• Respond to lawful requests from government authorities
• Protect our rights, property, or safety
• Investigate fraud or security issues

5.3. Business Transfers

In the event of a merger, acquisition, or sale of assets:

• Your data may be transferred to the acquiring entity
• We will notify you before any transfer
• The new entity will be bound by this Privacy Policy

5.4. No Sale of Data

We never sell your personal data to third parties.

5.5. AI Editor Privacy Safeguards

When you use the AI Editor feature (available on AI-Powered and Premium plans):

• Name Anonymization: Resident names are automatically removed from care plan text before it is sent to Anthropic Claude AI for editing
• Names are replaced with a placeholder `[RESIDENT_NAME]` during AI processing
• After the AI returns the edited text, resident names are automatically restored
• This ensures that no personally identifiable resident information is transmitted to the AI service
• Only generic care plan content (without names) is processed by AI

This automated privacy protection happens transparently - you do not need to take any action.

6. DATA RETENTION

6.1. Account Data: Retained for the duration of your account plus 6 years for accounting/tax purposes (HMRC requirement)

6.2. Payment Records: Retained for 6 years to comply with UK tax law

6.3. Resident Data: NOT retained - processed in real-time only and not stored

6.4. Usage Data: Retained for 2 years for analytics and service improvement

6.5. Marketing Consent: Retained until you withdraw consent or for 3 years of inactivity

6.6. Training Enquiry Data: Retained for 6 years following any training engagement for accounting and contractual purposes (HMRC requirement). Where an enquiry does not result in a training engagement, data will be deleted upon request or after 12 months of inactivity.

6.7. Right to Erasure: You may request earlier deletion subject to our legal obligations (see Section 8)

7. DATA SECURITY

7.1. We implement industry-standard security measures:

• Encryption: All data transmission uses SSL/TLS encryption
• Password Security: Passwords are hashed and salted (never stored in plain text)
• Access Controls: Restricted access to personal data on a need-to-know basis
• Regular Audits: Periodic security assessments and vulnerability testing
• Secure Servers: Hosting with reputable providers with ISO 27001 certification

7.2. Your Responsibilities:

• Use a strong, unique password
• Do not share your login credentials
• Log out after each session on shared devices
• Report suspected security breaches immediately

7.3. Data Breach Notification:

• We will notify the ICO within 72 hours of becoming aware of a breach
• We will notify affected users without undue delay if there is a high risk to their rights

7.4. No Absolute Security: While we strive to protect your data, no internet service is 100% secure. You use the Service at your own risk.

8. YOUR DATA PROTECTION RIGHTS

Under UK GDPR, you have the following rights:

8.1. Right of Access (Subject Access Request)

• Request a copy of all personal data we hold about you
• We will provide this within 30 days, free of charge

8.2. Right to Rectification

• Correct inaccurate or incomplete data
• Update your account information at any time via your dashboard

8.3. Right to Erasure ("Right to be Forgotten")

• Request deletion of your personal data
• Subject to legal retention requirements (e.g., 6-year tax records)

8.4. Right to Restrict Processing

• Limit how we use your data in certain circumstances

8.5. Right to Data Portability

• Receive your data in a structured, machine-readable format
• Transfer your data to another service provider

8.6. Right to Object

• Object to processing based on legitimate interests
• Object to marketing communications (opt-out links in all marketing emails)

8.7. Right to Withdraw Consent

• Withdraw consent for marketing communications at any time
• Does not affect processing based on other legal bases (e.g., contract performance)

8.8. Right to Complain

Lodge a complaint with the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk/make-a-complaint/
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

8.9. How to Exercise Your Rights:

• Email: support@shadowhealthcare.co.uk
• Subject Line: "Data Protection Request"
• Include: Your name, email, and specific request
• Response Time: We will respond within 30 days

9. COOKIES AND TRACKING

9.1. What Are Cookies?
Cookies are small text files stored on your device when you visit our website.

9.2. Cookies We Use:

Essential Cookies (Always Active):

• Session management (keep you logged in)
• Security and authentication
• These cannot be disabled as the Service would not function

Analytics Cookies (With Consent):

• Google Analytics (anonymized IP)
• Usage patterns and feature popularity
• Performance monitoring

Preference Cookies (With Consent):

• Remember your settings
• Language preferences

9.3. Cookie Consent:

• We ask for your consent before setting non-essential cookies
• You can withdraw consent at any time via cookie settings
• Disabling cookies may affect Service functionality

9.4. Third-Party Cookies:

• Stripe may set cookies for payment processing
• We do not control third-party cookies (see their privacy policies)

9.5. Managing Cookies:

• Browser settings: Most browsers allow you to block or delete cookies
• Our cookie banner: Manage preferences directly on our site

10. MARKETING COMMUNICATIONS

10.1. With Your Consent:

• We may send marketing emails about new features, updates, and special offers
• You can opt-out at any time via the unsubscribe link in emails

10.2. Service Communications (No Opt-Out):

• Essential service emails (password resets, billing notifications, security alerts) cannot be disabled
• These are necessary for account management

10.3. Training Enquiry Communications:

• We will contact you in response to a training enquiry using the details you provide
• We will not use training enquiry contact details for marketing purposes without your explicit consent

10.4. Email Frequency:

• Marketing emails: Maximum 1 per week
• Service emails: As needed

11. CHILDREN'S PRIVACY

11.1. Shadow Healthcare Ltd is not intended for individuals under 18 years of age.

11.2. We do not knowingly collect data from children.

11.3. If we become aware that a child has provided personal data, we will delete it immediately.

11.4. Parents/guardians: If you believe your child has provided data to us, please contact support@shadowhealthcare.co.uk.

12. INTERNATIONAL DATA TRANSFERS

12.1. Data Location:

• Your account data is primarily stored in the UK/EEA
• Some third-party processors (e.g., Anthropic for AI) are based outside the UK/EEA

12.2. Safeguards for International Transfers:

We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the UK ICO
• Adequacy decisions (where applicable)
• Binding corporate rules

12.3. Anthropic (USA):

• AI processing may involve data transfer to the USA
• Protected by Standard Contractual Clauses
• Resident names are automatically anonymized before transfer
• No directly identifiable resident data is transferred

13. DO NOT TRACK (DNT)

13.1. Some browsers offer a "Do Not Track" (DNT) signal.

13.2. We do not currently respond to DNT signals, as there is no industry standard for how to interpret them.

13.3. You can manage tracking through cookie settings and browser preferences.

14. DATA PROTECTION OFFICER (DPO)

14.1. DPO Appointment:

• Small businesses are not required to appoint a DPO under UK GDPR unless processing large volumes of sensitive data
• We do not have a DPO. Data protection inquiries should be directed to support@shadowhealthcare.co.uk

15. CHANGES TO THIS PRIVACY POLICY

15.1. We may update this Privacy Policy to reflect:

• Changes in law or regulation
• Changes to our data practices
• New features or services

15.2. Notification of Changes:

• Material changes will be notified via email at least 30 days in advance
• The "Last Updated" date at the top will be revised
• Continued use after changes constitutes acceptance

15.3. We encourage you to review this Privacy Policy periodically.

16. CONTACT US

16.1. For Privacy Questions or Requests:

• Company Name: Shadow Healthcare Ltd
• Company Number: 17149901
• Registered Office: Fernbrae Lodge, The Long Road, Rowledge, Farnham, Surrey, GU10 4EB, United Kingdom
• Email: support@shadowhealthcare.co.uk
• Subject: "Privacy Inquiry" or "Data Protection Request"

16.2. For Complaints:

• You may complain to us first, and we will investigate
• If unsatisfied, you may complain to the ICO (see Section 8.8)

17. ACKNOWLEDGMENT

By using Shadow Healthcare, you acknowledge that:

• You have read and understood this Privacy Policy
• You consent to the collection and use of your data as described
• You understand that resident data is not stored by Shadow Healthcare Ltd
• You understand that resident names are automatically anonymized during AI processing
• You understand that training enquiry data is collected and used solely for the purpose of responding to training enquiries and arranging training sessions

---

If you have any questions or concerns about these Terms and Conditions or our Privacy Policy, please contact us at support@shadowhealthcare.co.uk.