Privacy Policy

1. Who we are

More Days Limited ("we", "us", or "our") is a UK-based company providing a digital platform (Studio) used by care homes to support resident wellbeing through activity planning and engagement tracking.

We are registered with the Information Commissioner's Office (ICO) under registration number ZB905441.

Our appointed Data Protection Officer is Warren Hobden, who oversees data protection compliance and strategy at More Days Limited.

2. Scope and audience

This Privacy Policy applies to:

• Care home staff using the Studio platform
• Residents whose data may be entered into Studio by care staff
• Resident family members who access information via public or secure family views

3. What data we collect

A. Resident data (entered by care staff)

• First and last name
• Date of birth
• Room number or care home location
• Cognitive status (e.g. dementia level)
• Activity participation and observed responses
• Wellbeing notes and triggers (optional)

B. Staff data

• Full name
• Email address
• Job title and role
• Login and access timestamps

C. Family member data

• Name (as registered by the care home)
• Email address or access link
• Viewing activity logs

D. Technical data

• IP address (anonymised where possible)
• Browser type and device
• Pages visited and features used
• Cookies and tracking data (see Cookie Policy)

4. How we use your data

5. How we store and protect your data

Where we store data

Our hosting infrastructure includes:

• Bubble.io — US-based platform (Standard Contractual Clauses in place)
• Amazon Web Services (AWS) — EU/EEA-hosted (Ireland region), SOC 2 Type II and ISO 27001 certified
• Google Analytics — consent-based, IP anonymisation enabled, SCCs in place

How we protect data

• TLS/SSL encryption for data in transit
• AES-256 encryption at rest
• Role-based access controls
• Regular access reviews and audit logging
• Staff training in data protection compliance

How long we keep data

• Active accounts: Data retained for the duration of the service agreement
• After account closure: Personal data deleted within 90 days unless retention is required by law
• Anonymised data: May be retained indefinitely for analytics and service improvement

6. Sharing your data

We do not sell or rent personal data. We may share data with:

• Subprocessors — listed in our Data Processing Agreement
• Care homes — as the data controller, where they request access to their own records
• Legal authorities — if required by law, court order, or regulatory obligation

7. Your rights under UK GDPR

You have the right to:

To exercise any right, contact: talktous@moredays.co.uk

We will respond within one calendar month in line with UK GDPR requirements.

If you are a resident or family member, your care home (as data controller) may need to process your request. We will assist them as required.

8. Children's data

Studio is not designed for use by children under 18. We do not knowingly collect personal data from minors. If we discover that data has been collected from a child, we will delete it promptly.

9. International data transfers

Where personal data is transferred outside the UK or EEA (e.g. to Bubble.io in the US), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)
• International Data Transfer Agreement (IDTA)

10. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal obligations. Material changes will be communicated through the platform.

11. Complaints

If you are not satisfied with our handling of your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

12. Contact us