Privacy Policy

Last updated: 25 October 2026

1. Who we are

Warden is provided by Zelicra Technologies Private Limited, a company registered in India (CIN U62011KL2026PTC104927), registered office: Kalathiparambil, Chirakkakam, Varapuzha P.O., Paravur, Ernakulam, Kerala 683517, India ("Zelicra", "we", "us"). For anything about your personal data, email privacy@zelicra.com.

2. Our two roles

For the records care homes keep in Warden, the care home is in charge. A care home uses Warden to keep records about its staff and, in its DoLS register, about some residents. The care home is the controller of that information: it decides what to record and why. We are its processor: we store and handle the records only to provide Warden and only on the care home's instructions, under our Data Processing Agreement. If you work at a care home, or live in one, and have a question about your records, please ask the care home first; we will help it answer you.

For our own business information, we are in charge. We are the controller of the information we need to run Warden as a business: the accounts of managers who sign up, invoices, messages people send us, and visits to our website.

3. Information we hold for our own purposes

Information	Why we use it, and our legal basis
Manager account details: name, work email, the care home's name, password (stored only as a hash)	To create and run the account and to contact you about it. Legal basis: contract.
Invoicing details: the organisation's legal name and address, billing contact and invoices	To bill for Warden and keep accounting records. Legal basis: contract, and our legal obligation to keep accounts.
Messages to us: contact and demo forms, emails	To answer you. Legal basis: our legitimate interest in replying to enquiries.
Website chat questions	To answer questions about Warden on our website. Legal basis: our legitimate interest in answering visitors.
Technical data: IP address, browser type, times of requests	To keep Warden and our website secure and working. Legal basis: our legitimate interest in security.

We do not sell personal data, and we do not use it for advertising.

4. Information care homes keep in Warden

As the care home's processor we handle these records only to provide Warden to it:

Staff details: name, email, phone number, role and job role, employment type (for example employee, bank, agency or volunteer), start date, and sign-in history.
Training: courses, completion and expiry dates, and uploaded certificates.
Recruitment checks: the information care homes must hold for each person they employ, including managers (Schedule 3 to the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014): proof of identity, DBS check details and certificate copies, references and evidence of conduct in earlier care work, why earlier work with children or vulnerable adults ended, evidence of qualifications, a full employment history, whether the health check is complete (Warden does not hold the health information itself), right to work checks, and professional registration numbers. DBS information is criminal offence data (UK GDPR Article 10).
DoLS register: the names of residents subject to Deprivation of Liberty Safeguards authorisations, with references, dates, the local authority and assessor, notes and documents. This includes health and mental capacity information, which is special category data (UK GDPR Article 9).
Supervisions and appraisals: meeting notes, dates and sign-offs.
Policies and notices: what each person was sent, when they opened and signed it, their answers to any comprehension check, and the IP address used.
Audit log: who did what in Warden, when, and from which IP address.

The care home decides its own legal basis for these records, including the extra conditions the law requires for health and criminal offence data, and tells its staff and residents about them. Because these records are so sensitive, we protect them as described on our Security page.

We use a small number of companies to run Warden. They may only use the information to provide their service to us:

Hetzner hosts our server in Helsinki, Finland, where Warden's database and uploaded documents are stored.
Brevo sends Warden's emails, such as sign-in links and notices.

The full list, with what each company does and where, is on our sub-processors page.

When a member of staff switches on notifications, their browser maker's push service (Google, Mozilla, Apple or Microsoft) carries each notification to their device. The notification is encrypted so that only that device can read it. These services are part of the browser the person chose; we have no contract with them.

Our website and Warden also use:

Google Fonts (Google), which supplies the fonts on our website and inside Warden, and cdnjs (Cloudflare), which supplies the animation code on our public website. When a page loads, your browser asks their servers for these files, so they receive your IP address and browser details.
An AI service provider that writes the answers in the chat on our website. The question you type is sent to it to produce an answer. We do not keep chat transcripts; our server only counts how many questions are asked. Please do not type personal or health information into the chat.

We may also share information where the law requires it, with professional advisers under a duty of confidence, or with a company that takes over Warden (we would tell you first).

6. Where information is stored and international transfers

Warden's database and uploaded documents are stored on our server in Helsinki, Finland, in the European Economic Area (EEA). UK law approves transfers of personal data to the EEA.

Zelicra is based in India, and our team accesses Warden from India to run and support it. Under UK law that access is a transfer of personal data out of the UK, and India is not a country UK law has approved for transfers. Each care home and Zelicra therefore agree to the International Data Transfer Agreement issued by the UK's data protection regulator, which forms part of our Data Processing Agreement (Annex 4), and we have assessed the risks of these transfers. We access only what we need to provide and support Warden, over encrypted connections, and the data stays stored in Finland. You can ask us for a copy of these safeguards at privacy@zelicra.com.

The information we hold for our own purposes (section 3) is also stored in Finland and handled by our team in India.

Some of the companies in section 5 may also process information outside the UK and EEA, for example Brevo's support teams in India and the USA; where they do, they use the safeguards the law requires.

7. How long we keep information

For the records care homes keep in Warden:

Records	Kept for
Everything for a care home	Deleted 30 days after the account is closed
Email log (who was emailed what, and when)	12 months
Audit log	Kept while the account is open; deleted 30 days after the account is closed
DBS certificate copies	6 months after the certificate was issued (or 6 months after the check was recorded, if no issue date was entered). The check record (reference, dates and result) is kept.
Notice records (notices, acknowledgements and signatures)	Kept while the account is open; deleted 30 days after the account is closed
Sign-in links and reset tokens	Deleted 30 days after they are used or expire

Deleted information leaves our nightly backups within 30 days, as we keep the last 30.

For our own information: manager account details for as long as the account is open and then 30 days; invoices and accounting records for as long as tax and company law requires; messages to us for up to 2 years after our last contact; server logs (IP address, browser and request times) for 14 days.

8. Your rights

You have the right to ask for a copy of your personal data, to have it corrected, deleted or restricted, to object to how we use it, and to have it moved to another service. For records a care home keeps about you in Warden, please ask the care home first; we will help it. For anything we hold for our own purposes, email privacy@zelicra.com. We reply within one month.

9. Security

How we protect information, including what is still on our roadmap, is set out on our Security page.

10. Cookies and similar storage

Session cookie (essential): keeps you signed in.
Cookie notice cookie (essential): remembers that you have seen our cookie notice, for 1 year.
Notifications cookie (needed for notifications): remembers when a manager last opened their notifications, so Warden can show what is new, for 30 days.
Display settings: your light or dark choice, and whether you dismissed the prompt to switch on notifications, are saved in your browser's local storage, not sent to us.

We do not use analytics, advertising or tracking cookies.

11. Children

Warden is for adults working in care homes. DoLS records relate to residents aged 18 or over. We do not knowingly collect information from children.

12. Changes to this policy

We will update this policy when how we use information changes, and email the managers of every home about important changes. The date at the top shows the latest version.

13. Complaints

If you are unhappy with how we have handled personal data, please tell us at privacy@zelicra.com. We acknowledge every complaint within 30 days, look into it, keep you informed and tell you the outcome without undue delay. If your complaint is about records a care home keeps about you in Warden, please also contact the care home, which is responsible for them; we will help it respond.

You also have the right to complain to the UK's data protection regulator, the Information Commission (which still uses the name ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.