This page lists the companies that handle data on behalf of ARC, what they do, and where. It is the list our Data Processing Agreement refers to.
Data protection in brief
Who is responsible. You are the data controller for your care records. ARC is your data processor. For account and billing details, ARC is the controller.
Where it is held. The database, uploaded documents, backups, AI processing and email sending all run in Amazon Web Services in London (eu-west-2). Two providers outside the UK are listed below: Laravel Forge and Stripe. Neither one stores care records.
Encryption. Traffic is encrypted in transit. The database and the backups are encrypted at rest.
Backups. Backups are made daily and kept for 30 days. No copy is held beyond 42 days.
Leaving ARC. You can ask for a full export at any time and for 30 days after you cancel. After that we delete your data from live systems, and from backups within 42 days.
Website analytics. Our public website uses Umami, which we run ourselves on our own AWS account in London. It sets no cookies. It is not used inside ARC.
Contracts. Our Data Processing Agreement is at /data-processing-agreement. Our wider security position is at /data-security.
Processors of your data
These providers handle your data, which can include care records. Each one is bound by data protection terms.
| Provider | What it does | Data it handles | Where | Safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Hosts the application servers and the database. Stores uploaded documents. Holds encrypted daily backups. | All data you enter into ARC, including care records and uploaded documents. | London (eu-west-2) | UK region. AWS data processing terms. |
| AWS: Amazon Bedrock | Runs the AI features that draft summaries. | Text from the record you ask it to summarise. Names and identifiers are replaced before it is sent. The model runs inside AWS. No AI company outside AWS receives the text. | London (eu-west-2), in region only | UK region. AWS data processing terms. |
| AWS: Amazon Transcribe | Turns spoken notes into text. | Audio of spoken notes. The audio sits in a London storage bucket while the job runs and is deleted when it finishes. AWS does not use the content to improve its services. | London (eu-west-2) | UK region. AWS data processing terms. AWS AI-services opt-out set. |
| AWS: Amazon SES | Sends email from ARC. | Recipient email addresses and the content of emails ARC sends for you. Incident notifications include the child's initials and incident details. | London (eu-west-2) | UK region. AWS data processing terms. |
| Laravel Forge | Manages our servers. It holds the keys that let it log in to them. | Does not handle care records in normal running. It has no routine access to your data. | United States | UK International Data Transfer Agreement (IDTA). |
| Stripe | Takes card payments for your subscription. | Billing contact and card details. No care records. | Outside the UK | Stripe data processing agreement. |
Services for ARC's own business
These services help us run ARC as a company: sales, marketing, research and the free tools on our website. None of them receives your care records or any other customer data.
| Provider | What it does | Data it handles | Where | Safeguard |
|---|---|---|---|---|
| Google (Gmail and Search Console) | Our sales mailbox and our search performance reports. | Business contact details of prospects. Search statistics for our website. | Outside the UK | Google data processing terms. |
| Calendly | Books demo calls on our demo page. | The name, email and chosen time of a person who books a demo. | Outside the UK | Calendly data processing terms. |
| OpenAI | Helps draft sales and website content. | Public business information about prospects and our own marketing text. No customer data. | Outside the UK | OpenAI data processing terms. |
| Brave Search and Adzuna | Find public information on care providers, such as websites and job adverts. | Search terms. Public information. | Outside the UK | Provider terms. |
| Companies House, planning.data.gov.uk, data.police.uk and postcodes.io | Public data about companies, planning, local crime and postcodes. | Company numbers and postcodes. The location assessment tool sends only a postcode, never a child's details. | United Kingdom | Public UK data services. |
| Ordnance Survey and Overpass (OpenStreetMap) | Map and place data for the location assessment tool. | A postcode or map area. | United Kingdom and Europe | Provider terms. |
How we tell you about changes
Before we add or replace a provider that handles customer data, we update this page and email the admins of each company. We do this at least 30 days before the new provider starts, as our Data Processing Agreement says.
If you object on data protection grounds, tell us in that time. Section 5 of the Data Processing Agreement explains what happens next.
This list was last reviewed on 7 November 2026.
Questions about who handles your data? Contact us at privacy@arccare.co.uk.
Other legal pages: Terms of service · Privacy policy · Data security · Sub-processors