Privacy policy
How we use your information
Last updated: 15 October 2026
Bridgit Care supports carers and other people through digital tools and partner services. This privacy notice explains what personal information we use, why we use it, who we share it with, how long we keep it and how you can exercise your rights.
This notice applies across our websites, applications, AI coaches, embedded tools, assessments, support plans, referrals and communications, including telephone, WhatsApp, SMS and email where available. All our coaches are covered by the same privacy requirements. Information shown when you choose a particular service supplements this notice where an additional feature or partner arrangement needs explaining. Staff receive separate information about employment records.
1. Who is responsible for your information
Bridgit Care is a trading name of Upstream Outcomes Ltd, company number 09347278. Our address is Ergo, Bridgehead Business Park, Meadow Road, Hessle, HU13 0GD, United Kingdom. You can contact our privacy team at contact@bridgit.care or +44 (0)3455 481 654.
Bridgit is normally the independent controller of information you enter into our platform. This means we decide how and why it is used. A partner funding or providing access to the service does not automatically receive access to your identifiable support records.
Some services involve a partner that jointly decides the purposes and means of processing with us. Where we act as joint controllers, the applicable service information explains the organisations involved, the main responsibilities in their arrangement and how to exercise your rights with either organisation. In a specific service where we process information only on another controller’s instructions, that organisation’s notice explains its purposes and our role. The actual arrangement for your service determines the responsibilities.
2. The information we collect
We collect information relevant to the service you choose. This can include:
- Identity, contact and account details: your name, contact information, age or date of birth where needed, postcode, sign-in information and communication or accessibility preferences.
- Caring circumstances and support needs: your caring role, household, employment or financial circumstances, goals, needs, assessment answers, support plans, tasks, referrals and progress.
- Health and other sensitive information: health, disability, wellbeing, ethnicity or other special-category information where relevant and lawfully provided for your support.
- Conversations and correspondence: messages, AI replies, transcripts, voice information where you choose a voice feature, requests for help, complaints, feedback and correspondence with our team.
- Information about other people: relevant details about a person you care for, family member, emergency contact or professional involved in support.
- Technical and service records: IP address, device and browser details, sign-in and service activity, security and diagnostic records, and records of consent or preferences. Technical records may contain information sent with a request.
- Other information you choose to provide: documents or media needed for a particular tool, research or survey responses, business enquiries and recruitment information.
You can use some information and support routes without creating an account. Features such as saving a plan, receiving a message or making a referral may need particular details. We explain what is required when collecting it. If you do not provide information needed for a feature, we may be unable to provide that feature.
3. Where information comes from
Most information comes directly from you when you register, complete a form, use a coach or other tool, communicate with us or choose to share information. We also create records when operating the service, including support activity, generated responses and security records.
We may receive information from a referring organisation, an authorised professional, a person involved in your care or an integration you use. The referring organisation must have a lawful basis for sharing it. Where information comes from another source, we explain its source, purpose and use when required by data protection law, unless a lawful exception applies.
4. Why we use information and our lawful bases
We identify a lawful basis for each use of personal information. The main purposes and bases for services we control are set out below. Where consent is used, it is a specific choice that you can withdraw. Using our website or accepting our Terms does not give blanket consent to every use of your information.
| Purpose | Lawful basis |
|---|---|
| Create and manage an account, provide requested digital support, save plans and deliver features you request under our Terms. | Performance of a contract, or steps you request before entering one, under Article 6(1)(b) UK GDPR, where the processing is necessary for that service. |
| Answer enquiries and provide support outside a contractual service. | Our legitimate interests under Article 6(1)(f) in responding to people seeking help and operating our services, balanced against their rights and reasonable expectations. |
| Personalise guidance, support plans and recommendations using the information you provide. | The requested service under Article 6(1)(b), or legitimate interests under Article 6(1)(f) where personalisation forms part of non-contractual support. Sensitive information also needs a separate condition described below. |
| Send necessary account, service, support or security messages. | The requested service under Article 6(1)(b), or our legitimate interests under Article 6(1)(f) in providing relevant operational communications. Optional check-ins and other communications use consent where required. |
| Make an optional referral, share a plan or send information to an organisation you choose. | Your consent under Article 6(1)(a) where we ask for that choice. A different basis applies only where a legal obligation or another identified lawful purpose requires the sharing. |
| Send optional marketing or enable optional advertising measurement. | Your consent under Article 6(1)(a), together with any consent required by the electronic communications rules. Service communications are handled separately from marketing. |
| Maintain security, prevent misuse, diagnose faults, review service quality and handle complaints or legal claims. | Our legitimate interests under Article 6(1)(f) in protecting users, maintaining reliable services and resolving problems, or a legal obligation under Article 6(1)(c) where a specific duty applies. |
| Meet accounting, regulatory or other legal obligations. | Compliance with a legal obligation under Article 6(1)(c). |
| Manage recruitment, business enquiries and partner relationships. | Steps requested before an employment or other contract under Article 6(1)(b), legitimate interests under Article 6(1)(f) in managing applications and professional relationships, or a legal obligation where applicable. |
A partner delivering a statutory or jointly controlled service may have a different lawful basis, such as a public task. Its involvement does not automatically give Bridgit the same basis. The information for that service identifies the relevant controller arrangement and the basis for its processing.
Before relying on legitimate interests, we consider the purpose, whether the information is necessary and the effect on the people involved. You can ask us about this assessment and object to processing based on legitimate interests.
5. Health information and information about other people
Caring circumstances can reveal health or other special-category information about you or somebody else. We use relevant personal context to provide support; it is not automatically anonymised before being processed for that purpose. We limit the information requested and who can access it.
Special-category processing needs both a lawful basis under Article 6 and an additional condition under Article 9 UK GDPR. For optional health or wellbeing information used to personalise support, we ask for explicit consent under Article 9(2)(a). We explain the purpose when asking. You can decline or withdraw that consent, although this may limit support that depends on that information. Another condition is used only where it genuinely applies, for example information necessary for legal claims, or a qualifying safeguarding or emergency purpose.
Please share only the information about another person that is needed for your support. Do not assume that being their carer gives you authority to consent on their behalf. Where identifying information is needed, we must have an appropriate basis and condition for using it and consider that person’s information rights. We may ask you to use a general description, obtain appropriate authority or use another support route.
Where there is a serious risk to someone’s safety, information may need to be used or shared with an appropriate organisation where the law permits it. Safeguarding or emergency processing must have a specific lawful basis and, for sensitive information, the relevant additional condition. In an emergency involving someone unable to consent, vital interests may apply. These provisions do not provide a general basis for routine collection or sharing.
6. AI coaching and automated processing
Our AI features use information relevant to your request to generate guidance, search for useful resources, summarise information, suggest next steps and help create support plans. Personalisation may involve identifying likely needs or matching information and services to your circumstances. This can involve automated analysis of your answers and conversations.
Information needed for a response is processed by our platform and the AI or speech providers used for the feature. If you choose voice, audio may be processed for speech recognition and spoken replies. The information provided with a voice or recording feature explains any audio recording and conversation storage before you choose to use it. If you request an email copy, referral or other delivery action, the relevant recipient and communications provider also receive what is needed for that action.
The same requirements for purpose, minimisation, lawful processing, access, retention and users’ rights apply across our coaches. A change to the subject or name of a coach does not create permission to use information for an unrelated purpose. We do not use identifiable support conversations to build general-purpose AI training datasets.
AI can produce inaccurate, incomplete or unsuitable information. It supports your choices and does not replace professional advice. We do not use AI alone to decide entitlement to benefits, eligibility for a statutory service, clinical care or other matters with legal or similarly significant effects. Those decisions remain with the responsible person or organisation. Do not rely on an AI conversation for an emergency response or assume that a care professional is monitoring it.
7. Who can receive your information
Access within Bridgit is limited to people who need information for their role, such as providing support, maintaining the service or handling a privacy request. We use contracted providers for hosting, storage, AI and speech processing, communications, security and other functions needed to operate the service. Providers must process information for agreed purposes under appropriate terms, with access and security controls.
We share information with a support organisation or professional when you request a referral or other sharing, or where another lawful basis applies. The information shared must be relevant to the stated purpose. An organisation receiving a referral as an independent controller is responsible for its subsequent use under its own notice.
Partners and commissioners normally receive aggregated or anonymised information about service use. Access to identifiable support information requires a separate, documented lawful arrangement and appropriate transparency. Simply sponsoring access to Bridgit does not entitle a partner to read individual conversations or support records.
We may also disclose relevant information to professional advisers, regulators, courts or other authorities where necessary for a legal obligation, a lawful investigation, the protection of rights or a qualifying safeguarding purpose. We do not sell personal information or share it for another organisation’s own marketing.
8. Where information is processed
Our core platform hosting uses Microsoft Azure in the United Kingdom and European Union. Our AI agents are configured to use our custom language model hosted through Microsoft Azure in the UK to generate their responses, including when you interact through a voice service.
Some features also use external voice and conversation services. These services currently store or process information outside the UK and EU, including in the United States. Depending on the feature you choose, this can include audio, transcripts and the conversation context needed to provide a response. This processing is separate from the location of the Azure language model.
International processing is subject to the applicable provider data-processing and transfer terms. These may include standard contractual clauses and the UK Addendum, or another transfer mechanism recognised by UK data protection law. The relevant safeguard depends on the provider and transfer. You can contact our privacy team for information about the recipients, processing locations and applicable safeguards, including how to obtain a copy of relevant transfer safeguards.
9. How long information is kept
We decide retention by the purpose and type of record, the service arrangement and any legal requirements. We do not keep information simply because it may be useful in future. The same retention governance applies across coaches and service providers.
| Record | Retention approach |
|---|---|
| Account and support records | Kept while needed for the service. Our standard platform baseline is up to six years from account closure or the last meaningful activity. Information may be deleted sooner where no longer needed or where a valid erasure request applies. |
| Information governed by a particular partner agreement | The lawful, agreed schedule for that service applies where it differs from the general baseline. The applicable service information explains the difference. |
| Voice recordings and separately stored conversation history | Kept for the agreed service purpose and applicable retention arrangement. Any additional recording or storage arrangement, including longer retention or storage without automatic expiry, must be explained when the feature is offered, with a route to request deletion. |
| Consent and preference records | Kept only as needed to show the choice and respect it. Separate minimal consent receipts are kept for up to six years. A minimal suppression record may be needed to prevent further unwanted communications. |
| Unsuccessful recruitment applications | Normally up to six months. Successful applications become part of employment records under the relevant workforce arrangements. |
| Research, surveys and time-limited projects | The period explained for that project. Properly anonymised results may be retained for research or reporting. |
| Financial and contractual records | For the period needed to meet accounting, legal or claims requirements, normally six years for relevant financial records. |
| Technical and security records | For the period needed for operation, fault diagnosis, security or a specific incident or claim. We assess the content, sensitivity and purpose when setting the applicable schedule. |
When information is due for deletion, we remove it from live systems or anonymise it so that it can no longer reasonably identify a person. Backup copies expire through the controlled backup lifecycle, which can take up to 12 months under our standard arrangements. Any necessary restoration must preserve applicable deletion requirements. Provider copies must be addressed through the applicable deletion and backup arrangements.
If information must be retained for a legal obligation, an active dispute or another lawful exception, we explain the reason when responding to a deletion request. Contact us if you would like the retention arrangements for your service explained.
10. Cookies and similar storage
Our websites and applications use cookies or similar browser storage for necessary functions, such as sign-in, security and remembering privacy choices. Optional advertising measurement is kept off unless you accept it. You can decline optional measurement and continue using the service.
Where you arrive at a Bridgit app through a Google advertisement, the app can recognise the ad reference and offer an advertising-measurement choice. If you accept, the measurement service may receive an ad reference, technical information and relevant activity, such as a successful login. Names, email addresses, account identifiers and support conversations are not included in the app’s login measurement event. Advertising measurement is separate from providing your support.
The cookie that remembers your advertising preference lasts for up to six months and can be read across Bridgit subdomains. On the main website, use Cookie settings in the footer to review or change your choice. In an app, you can remove the stored preference through your browser settings and make a fresh choice when next offered. Your browser can also restrict or remove cookies, although blocking necessary storage may affect some functions.
11. Communications and marketing choices
We use the details and channel you provide to deliver requested support and relevant service messages. Messages appearing on a shared device or in a shared inbox can reveal that you use a support service, so choose contact details and settings that are safe for you. Optional summaries or referrals are sent only through the choices explained for that feature.
We obtain consent for optional marketing where required. You can unsubscribe using the message’s instructions or contact us. A marketing opt-out does not prevent a necessary account, security or service message relating to a service you continue to use.
12. Children and young people
Some partner services support young carers aged 13 to 17. The service information explains who the service is for. We give particular weight to children’s best interests, use information relevant to their support and provide explanations appropriate to their age. Privacy, sharing and safeguarding arrangements must take account of their needs and the risks involved.
Using a service does not automatically give a parent, school, commissioner or other organisation access to a young person’s information. Any sharing needs an appropriate basis and must consider the young person’s rights, understanding and safety. We do not use a child’s caring or health information to create advertising profiles.
13. Your rights and choices
Depending on the circumstances, you can ask us to:
- explain how your information is used and provide access to it;
- correct inaccurate or incomplete information;
- delete information where the right to erasure applies;
- restrict its use while a relevant concern is considered;
- provide a portable copy of information you supplied where processing is automated and based on consent or contract;
- consider an objection to processing based on legitimate interests, and stop direct marketing when you object; or
- withdraw consent for future processing where we rely on it.
Withdrawing consent does not affect processing that was lawful before withdrawal. It can affect a feature that needs the information concerned. Some rights have legal limits; if we cannot meet a request in full, we explain why and what options remain.
Send a request to contact@bridgit.care. We may ask for proportionate information to verify identity or understand the request. We normally respond within one month, subject to the time limits and extensions permitted by law. Where extra time is permitted and needed, we explain the reason. You can contact either controller where a joint-controller service applies.
14. How we protect information
We use technical and organisational safeguards appropriate to the information and risks. These include controlled access, authentication, encryption, separation of organisation data, monitoring, backups, staff checks and guidance, access reviews, security testing and independent assurance. We review changes to our services and suppliers for privacy and security risks.
Online services cannot be guaranteed completely secure. If an incident creates a requirement to notify you or a regulator, we follow the applicable legal requirements. You can report a privacy or security concern through our contact details below.
15. Complaints and contact details
For questions, rights requests or complaints, email contact@bridgit.care, call +44 (0)3455 481 654, or write to Privacy Team, Upstream Outcomes Ltd, Ergo, Bridgehead Business Park, Meadow Road, Hessle, HU13 0GD, United Kingdom.
You can also complain directly to the Information Commissioner’s Office, the UK data protection regulator. You do not have to complete our complaints process before contacting it.
16. Changes to this notice
We review this notice when our services, processing or legal requirements change. The latest version and update date are available on this page. Where a change materially affects how we use your information, we provide appropriate information before the new processing starts and obtain a new choice or consent where needed.