Security & Data Protection Policy

1. Purpose and Scope

This policy describes how Aim Automations Ltd (“Aim”) protects customer data, including the personal data and health information that care providers process through Aim on behalf of the people they support and their staff.

It applies to:

• the Aim web app, the care worker mobile app and the Aim APIs;
• the infrastructure and sub-processors used to run them; and
• Aim’s own people and processes that touch customer data.

It is written for care providers, commissioners and regulators who need assurance about how Aim keeps data safe. It should be read with the Data Processing Agreement (UK GDPR) v1.3, which is the contractual commitment.

2. Roles and Accountability

3. Certifications and Standards

View certificate: NHS DSPT · Cyber Essentials Plus · ICO registration · Verify Cyber Essentials Plus on the IASME registry

4. Hosting and Data Location

Aim hosts production systems and customer care data in the United Kingdom.

Where a sub-processor handles limited data outside the UK, the transfer is covered by the UK International Data Transfer Agreement, or the Standard Contractual Clauses with the UK Addendum, and a transfer risk assessment (see section 9).

5. Encryption

6. Access Control and Authentication

• Role-based access on a least-privilege basis. Carers, seniors, managers, finance and family each see only what their role allows. Providers set roles and permissions themselves.
• Organisation structure. Access can be limited by branch and area, so staff see only the clients and colleagues they work with.
• Two-factor authentication is enabled for logins, and providers are strongly encouraged to require it for all users.
• Tenant separation. Each customer’s data is logically separated and enforced at the tenancy boundary, so no customer can see another’s data.
• Family access is by invitation only, and the provider controls what families can see.
• Leavers. Providers remove access themselves when someone leaves, and tell Aim of any account that should be closed.

7. Internal Access to Production Data

• Access to production systems is restricted to named Aim personnel who need it to run, support or secure the service.
• That access is logged and reviewed periodically.
• Everyone at Aim with access to personal data is bound by confidentiality obligations and completes data protection training.
• Aim never sells, rents or commercially exploits customer data, or uses it for any purpose other than providing and supporting the service.

8. Audit Logging and Monitoring

• Every record change, check-in override and approval is logged with who did it, what changed and when.
• The audit log shows what was done by AI (Aim Assist, Aim Agents and automated rules) separately from what was done by people.
• Access to personal data is logged and kept for investigation.
• Service health is checked every minute and published at status.weaim.io.

9. Sub-Processors

Aim uses the sub-processors below, each under a written contract with data protection terms equivalent to our DPA. We give customers at least 30 days’ notice of any change, with a right to object (DPA section 4).

10. AI and Data Protection

• AI features use OpenAI and Anthropic through their commercial APIs only, never consumer products such as ChatGPT or Claude.ai.
• Customer data is never used to train, fine-tune or evaluate any AI model, Aim’s or a provider’s.
• Only the minimum data a feature needs is sent. OpenAI processing runs under Zero Data Retention and a signed Business Associate and Healthcare Addendum. Anthropic processing runs under Anthropic’s Data Processing Addendum.
• Everything AI produces for the care record is a draft until a member of staff approves it. AI agents propose; people approve.
• Automatic review of care notes for safeguarding and dignity concerns runs only if the provider turns it on, and never changes the note.
• AI can be switched off by role, by user or for a whole account, and Aim works fully without it (AIM-AI-06).

Full detail is in the AI due-diligence pack, AIM-AI-01 to AIM-AI-06.

11. Backups, Availability and Business Continuity

The full plan, including outages, cyber attacks and the resilience work under way, is in AIM-BC-01 Business Continuity and Contingency Plan.

12. Incident Response and Breach Notification

Cyber attacks are always treated as major incidents: we isolate, secure, preserve evidence, report to the police and the National Cyber Security Centre where appropriate, and restore from known-clean backups (AIM-BC-01 section 5).

13. Data Retention, Return and Deletion

• Customer data is kept for as long as the customer agreement runs.
• On termination, the customer chooses whether Aim returns or deletes the data (DPA section 10).
• Data is kept for 6 months after termination so the customer can export it. A complete export is provided in standard machine-readable formats within 20 business days of request, free for a single export.
• On deletion, data is removed from production systems, and residual copies leave backups through normal rotation. Deletion is confirmed in writing on request.
• Aim never withholds a customer’s data as leverage in a dispute.

14. Data Subject Rights, DPIAs and Audits

• Aim helps providers respond to requests for access, rectification, erasure, restriction, portability and objection (DPA section 3.6).
• Aim supports providers’ data protection impact assessments with AIM-DP-01 Data Protection Impact Assessment and AIM-AI-05 DPIA Support Pack.
• Customers may audit Aim’s compliance once in any twelve months, and after any breach affecting their data (DPA section 7.2).

15. Customer Responsibilities

• Having a lawful basis for the data entered into Aim, and giving privacy information to the people it relates to.
• Managing users, roles and permissions, and removing access promptly when someone leaves.
• Making sure staff use secure devices and credentials, use two-factor authentication and never share logins.
• Meeting their own duties to the ICO, CQC, Care Inspectorate, Care Inspectorate Wales, RQIA and commissioners.

16. Review and Continuous Improvement

This policy is reviewed at least every 12 months, and after any major incident or significant change to the service. Planned improvements include ISO 27001 certification and the resilience work set out in AIM-BC-01 section 8.

Related Documents