DoseScan is operated by DoseScan Ltd, a company registered in England and Wales. Our registered address is Liverpool, United Kingdom. We provide digital medication administration record (MAR) software to UK care providers — including supported living services, residential care homes, and domiciliary care organisations.
When this policy refers to "DoseScan", "we", "us", or "our", it means DoseScan Ltd.
If you have questions about this policy, contact us at hello@dosescan.co.uk.
We collect the following categories of personal data:
Organisation data: Company name, registered address, care type, CQC registration details, and billing information provided during account setup.
Administrator data: Name, email address, and login credentials of the care organisation's admin users.
Staff data: Staff names and the 6-digit passkeys generated for mobile app access. We do not store passwords in plaintext.
Resident data: Full names, room numbers or addresses, and medication schedules. This is sensitive health-related data and is handled with the highest level of care. We do not store medical diagnoses or clinical notes.
Medication records: Every medication administration event recorded by staff — including the medication name, dose, time, status (given/missed/refused), and the staff member who recorded it. These records form the digital MAR sheet.
Device data: Device identifiers for registered mobile devices used to access the platform.
Technical data: IP addresses, browser type, and usage logs collected automatically when you use our web dashboard.
We use the data we collect to:
Provide the DoseScan platform — processing medication records, generating MAR sheets, sending stock and missed-dose alerts, and enabling the dashboard and mobile app to function.
Maintain the security and integrity of the platform — including authenticating users, validating device access, and detecting unusual activity.
Communicate with you — responding to support requests, sending service notifications, and (where you have agreed) sending product updates.
Comply with our legal obligations — including data retention requirements under UK law.
We do not use your data for advertising, and we do not sell it to third parties.
Under UK GDPR, we rely on the following lawful bases:
Contract: Processing necessary to deliver the DoseScan service under our Terms of Service — this covers the core platform functionality.
Legitimate interests: Technical data collected to maintain platform security and improve reliability, where this does not override your rights.
Legal obligation: Retaining records where required by UK law.
For the processing of resident data (which is special category data under UK GDPR due to its health-related nature), our lawful basis is Article 9(2)(h) — processing necessary for the provision of health or social care under a contract with a health professional, and/or your explicit consent provided during account setup.
All DoseScan data is stored on servers located within the United Kingdom and the European Economic Area. We use Supabase as our database infrastructure provider, with UK-region hosting configured.
We do not transfer personal data outside the UK or EEA except where necessary and covered by an appropriate transfer mechanism under UK GDPR.
Data is encrypted in transit (TLS 1.2 or higher) and at rest. Database-level encryption is applied to all stored data.
We retain your data for as long as your account is active and for a period after closure to meet legal obligations:
Medication records: Retained for a minimum of 3 years from the date of the record, in line with UK care sector regulatory guidance.
Account and staff data: Retained for 30 days after account closure, then securely deleted.
Resident data: Retained for 30 days after the resident is discharged or the account is closed, then securely deleted. You can request earlier deletion — see your rights below.
Technical logs: Retained for 90 days, then deleted automatically.
Under UK GDPR, you have the right to:
Access: Request a copy of the personal data we hold about you.
Rectification: Ask us to correct inaccurate or incomplete data.
Erasure: Request deletion of your data, subject to our legal retention obligations.
Restriction: Ask us to limit how we use your data while a complaint is investigated.
Portability: Receive your data in a structured, machine-readable format.
Objection: Object to processing based on legitimate interests.
To exercise any of these rights, contact us at hello@dosescan.co.uk. We will respond within 30 days. If you are unhappy with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
DoseScan is a professional platform for use by care organisations. We do not knowingly collect personal data from individuals under the age of 18 in any capacity other than as residents in the care of a registered care provider.
Resident data for individuals under 18 is processed under the same conditions as all resident data — for the sole purpose of recording medication administration — and is subject to the same retention and security controls.
We may update this policy from time to time. When we make material changes, we will notify account administrators by email and update the "last updated" date at the top of this page.
Continued use of DoseScan after a policy update constitutes acceptance of the revised policy.
Contact us at hello@dosescan.co.uk. We aim to respond within 2 business days.
You also have the right to raise a complaint with the Information Commissioner's Office (ICO) at any time.