Terms of Service

1. Scope of Service & Clinical Responsibility

CantraCare provides cloud software for resident admission, care planning, electronic Medication Administration Records (eMAR), physiological observations (NEWS2), risk assessments, and workforce scheduling. Clinical decision-making tools (including NEWS2 scoring and escalation prompts) are decision-support aids aligned with Royal College of Physicians (RCP) and NHS DCB0129/DCB0160 clinical safety standards; they do not replace professional clinical judgement or emergency medical escalation (999/111).

2. Incorporation of the UK GDPR Article 28 Data Processing Agreement (A-02)

Where the Customer uses CantraCare to process personal data and special-category health data of residents, relatives, and staff, the Customer acts as the Data Controller and CantraCare acts as the Data Processor. Our UK GDPR Article 28 Data Processing Agreement (DPA) is incorporated by reference into these Terms of Service and becomes legally binding upon tenant onboarding and acceptance.

3. Access Control, Multi-Factor Authentication & Tenant Isolation

• Mandatory MFA: Multi-Factor Authentication (TOTP) is mandatory for all `SuperAdmin`, `Admin`, and `Manager` accounts, and may be enforced across all `Nurse` and `Carer` accounts via Tenant Organisation Settings.
• Account Security: Customers must ensure each staff member uses an individual named account and immediately deactivate accounts upon termination of employment.
• CQC Inspection Access: Customers are responsible for verifying CQC Inspector identity before issuing read-only inspection exports or audit reports.

4. Offboarding, Data Return & Statutory Retention

Upon subscription termination, the Customer may export all resident care records, eMAR charts, and audit logs in structured JSON and PDF formats for 30 days. Thereafter, CantraCare will delete or irreversibly anonymise Customer data except where statutory retention is mandated under UK law.

5. Governing Law & Jurisdiction

These Terms of Service and the incorporated DPA are governed by and construed in accordance with the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.