Kinto holds sensitive information about the people in your care. Here are the basics. They don’t replace legal advice or your own data protection policies.
Who is responsible for what
- Care records in the workspace (residents’ details, observations, medicines, incidents and so on) belong to your care home. You’re the controller; Kinto is your processor and only uses them on your instructions, under a data processing agreement.
- App accounts and conversations with Sarah belong to the person using the app. Kinto is the controller for those. Our privacy policy explains what we collect, which providers process it and how long we keep it.
Before you go live
- Sign our contract and data processing agreement.
- Complete or update your data protection impact assessment (DPIA) to cover Kinto and AI conversation. We can share information to help.
- Update your privacy notice for residents and families to mention Kinto.
- Agree how long records should be kept, and what happens to them if you stop using Kinto.
Every day
- Only invite people who need access, with the lowest role that works. Remove leavers on their last day.
- Everyone uses their own account. Never share passwords, codes or recovery codes.
- Record facts, not opinions, and only what’s needed for care.
- Never email residents’ details to Kinto support. Describe the page and the problem instead.
- If you think there’s been a data breach, follow your breach procedure and email support@kinto.you straight away.
Where to find our policies
Still stuck, or spotted something that doesn’t match what you see? Email support@kinto.you and tell us which page you were on. Please don’t include residents’ personal or medical details.