Privacy & Data Protection Policy
Who we are
Data Controller for AmbuNet’s own business data (tenants, billing, CRM).
Our website address is: https://ambunet.co.uk. AmbuNet is a trading name of Care Nav Ltd – a private limited company registered in England Wales (12956613). We provide a secure, cloud-based software platform for healthcare and medical event management.
We are committed to protecting personal data and maintaining compliance with the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, and where applicable, NHS Data Security and Protection Toolkit (DSPT) and DCB0129 clinical safety standards.
This policy explains how AmbuNet collects, processes, and protects personal data.
Roles & Responsibilities
-
Care Nav Ltd (ICO: ZB229301)
Data Controller for AmbuNet’s own business data (tenants, billing, CRM). -
Tenant organisations
Data Controllers for their own employee, patient, and operational data stored within AmbuNet. -
AmbuNet (Care Nav Ltd)
Data Processor for tenant data. -
Data Protection Officer (DPO)
Luke Jones (contact@ambunet.co.uk)
Information we Process
AmbuNet stores and processes information on behalf of tenants, including:
-
Employee and applicant data: personal details, DBS checks, qualifications, employment and training records.
-
Patient and clinical data: demographics, medical and incident data (ePCR, safeguarding, clinical advice).
-
Event, client, and transport data: organisers, hospitals, shift details, resource allocation.
-
Governance and compliance data: policies, incidents, KPIs, medicines management.
-
Financial data: invoices, payments, and tenant billing details.
-
System and audit logs: access and activity logs for accountability and security.
AmbuNet also processes limited business data directly as controller (e.g., tenant account creation, subscription management, and communications).
Data Storage and Security
Hosting Provider – IONOS (UK)
Database – MongoDB hosted on AmbuNet’s IONOS(UK) Server
File Storage – AWS S3 (UK Region)
Backups – IONOS-managed, stored in the EU (UK adequacy ensured)
Encryption at rest – LUKS full-disk encryption
Encryption in Transit – All data transferred via HTTPS/TLS 1.2+
Tenant Isolation – Each Tenant has its own Database and S3 component
Password Protection – bcrypt hashing – raw passwords are not stored
MFA – Required for Dev Login and Access to Patient Data
Access Logging – All administrative access logged and justified
5. Sub-Processors
IONOS – Server hosting and backups – UK / EU (UK Adequacy Ensured)
AWS S3 – File and Image Storage – UK
ClickSend – SMS Delivery – UK
PostMark / Microsoft – Email Delivery – UK
Stripe – Billing and Payments – UK/EEA
Grafana/PM2 – Internal Monitoring – UK
Where data is processed outside the UK, this is only to countries covered by an adequacy decision or Standard Contractual Clauses (SCCs).
6. Data Retention
Employee / Applicant Data – 6 years after leaving (tenants may override)
Patient Data – 8 years after last contact
Governance and Clinical Records – 8 years
Financial Data – 7 years (legal minimum)
Audit Logs – 1 year
Tenant Databases – Archived until deletion confirmed
Tenants may request deletion or export of their database at any time.
7. Access and Administrative Controls
AmbuNet support staff may log in on behalf of a tenant user for technical support. Each access is logged with a justification and is never permitted for data requiring MFA (such as ePCRs).
8. Data Sharing
AmbuNet does not sell or share data with third parties. Limited information may be shared with sub-processors as listed above solely for system functionality.
9. Data Breach Response
In the event of a personal data breach, AmbuNet will:
-
Notify the affected tenant (data controller) immediately upon discovery.
-
Investigate and provide full details within 72 hours.
-
Cooperate fully with the ICO or relevant supervisory authority.
AmbuNet maintains a Data Breach Response Procedure and audit trail of all incidents.
10. Data Subject Rights
Data subjects may request access, correction, restriction, or deletion of their data.
Requests should normally be made to the tenant (the data controller).
For AmbuNet’s own data, requests can be made directly to: contact@ambunet.co.uk
11. Data Protection Impact Assessments (DPIA)
AmbuNet performs DPIAs for any new features that involve high-risk or special category data processing, in line with UK GDPR Article 35.
