Privacy Policy

What This Policy Covers: This policy applies to both of the products below unless a section says otherwise.

• Bridge — our referral management platform for children’s residential care, used in your browser at bridge.elyndra.co.uk

• The Bridge Referral Importer — an optional browser extension that puts a referral from a commissioning portal into your Bridge inbox, described in its own section below

Introduction: Empower Aid Technologies Ltd (“Elyndra”) is committed to protecting personal data privacy. This policy outlines how we collect, process, and manage data in compliance with UK GDPR, the Data Protection Act 2018, and ICO guidelines, in connection with the products listed above.

What Data We Collect:

• Personal information (name, contact details, role) of care provider staff and users of the Bridge platform

• Referral information relating to children and young people, including special category data (health, safeguarding, and welfare information) shared with care providers as part of the placement referral process

• Usage data and decision reasoning captured within the platform to support audit, accountability, and service improvement

Why We Collect Data:

• To provide care providers with a structured platform for receiving, assessing, and responding to placement referrals

• To support safer, more accountable placement decisions through structured risk intelligence and decision capture

• To meet our contractual obligations to care provider customers and support their regulatory and safeguarding duties

How We Handle Your Data:

• Data is hosted within UK/EU regions on secure Microsoft Azure infrastructure

• Retention periods are set by each customer, and personal data is irreversibly anonymised no later than 180 days.

• Personal data is processed only for the purposes described in this notice and our agreements with customers

Data Sharing and Third Parties:

• Microsoft Azure (UK and EU regions): secure cloud hosting, databases and file storage

• Microsoft Azure OpenAI (EU data zone): structured analysis of referral content within Bridge. This processing stays within the EU, and no personal data is used to train models.

• Microsoft Azure Communication Services (UK): sending email notifications from Bridge

• Auth0 by Okta (UK and EU): secure sign-in for Bridge users

• Sentry (EU, Germany): error monitoring, so we can find and fix faults quickly

• Records of our AI processing are kept in a system we run ourselves inside our own Azure environment. No outside company receives them or has access to them.

• Any additional sub-processors will be notified to customers at least 30 days in advance and listed in our processor schedule, and customers may object.

• The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

The Bridge Referral Importer Browser Extension:

• An optional browser extension for teams who already use Bridge and receive referrals through a commissioning portal. It puts a referral into your Bridge inbox so you do not have to copy it across by hand; a Bridge account is required to use it

• It sends information to Bridge only when you click its button and confirm what to send: the content of the referral page you are viewing (or only the part you have highlighted), the documents you tick, and four details you confirm — the child’s initials, gender, age and council

• It does not ask for or record the child’s name; a child is identified by their initials

• It stores your Bridge sign-in, and any referral you are part-way through sending, on your own computer only. Both are private to the extension and cannot be read by any website

• It reads a page only when you click its button, and only the page you are viewing. It has no access to your other tabs, does not run in the background, and holds no ongoing access to any website

• It never sees or stores your portal username or password. Documents are collected using the connection you are already signed in with, so the portal controls what you are allowed to see

• It contains no tracking, analytics or advertising, and does not record which pages you visit or what you do in your browser

• Information the extension sends goes to Bridge and nowhere else, and once there is handled as described elsewhere in this policy. Removing the extension deletes your sign-in and anything it stored on your computer, but does not delete referrals already sent to Bridge

Your Rights:

• Request access to your personal data

• Request correction or deletion of your data

• Object to or restrict certain processing activities (subject to operational and legal feasibility)

• Request your data in a portable format

• Lodge a complaint with the Information Commissioner’s Office (ico.org.uk)

Where Elyndra acts as a data processor on behalf of a care provider customer, requests relating to children, families, or third-party data subjects should be directed to the relevant care provider as the data controller.

Security Measures:

• Encryption of data at rest and in transit

• Role-based access controls and authentication requirements

• Regular security reviews and vulnerability testing

ICO Registration:

• We are registered with the Information Commissioner’s Office (reference: ZB871667)

Contact Information: For privacy inquiries, access requests, or complaints, contact: marcus(at)elyndra(dot)co(dot)uk