Privacy Policy

Welma is an independent care management platform for Ofsted-regulated children’s residential homes in the United Kingdom. For the purposes of UK data protection law, Welma is the data controller for personal data collected through this website. Within the platform, the children’s home or provider using Welma is the controller of care records, and Welma acts as a processor on their behalf under a written agreement.

Through this website and when you contact us, we may collect:

• Contact details you give us, such as your name, work email, organisation and role.
• The content of enquiries and demo requests you send us.
• Basic technical and usage data, such as device and browser information, needed to keep the site secure and working.

Care records inside the Welma platform, including data about children in care, are governed by the agreement between Welma and the home using the platform, and by that home’s own privacy notices to the people it supports.

• To respond to your enquiries and arrange demos.
• To provide, maintain and improve the Welma platform and website.
• To keep the service secure, prevent abuse and meet our legal obligations.
• To send you information you have asked for. We do not sell your data.

We rely on your consent, our legitimate interests in running and improving the service, and the performance of a contract, as the lawful bases for processing, depending on the situation.

Welma is engineered to keep sensitive records safe. Data access is isolated at the database level, incident records are tamper-evident, and material actions are written to an audit trail. Connections are encrypted, and we apply per-user rate limits and modern security practices throughout. You can read more on our security page.

We share personal data only where necessary to run the service, for example with infrastructure, hosting and communication providers who act under contract and on our instructions. We do not share your personal data for advertising. Where data is processed outside the UK, we put appropriate safeguards in place.

We keep personal data only as long as we need it for the purposes above, or as required by law. Enquiry data is kept for as long as needed to deal with your request and a reasonable period afterwards. Care records within the platform are retained according to the instructions of the home that controls them.

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Ask us to correct data that is wrong or incomplete.
• Ask us to delete data, or restrict how we use it, in certain circumstances.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time where we rely on it.
• Complain to the Information Commissioner's Office (ICO).

This site uses the cookies needed to make it work and keep it secure, plus one optional analytics cookie you control. We do not use advertising cookies, and we do not share your data with advertisers. Fonts are self-hosted, so viewing the site does not send a request to a third-party font provider.

If you accept our analytics banner, we load Google Analytics to understand how the site is used, such as which pages are visited. This is off by default: it only runs after you actively accept, and you can decline or change your mind at any time. We do not use analytics for advertising, and IP addresses are anonymised. If you decline, no analytics cookie or script is loaded.

If you have a question about this policy, or want to exercise any of your rights, please get in touch. If you are unhappy with our response, you can raise it with the ICO at ico.org.uk.