GDPR-safe AI for care teams

The problem

Care workers write a lot. Daily notes, care plans, incident reports, safeguarding forms. Documentation eats something like a tenth to a third of every shift, and the temptation to paste a rough note into a consumer AI tool and ask it to tidy it up is enormous. Many do, on their own phones, during shifts.

Every time that happens, a resident's name, medication list and address leave the organisation for a server the provider has no agreement with. Under UK GDPR that is a breach. Under the data security standards care providers now have to meet, it is a hole an assessor can drive a bus through. Telling staff not to do it is a policy, not a control.

What it does

Caredact sits between the person and the AI. The worker writes the note as they normally would. Before anything is sent to a language model, Caredact detects and removes the personal data: names, NHS numbers, dates of birth, addresses, medication details, the lot. The AI works on the anonymised text, and the result is put back together for the worker to review.

• Works in the browser, nothing to install, staff can start in under a minute.
• Every session is logged, so a manager has an audit trail to show an inspector or a data-protection officer.
• Personal data is deleted on a schedule the provider sets, and never stored longer than it needs to be.
• Built for the workflows that actually exist: care notes, care plans, incident and safeguarding reports, and the fostering and children's-services paperwork that sits alongside them.

How it's built

Detection is layered rather than trusting one model. Pattern matching catches the structured things like NHS numbers and postcodes. A transformer model trained on personal-data recognition catches names and the free-text identifiers, and a zero-shot entity model picks up the categories that appear in care records specifically. Anything the layers disagree on is treated as personal data, because the cost of a false negative is a breach and the cost of a false positive is a slightly over-cautious redaction.

Everything runs inside the UK data boundary. The application and its database sit in Azure's UK South region, and the AI inference runs on Azure OpenAI in the same region under a managed identity, so there is no API key to leak and no data leaving the country to be inferred on.

Where it is now

Caredact is live at caredact.com, with a free pilot open to a small number of care providers, and is being put in front of home-care agencies, residential homes and supported-living providers across England.