Privacy notice

Mosaic Behavioural Intelligence (“Mosaic”, “we”, “us”) provides a behaviour recording and Positive Behaviour Support (PBS) platform for UK care providers. Registered company name, address and ICO registration number: to be confirmed on incorporation.

For workspace users’ account data we act as controller. For records about the people supported by a care provider, the care provider is the controller and Mosaic acts as its processor under a written data processing agreement (see our data processing terms).

• Account data — name, work email, role, organisation and sign-in records.
• Clinical recording data — pseudonymised service-user identifiers, ABC incident records, PBS plans, outcome measures, case notes and progress updates. This is special category (health) data. Mosaic never stores service users’ names or direct identifiers.
• Audit data — who viewed or changed which record and when.
• Technical data — device and browser information and security logs needed to keep the service safe.

Account data: performance of a contract and our legitimate interest in operating a secure service (UK GDPR Article 6(1)(b) and (f)).

Clinical data, processed on the care provider’s instructions: Article 6(1)(e) or (f) together with Article 9(2)(h) — provision of health or social care — and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.

Optional analytics: your consent, which you can withdraw at any time from Cookie settings.

To provide recording, PBS planning, analytics and reporting; to secure accounts and detect misuse; to keep a complete audit trail; and to provide support. AI-assisted pattern reviews are optional, restricted to Registered Managers, and produce observations for human review — never automated decisions with legal or similar effects.

We do not sell data. We use carefully selected sub-processors for hosting, email and AI processing, bound by contract to UK GDPR standards. Our aim is to store clinical data in the UK; until UK hosting is confirmed, providers should not enter real service-user data. Any restricted transfer is protected by the UK International Data Transfer Agreement or Addendum.

Clinical records are kept for 7 years after a service user’s discharge by default, or as the care provider instructs. Account data is kept while the account is active and up to 12 months after. Audit logs are kept for the life of the related records.

Encryption in transit and at rest, role-based access with organisation-level isolation, least-privilege permissions, full audit logging and pseudonymisation of service users. Personal data breaches are assessed promptly and reported to the ICO within 72 hours where required.

You have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent. Requests about care records should go to the care provider; we will assist them. Contact: privacy contact email to be confirmed.

You may complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

We will post updates here and notify workspace administrators of material changes.