Last updated: 15 October 2026
SOP Care is built for regulated health and care services, so we keep the way we handle your data simple and clear. This page sets out who is responsible for what, where your data is stored, and which providers help us run the service.
Who is responsible for your data
Your organisation is the controller. Your pharmacy, care home or dental practice decides what goes into SOP Care: staff, locum and agency worker names, roles and contact details, SOP sign-offs, check records and corrective actions.
Aleph Logic is the processor. We store and process that data only to provide SOP Care to you, only on your documented instructions, and under our Data Processing Agreement, which forms part of our Terms of Service.
For the details you give us to set up and pay for your account (such as the account administrator’s name and email, and billing records), Aleph Logic is the controller. Our Privacy Policy explains how we use that information.
What SOP Care is designed to hold
SOP Care holds staff and compliance records. It is not designed to hold patient or resident records, and you should not enter names, NHS numbers or health information about patients or residents. Checks and corrective actions can be recorded without identifying anyone in your care.
Where your data is stored
- Hosting: the SOP Care app, its database and this website run on servers in the United Kingdom.
- Backups: backups are stored by our hosting provider in Germany (EU). The UK recognises the EU as providing adequate protection for personal data.
- Encryption in transit: all connections to sop-care.com and app.sop-care.com use HTTPS.
- Access: every user has their own login, access is limited by role, and changes to SOPs, sign-offs and checks are recorded in an audit trail.
Subprocessors
These providers process data inside SOP Care on our behalf. Each is bound by written data protection terms.
| Provider | What they do | Where data is stored |
|---|---|---|
| Hostinger International Ltd | Hosting of the SOP Care app, database and website; backups; email for sign-in details and notifications | United Kingdom (servers); Germany (backups) |
These payment providers handle billing for your subscription. They act as independent controllers of payment information and do not have access to the data inside SOP Care. We never see or store full bank or card details.
| Provider | What they do | Where data is processed |
|---|---|---|
| GoCardless Ltd | Direct Debit mandates and payments | United Kingdom and EU |
| PayPal | PayPal and card payments | UK and EU; may transfer data outside the UK under PayPal’s own safeguards |
We will give account administrators at least 30 days’ notice by email before we add or replace a subprocessor, so you can raise any objection.
Your requests
You can export or delete your organisation’s data at any time by contacting support@sop-care.com. When you cancel, we keep SOP Care data for up to 12 months so you can restart, then delete it, unless you ask us to delete it sooner. If we become aware of a personal data breach affecting your data, we will tell you without undue delay.
Contact
Aleph Logic, a trading name of Aleph Healthcare Ltd
[Business address to be added]
Questions about data protection or security: support@sop-care.com