Trine is operated by Purinode Ltd, a company registered in England and Wales under company number 17395630, with registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.
We are registered with the Information Commissioner's Office under reference ZC235279.
Our privacy lead is a director of Purinode Ltd. Contact [email protected] about anything in this notice.
Trine holds two different kinds of information, and our role differs between them.
Records your organisation keeps in Trine — staff files, recruitment and pre-employment checks, training records, compliance documents, incidents, safeguarding matters, resident information. For all of this, the care provider is the controller and we are only the processor. We hold it on their instructions and we do not decide what goes in it. If you are a member of staff, a job applicant, a resident or a relative, and you want to know what is held about you or ask for it to be corrected or deleted, contact the care provider, not us. If you contact us we will pass the request to them and tell you we have done so, but we will not confirm or deny what any provider holds.
Our processing of that data is governed by our Data Processing Agreement with the provider.
Information we hold in our own right — account and login details, billing records, support correspondence, and security logs. For this we are the controller, and the rest of this notice explains what we do with it.
| What | Why | Lawful basis |
|---|---|---|
| Name, work email, job title, care home and organisation | To create and run your user account and set your access level | Legitimate interests — providing the Trine service your organisation subscribes to, and running your account within it |
| Password (stored hashed), login timestamps, two-factor settings | To authenticate you and secure the account | Legitimate interests — authenticating users and keeping accounts secure |
| IP address, browser and device information, request logs | To keep the platform secure, detect misuse and diagnose faults | Legitimate interests — securing a platform that holds sensitive information |
| Records of what you did in the platform (audit log) | To provide an accountability trail your organisation and its regulator can rely on. Your organisation is the controller of this record and we keep it for it under the Data Processing Agreement; sign-in and other security entries are our own security records (row above) | Your organisation is the controller; we process this on its instructions under the Data Processing Agreement |
| Billing contact details, subscription and payment records, VAT information | To take payment and meet accounting and tax obligations | Legal obligation (accounting and tax records); legitimate interests in taking payment under our contract with your organisation |
| Support emails and correspondence | To answer your questions and improve the service | Legitimate interests — supporting our customers |
| Acceptance records: who accepted which document version, when, and from what IP address | To evidence agreement to our contractual terms | Legitimate interests in evidencing our contract with your organisation |
| Trusted-device security records: a hashed trusted-browser token, browser/user-agent information, IP address, creation, expiry, last-use and revocation information | To remember a successful two-factor authentication on a browser the user has chosen to trust, prevent misuse and allow the user to manage trusted browsers | Legitimate interests in securing accounts and the platform |
| Mobile app, when push notifications are enabled: the device's push token, its platform (iOS or Android) and its device name | To send your organisation's reminders to your phone, if you allow notifications | Your organisation is the controller; we process this on its instructions under the Data Processing Agreement (see section 2) |
| Mobile app: crash and error reports, with the technical details described in section 9 | To find and fix faults in the app and keep it secure | Legitimate interests — keeping the app working and secure. Reports do not include your name or account details, and record content is filtered out before they leave the device |
Our contract is with your organisation, not with you personally, so where we process your information for our own purposes we rely on legitimate interests rather than on a contract with you. Where we rely on legitimate interests, we have considered the impact on you and are satisfied our interest does not override your rights. You can ask us for that assessment.
We do not use your information for automated decision-making or profiling, and we do not sell it.
We use a small number of service providers. They act on our instructions and are bound by contract.
| Who | What for | Where |
|---|---|---|
| Microsoft Azure | Hosting the application, database and file storage | United Kingdom (UK South) |
| AC PM LLC (Postmark) | Sending transactional email such as invitations and password resets | United States |
| Stripe Payments Europe Ltd | Payment processing, where paid billing is enabled | Global, including the United States |
| Google Ireland Ltd | Our own business email, which is where support correspondence lands | European Economic Area |
| 650 Industries, Inc. (Expo) | Relaying push notifications to the mobile app. Only when push notifications are enabled | United States |
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications to Android devices. Only when push notifications are enabled | United States and global |
| Apple Inc. (Apple Push Notification service) | Delivering push notifications to iPhones and iPads. Only when push notifications are enabled | United States and global |
| Functional Software, Inc. (Sentry), a United States company | Crash and error reporting for the mobile app | Data stored in Sentry's European Union region (Germany) |
| Cloudflare, Inc. | Delivering and securing connections to Trine, and checking that forms are used by people rather than automated scripts (Turnstile) | Cloudflare's global network, normally the location nearest you |
Transactional email content is stored by Postmark for 45 days. We never send passwords by email, and access links are time-limited.
Stripe acts as an independent controller for payment card data. We do not receive or store full card details, and Stripe's own privacy notice governs that processing.
Transfers to the United States rely on the EU-U.S. Data Privacy Framework and its UK Extension, or on the UK International Data Transfer Addendum where that framework does not apply. We keep a transfer risk assessment and will share a summary on request.
For Turnstile, Cloudflare also uses limited technical signals, such as your IP address and browser details, as an independent controller to improve its bot detection. Its Turnstile Privacy Addendum explains how.
The current list of our sub-processors is maintained in Annex 3 of our Data Processing Agreement.
We will also disclose information where we are legally required to, or to establish or defend legal claims.
| What | How long |
|---|---|
| Account and authentication data | 12 months after the account is closed or the user is deactivated |
| Billing and accounting records | 7 years |
| Support correspondence | 3 years |
| Security and access logs we hold as controller, including sign-in and other security entries in the audit log | 12 months |
| Other audit log entries (held for your organisation) | 6 years from the event, or deleted with your organisation's data at the end of its contract, unless a legal hold applies. The audit log is append-only: entries are never edited |
| Trusted-device and related security records | 12 months after the trust or session ended, or sooner where the record is no longer required for security investigation or account management |
| Transactional email content held by Postmark | 45 days |
| Mobile app push registration (push token, platform, device name) | Until you sign out of the app. A registration the device stops accepting is marked inactive and deleted 90 days later |
| Mobile app crash reports held by Sentry | 30 days |
Our full approach is in the Data Retention Policy.
Data is hosted in the United Kingdom on Microsoft Azure and encrypted at rest. Connections are encrypted in transit using TLS 1.2 or above, including between our network provider and our servers, and unencrypted database connections are rejected. Access is role-based and enforced server-side. Two-factor authentication is available on user accounts; your organisation can require it for its users, and it is required for all Trine platform staff. Users may choose to trust a browser for a limited period after completing two-factor authentication; this never bypasses the password. Material actions are recorded in an append-only audit log.
Purinode Ltd holds Cyber Essentials certification, scoped to the whole organisation, certificate number 6fcde322-bedf-487a-839b-e6977a72f9ed, valid until 1 September 2027.
Fuller detail is in Annex 2 of our Data Processing Agreement.
We use cookies that are strictly necessary to run and secure the platform. They do not track you for advertising or analytics, and do not require your consent:
trine_refresh_token keeps you signed in and renews your session.trine_trusted_device remembers a browser you have chosen to trust after two-factor authentication.Both are HttpOnly, so scripts running in the page cannot read them; SameSite=Lax, so your browser does not send them with most requests started by other websites; and Secure, so they are only sent over encrypted connections. Requests that read or change your data are authorised by a short-lived token sent in a request header rather than by a cookie, which is our main protection against cross-site request forgery.
On the sign-up and password-reset pages, and on online job application pages where a care home uses them, Cloudflare Turnstile checks that a person rather than an automated script is using the form, and may set its own strictly necessary cookie to do so. Trine also uses your browser's local storage, which is not a cookie. It holds the short-lived sign-in token that is sent with each request to prove who you are, whether you asked to stay signed in, and which organisation you last signed in to with each email address. All of these are needed to provide the service you have asked for.
If we introduce analytics or any other non-essential cookie, we will ask for your consent first and you will be able to change your choice at any time.
You can ask us to give you a copy of the information we hold about you, correct it if it is wrong, delete it, restrict how we use it, or provide it in a portable format. You can object to processing we carry out on the basis of legitimate interests, and withdraw consent where we have relied on it.
To exercise any of these, email [email protected]. We will respond within one month. We may ask you to confirm your identity first.
Some of these rights are not absolute. Where we cannot do what you have asked — for example where we must keep billing records for tax purposes, or where an audit entry is the only evidence that a deletion took place — we will tell you why.
If you are unhappy with how we have handled your information, please tell us so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. You do not have to raise it with us first.
Trine has a mobile app for iPhone, iPad and Android phones (app identifier uk.trine.mobile). It is another way to use the same Trine service: it shows and updates the same information your organisation already keeps in Trine, under the same access rules, and the roles described in section 2 apply in the same way. The app does not create accounts; your organisation sets up your account, and you sign in with it.
What the app keeps on your device
Biometric unlock (optional). If you turn on Face ID, Touch ID or fingerprint unlock, the check is carried out entirely by your device's operating system. The app is told only whether the check succeeded. No biometric data is sent to Trine or stored by the app.
Push notifications (when enabled). Push notifications are switched off at present. Once they are switched on, and only if you allow notifications on your device, the app sends us your device's push token, its platform (iOS or Android) and its device name, so that we can send reminders to it. Notifications are relayed by Expo's push service to Google Firebase Cloud Messaging (Android) or the Apple Push Notification service (iPhone and iPad), which deliver them to your device. The visible text only says what kind of reminder it is, for example "You have an overdue action". It never includes a person's name or a record's details, because it can appear on your lock screen. Each notification also carries an in-app link, which can include a record number, and an identifier for the care home, so that tapping it opens the right screen. You can turn notifications off at any time in your device's settings. When you sign out, the app asks us to remove your device's registration. If that request does not complete (for example, because the device is offline), the registration may remain until you next sign in on that device or it stops accepting notifications.
Crash reporting. The app sends crash and error reports to Sentry so that we can fix faults. Reports are stored in Sentry's European Union data region and kept for 30 days. The app does not attach your name or account details to a report, and before a report leaves the device it removes the content of any request, sign-in and cookie headers, cookies, console logs, and record numbers in web addresses. When Sentry receives a report it also scrubs common sensitive fields, such as passwords, card numbers and email addresses, and it is set not to store the IP address the report came from. Reports still include technical details such as the app version, the device model and operating system, the error itself, and a pseudonymous installation identifier used to count crash-free sessions. Because these technical details can relate to a particular device, we treat crash reports as personal data. We do not use Sentry to measure performance.
What the app does not do. The app does not use analytics or advertising identifiers, and does not track you across other apps or websites. It does not access your location, contacts or microphone. It uses the camera only when you choose to take a photo to upload.
We may publish new versions of this notice. Each version is published at its own address and earlier versions remain readable. Where a change materially affects you, we will tell you.
The current version is always at https://trine.uk/legal/privacy.