Hollowmere Care Group - Security Questionnaire
Documentfinal Hollowmere Care Group: documents · security_questionnaire · final · 2026-02-25
BB-Demo's final answers to Hollowmere Care Group's security review, dated 25 Feb 2026, for the Enterprise tier. It states no availability percentage, P1 response time or price. Two open points remain on retention and commissioner wording.
What it says
What this says
Current to 11 Oct 26BB-Demo's final answers to Hollowmere Care Group's security review, dated 25 Feb 2026, for the Enterprise tier. It states no availability percentage, P1 response time or price. Two open points remain on retention and commissioner wording.
What it is: a security questionnaire prepared by Theo Gallagher, Solutions Engineer, for Hollowmere Care Group in Leeds. It covers hosting, access control, special category data, resilience and exit.
Commits: it says "The Enterprise availability service level applies, with service credits for availability and for data freshness." It also says "A nightly refresh completes before the start of your business day on business days." No figures are stated.
Unusual: it recommends "excluding clinical notes unless there is a stated need", which matters for a care operator. Residency can be fixed only through a dedicated add-on, otherwise the Snowflake account region decides.
Not settled: final retention settings for care-related sources and any regulator-specific wording from commissioners are still open. The document is not a contract, and the evidence does not show whether an order form followed.
As found in this document
Current to 9 Oct 26- AvailabilityThe Enterprise availability service level applies, with service credits for availability and for data freshness.The Enterprise availability service level applies, with service credits for availability and for data freshness. · Source: object_read:doc_023_002
- RefreshA nightly refresh completes before the start of your business day on business days.A nightly refresh completes before the start of your business day on business days. · Source: object_read:doc_023_002
- Severe issue responseThe Enterprise first-response commitment for the most severe tickets applies.The Enterprise first-response commitment for the most severe tickets applies. · Source: object_read:doc_023_002
The document
Body
Hollowmere Care Group - Security Questionnaire
Status: Final Prepared by: Theo Gallagher, Solutions Engineer, BB-Demo Prepared for: Hollowmere Care Group, Leeds Date: 25 Feb 2026 Tier under review: Enterprise
Purpose and scope
This questionnaire records BB-Demo's answers to the security review of Hollowmere Care Group, an operator of residential and nursing care homes across Yorkshire and the North East. The brain would give your teams one view of family and commissioner contact, incidents and fee invoices per home. Answers describe the Enterprise tier. Where a control is described, we can evidence that on request, and where an answer depends on your own configuration we say so.
Hosting and data location
Read the whole document (4,320 characters)
| Area | Question | Response | Evidence offered |
|---|---|---|---|
| Hosting | Where does the brain run and where is data stored? | The brain is built and run inside your own Snowflake account. BB-Demo does not keep a separate copy of your records in its own estate. | Architecture summary, on request |
| Residency | Can data stay in the UK? | Your Snowflake account region decides this. A dedicated residency add-on exists if you need it fixed contractually. | Order form wording, at proposal stage |
| Segregation | Is your data separated from other customers? | Yes. Each customer has its own deployment in its own Snowflake account. | Deployment description, on request |
Access control
| Area | Question | Response | Evidence offered |
|---|---|---|---|
| Sign-in | Is single sign-on supported? | Yes. Enterprise includes SSO and SCIM, so joiners and leavers follow your identity provider. | Configuration guide, on request |
| Privilege | How is administrator access limited? | Administrator rights are held by named people in your organisation. BB-Demo staff access is limited to the support and implementation work in the agreement. | Access policy extract, on request |
| Leavers | How quickly is access removed? | With SCIM in place, removal follows the change in your directory. Without it, your administrators remove access in the product. | Control reference supplied with the evidence pack |
Data protection and sensitive records
| Area | Question | Response | Evidence offered |
|---|---|---|---|
| Special category data | Can the brain hold care and incident data? | It can index the sources you connect. You decide which sources and fields are connected, and we recommend excluding clinical notes unless there is a stated need. | Connector scoping note |
| Encryption | Is data encrypted in transit and at rest? | Protection at rest is provided by your Snowflake account settings. Connections between systems use encrypted transport. | Control reference supplied with the evidence pack |
| Retention | Can we control how long data is kept? | Yes. Retention follows the rules set in your Snowflake account and in the agreement at exit. | Data processing terms, at contract stage |
Resilience and incidents
| Area | Question | Response | Evidence offered |
|---|---|---|---|
| Availability | What availability applies? | The Enterprise availability service level applies, with service credits for availability and for data freshness. | Service level schedule |
| Refresh | When is data refreshed? | A nightly refresh completes before the start of your business day on business days. | Service level schedule |
| Incidents | How would you tell us about a security incident? | We tell your named security contact directly and promptly, and we do not wait for a root cause before saying what we know. | Incident procedure, on request |
| Support | What response applies to a severe issue? | The Enterprise first-response commitment for the most severe tickets applies. | Service level schedule |
Exit
| Area | Question | Response | Evidence offered |
|---|---|---|---|
| Exit plan | What happens if we leave? | Your data stays in your Snowflake account, so there is nothing to retrieve from BB-Demo. BB-Demo's access is withdrawn and the connectors are removed. | Exit steps, on request |
Open points
- Final retention settings for care-related sources are to be agreed with your data protection lead during implementation.
- Any regulator-specific wording your commissioners require is to be reviewed before signature.
Thanks, Theo
Unusual terms
Current to 9 Oct 26- Clinical notes recommended for exclusion
- Residency fixed only via add-on