Secure networking and Microsoft 365 with strict data protection for a care home

Chronus Equity sp. z o.o. operates Cudowny Poranek — a private, round-the-clock residential care home in Zebrzydowice, Silesia. The facility combines residential care with a therapeutic programme: rehabilitation, occupational therapy and salt-cave halotherapy.

A care facility places demands on IT infrastructure that a typical office never sees: resident records contain special-category data under GDPR, staff work in shifts on shared devices, and residents, families and visitors move through the building — each group needing a different level of network access.

Before the project the facility ran a single flat network with no traffic separation — administration computers, staff devices, CCTV and guest WiFi shared one address space. Resident records and correspondence flowed through scattered mailboxes with no central access policies.

The goal was an environment where residents' medical and care data is accessible only to authorised staff, from managed devices and predictable locations — without slowing down the daily work of the care team.

We designed and built the LAN and WiFi network from the ground up on the Ubiquiti UniFi stack — from the gateway and switches to access points covering the building and grounds.

Traffic was split into isolated VLAN segments: administration and records, care staff, CCTV, technical devices, and a guest network for residents and visitors. Firewall rules between segments restrict communication to the necessary minimum, and the guest network is fully isolated from facility resources.

The staff network uses WPA2-Enterprise authentication tied to employee identity — leaving the team means losing network access automatically, with no shared passwords to rotate.

Email and collaboration moved to Microsoft 365 with Exchange Online. Team identity is managed centrally in Entra ID, and access to facility data is governed by Conditional Access policies tailored to working with resident records.

Access to resources containing care documentation requires multi-factor authentication and a compliant, Intune-managed device. Privileged accounts carry additional restrictions, and sign-ins from unusual locations are blocked.

Facility devices — duty-room computers and administration workstations — are managed by Intune with enforced disk encryption, compliance policies and remote wipe.

Data about care-home residents is special-category data — a leak carries consequences far beyond those of a typical business. We deployed Microsoft Purview DLP policies that recognise personal and medical data in messages and documents.

Attempts to send documentation outside the organisation, or share it with unauthorised recipients, are blocked or require an explicit, justified override — and every such event lands in the audit log. The policies work in the background without changing the team's daily habits.