Data Processing Agreement

Version 1. This agreement is made between the organisation that subscribes to the Riisho platform (the Controller) and Creed Expressions Ltd (the Processor, “Riisho”). It forms part of, and is governed by, the Terms of Service between them, and applies from the date the Controller accepts it.

1. Definitions and roles

1.1 “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and any law that replaces or supplements them. “Personal data”, “special category data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in Data Protection Law.

1.2 For the personal data the Controller and its users put into the platform (the Controller Personal Data), the Controller is the controller and Riisho is the processor. For the account, contact and billing details Riisho holds about the Controller as its customer, Riisho is an independent controller, as described in its Privacy Policy; this agreement does not govern that processing.

2. Subject matter, duration, nature and purpose

2.1 Riisho processes the Controller Personal Data only to provide the care management platform described in the Terms of Service (scheduling, care records, medication administration records, incident and governance records, staff and compliance management, and related notifications and reporting), and as the Controller instructs.

2.2 The processing lasts for the term of the subscription and afterwards as set out in clause 10. The types of personal data and data subjects are in Annex 1.

3. Riisho’s obligations (Article 28(3) UK GDPR)

3.1 Instructions. Riisho will process the Controller Personal Data only on the Controller’s documented instructions, which are this agreement, the Terms of Service and the Controller’s use and configuration of the platform, unless required to do otherwise by law, in which case Riisho will tell the Controller before processing unless the law prohibits it. Riisho will tell the Controller if it believes an instruction infringes Data Protection Law.

3.2 Confidentiality. Riisho will ensure that everyone authorised to process the Controller Personal Data is bound by a duty of confidentiality and receives appropriate data protection training.

3.3 Security. Riisho will implement and maintain the technical and organisational measures in Annex 2, appropriate to the risk (Article 32), and will not materially reduce them during the term.

3.4 Sub-processors. See clause 5.

3.5 Data subject rights. Taking into account the nature of the processing, Riisho will assist the Controller, by appropriate technical and organisational measures, in responding to requests from data subjects to exercise their rights. If Riisho receives such a request directly it will pass it to the Controller without undue delay and will not respond to it except to say that it has been passed on.

3.6 Assistance with the Controller’s other obligations. Riisho will assist the Controller in meeting its obligations on security, personal data breaches (clause 6), data protection impact assessments and prior consultation (Articles 32 to 36), taking into account the nature of the processing and the information available to Riisho.

3.7 Deletion or return. See clause 10.

3.8 Information and audit. See clause 8.

4. Controller’s obligations

4.1 The Controller is responsible for having a lawful basis (and, for special category data, a condition under Article 9) for the processing, for the accuracy of the data it enters, for giving data subjects the information required by Articles 13 and 14, for configuring access roles for its users appropriately, and for its own registration with the Information Commissioner’s Office where required.

4.2 The Controller will not instruct Riisho to process the Controller Personal Data in a way that infringes Data Protection Law.

5. Sub-processors

5.1 The Controller gives Riisho general authorisation to use the sub-processors listed in Annex 3. Riisho will impose on each sub-processor data protection obligations no less protective than those in this agreement, and remains liable to the Controller for a sub-processor’s performance of them.

5.2 Riisho will give the Controller at least 30 days’ notice, by email to its organisation administrators and by publishing a new version of this agreement, before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may end the affected service before the change takes effect without penalty.

6. Personal data breaches

6.1 Riisho will notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting the Controller Personal Data.

6.2 The notification will describe, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Riisho will provide further information in phases as it becomes available and will cooperate with the Controller’s investigation and with any notification the Controller must make to the supervisory authority or to data subjects.

6.3 The Controller is responsible for deciding whether to notify the supervisory authority or data subjects of a breach of the Controller Personal Data. The platform provides a breach register to help the Controller record breaches and meet the 72-hour notification deadline.

7. International transfers

7.1 Riisho will not transfer the Controller Personal Data outside the United Kingdom, or make it accessible from outside it, unless the transfer is covered by UK adequacy regulations, or by an appropriate safeguard under Chapter V of the UK GDPR (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses), with a transfer risk assessment where required.

7.2 Where Annex 3 shows that a sub-processor may process data outside the United Kingdom, the safeguard relied on is documented and available to the Controller on request.

8. Information and audit

8.1 Riisho will make available to the Controller the information reasonably necessary to demonstrate compliance with this agreement, including its current security documentation and the results of any independent security testing it commissions, on written request.

8.2 Riisho will allow, and contribute to, audits by the Controller or an auditor it appoints, on reasonable notice (not less than 30 days unless a breach or regulator requires sooner), during normal business hours, subject to confidentiality and to protecting the data of Riisho’s other customers. The Controller will bear its own costs of an audit unless it reveals a material breach of this agreement by Riisho.

9. Records and cooperation

9.1 Riisho will keep a record of the processing it carries out on the Controller’s behalf as required by Article 30(2) and make it available to the supervisory authority on request. The platform’s audit log records who viewed and changed the Controller’s records and authentication events, and is available to the Controller’s administrators and managers.

10. Termination, return and deletion

10.1 When the subscription ends, the Controller may export its data through the platform’s data export function, which produces a complete package of the Controller Personal Data.

10.2 Riisho will keep the Controller Personal Data for the statutory retention periods the Controller has configured in its retention policy, so that records the Controller must lawfully retain (for example care records, personnel files and financial records) are not lost, will warn the Controller before deletion, and will then delete it. Deletion is carried out only after a deliberate decision and is irreversible.

10.3 Riisho may retain personal data after termination only where the law requires it, and will then protect it and use it only for that purpose. Backups are overwritten in the ordinary backup cycle described in Annex 2.

11. Liability and general

11.1 Each party’s liability under this agreement is subject to the limitations in the Terms of Service, except where the law does not permit limitation. This agreement is governed by the law that governs the Terms of Service, and the courts named there have jurisdiction.

11.2 If this agreement conflicts with the Terms of Service on the processing of the Controller Personal Data, this agreement prevails.

11.3 Riisho may publish a new version of this agreement. A version that makes a material change (including any change to the sub-processors in Annex 3) needs to be accepted by the Controller’s organisation administrator; the platform will keep asking until it is, and will not block access to care records while it waits.

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

Measures in place at the date of this version:

• Tenant isolation. Each customer’s data is held in its own database schema, and access is scoped to the customer’s organisation.
• Encryption. Data is encrypted in transit (HTTPS with HSTS enforced). Sensitive identifiers (including NHS, National Insurance, DBS, passport and bank details) are additionally encrypted at rest in the database at field level.
• Access control. Role-based access (administrator, manager, coordinator, staff, family); administrators and managers are required to use multi-factor authentication; password history and complexity rules; account lockout after repeated failed sign-ins; rate limiting of the API. The audit log and payroll exports are restricted to administrators and managers.
• Audit logging. Reads of client, medication and visit records, changes to sensitive records, sign-in, sign-out, failed sign-in and MFA events are recorded, with user, time and IP address. The audit log is append-only and enforced by the database. Automated alerts flag failed-login spikes, unusually heavy record reading and repeated exports.
• Backups and recovery. Daily, weekly and monthly database backups and point-in-time recovery, with a documented and tested restore procedure. Backups age out in the cycle: daily for 6 days, weekly for 27 days, monthly for 89 days.
• Breach management. A documented personal data breach response procedure and an in-platform breach register with a 72-hour deadline tracker.
• Secure development. Automated dependency and static security scanning in the build pipeline, and automated tests.
• Staff. Confidentiality obligations for everyone with access to customer data.

Measures planned and not yet in place at the date of this version: independent penetration testing before general availability; custody of the field-encryption keys in a managed key management service; safeguarding and data protection awareness training for all staff with access to customer data; Cyber Essentials certification. Riisho will update this Annex, and publish a new version if the change is material, as these are completed.

Annex 3: Approved sub-processors

Integrations that the Controller itself chooses to connect (for example its own accounting system, the NHS Personal Demographics Service or the DBS Update Service) are the Controller’s own processing arrangements and are not sub-processors of Riisho.