Privacy Policy
Care Monitoring & Governance Platform
| Data Controller | Creed Expressions Ltd (registered in England & Wales, Company No. 15951333) |
|---|---|
| Registered Address | 177 Wards Wharf Approach, London, England, E16 2EQ |
| ICO Registration No. | ZC179028 |
| Data Protection Contact | patricia@creedexpressions.com |
| Platform URL | https://riisho.uk |
1. Who This Policy Applies To
This policy applies to all individuals who interact with the Platform, including:
- Care provider organisations and their administrators ('Organisations')
- Care workers, managers, and staff employed by or contracted to those Organisations ('Staff Users')
- Family members or authorised representatives of people receiving care ('Family Users')
- Service users — people receiving care who may have a profile on the Platform ('Service Users')
2. What Data We Collect
2.1 Data You Provide Directly
Organisation Administrators:
- Organisation name, type, and CQC registration details
- Administrator name, job title, email address, and phone number
- Billing and contract information
Staff Users:
- Full name, date of birth, contact details
- Job role, employment status, start date
- DBS certificate number, issue date, and disclosure level
- Right to Work documentation (document type and expiry — not copies stored by default)
- Training certificates, qualifications, and competency records
- Timesheets and scheduling data
Service Users:
- Full name, date of birth, NHS number, address
- Care plans, visit notes, and health observations
- Medication records, including names, dosages, and administration logs
- Incident reports and safeguarding records
- Mental capacity assessments and consent records
Family Users:
- Full name, relationship to service user, contact details
- Communications and updates shared through the Platform
2.2 Data Collected Automatically
- IP address and device type
- Browser type and operating system
- Pages visited, features used, and time spent on the Platform
- Login timestamps and session data
- Error logs and performance data
2.3 Special Category Data
3. How We Use Your Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Providing and operating the Platform | All account and usage data | Contract (Art. 6(1)(b)) |
| Care visit scheduling and monitoring | Service user and staff data | Contract / Legal obligation |
| Medication management | Service user health and medication data | Legal obligation (Art. 6(1)(c)) + Art. 9(2)(h) |
| Staff compliance and governance | DBS, RTW, training records | Legal obligation + Art. 9(2)(b) |
| Safeguarding reporting | Incident and safeguarding data | Legal obligation + Art. 9(2)(b)/(g) |
| Finance and payroll management | Staff and financial data | Contract + Legal obligation |
| Sending service notifications and alerts | Contact details | Contract (Art. 6(1)(b)) |
| Complying with legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
4. Who We Share Your Data With
We do not sell your personal data. We may share data with:
Service providers (data processors):
- Cloud hosting and file-storage providers
- Email, SMS and WhatsApp delivery services
- Payment processors (for Organisation billing)
- Address search, geocoding and routing providers (used to plan visits)
- An AI text-drafting provider, only when a user uses the care plan drafting feature
Each provider, what it receives and where it is located is listed in Annex 3 of our Data Processing Agreement. Our providers may not use your data for any purpose other than providing services to us.
Legal and regulatory disclosure:
- Where required by law, court order, or regulatory authority
- To the ICO in the event of a reportable data breach
- To safeguarding authorities where there is a legal duty or overriding public interest
Care provider organisations:
Where you are a Staff User or Service User, the Organisation that has set up your account can access your data within the Platform in accordance with their own privacy notices and data controller obligations.
5. Data Retention
We retain personal data for as long as necessary for the purposes set out in this policy, and in accordance with our legal obligations.
Care platform data
Data about people receiving care and about an Organisation’s staff is held on behalf of that Organisation, which decides how long to keep it as the data controller. These are the default periods the Platform applies; an Organisation can configure its own.
| Data type | Default retention | Basis |
|---|---|---|
| Client care records | 8 years | Care Act 2014 — 8 years post-discharge |
| Staff personnel files | 6 years | Employment Rights Act 1996 — 6 years post-employment |
| Financial records | 7 years | Companies Act 2006 — 7 years |
| DBS certificates | Not kept | No retention — destroy after sighting |
| Accident/incident records | 10 years | Limitation Act 1980 — 3 years adults, 10 years children |
| CCTV footage | 1 year | ICO guidance — 31 days unless evidence required |
| Email communications | 3 years | GDPR legitimate interest — 3 years |
| Audit records (who viewed or changed records, sign-in activity) | 7 years | Kept for 7 years, then archived to storage and removed from the live system |
Our own records
| Data type | Retention period |
|---|---|
| Account and sign-in data | Life of the account plus 12 months |
6. Your Rights
Under UK GDPR, you have the following rights:
- Right of Access — request a copy of your personal data (Subject Access Request)
- Right to Rectification — ask us to correct inaccurate data
- Right to Erasure — ask us to delete your data where there is no lawful reason to retain it
- Right to Restrict Processing — ask us to pause processing in certain circumstances
- Right to Data Portability — receive your data in a structured, machine-readable format
- Right to Object — object to processing based on legitimate interests
- Rights relating to Automated Decision-Making — request human review of automated decisions that affect you
To exercise any of these rights, contact us at: patricia@creedexpressions.com
We will respond within one calendar month. We may need to verify your identity before processing your request.
7. Security
We take the security of your data seriously. Our measures include:
- Encryption in transit (HTTPS) and, at rest, field-level encryption of sensitive identifiers such as NHS number, National Insurance number, DBS details and bank details
- Multi-Factor Authentication (MFA), which is required for organisation administrators and managers and available to all users
- Role-Based Access Control: users access only data relevant to their role
- Audit logging of who viewed and changed sensitive records and of sign-in activity, with automated alerts for unusual account activity
- Daily, weekly and monthly backups with point-in-time recovery and a tested restore procedure
- An incident response procedure with 72-hour ICO breach notification
We are also working towards independent penetration testing, Cyber Essentials certification, and data protection and safeguarding awareness training for everyone with access to customer data. We will update this policy when each is in place.
No system is 100% secure. If you believe your account has been compromised, contact us immediately at .
8. Cookies
The Platform sets only the cookies it needs, plus one optional category that is off until you allow it. It uses no analytics or advertising cookies.
| Cookie type | Purpose | Can be declined? |
|---|---|---|
| Strictly necessary | Login sessions, security, remembering your cookie choices, and taking payment on the sign-up page | No: required for the Platform to work |
| Functional | Google Maps address search and map display, loaded only if you allow it | Yes |
You can change your choices at any time from the “Cookie settings” link in the footer or on our cookie policy page, which lists every cookie, and through your browser settings.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or via an in-Platform notice at least 30 days before the changes take effect (or as soon as reasonably practicable where required by law).
The date at the top of this policy shows when it was last updated. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.
10. Contact Us
For any questions about this Privacy Policy or how we handle your data:
| Company | Creed Expressions Ltd |
|---|---|
| Address | 177 Wards Wharf Approach, London, England, E16 2EQ |
| patricia@creedexpressions.com | |
| ICO Registration | ZC179028 |