Terms of Service

Care Monitoring & Governance Platform

1. Definitions

In these Terms:

• 'Platform' means the Riisho web application and all associated services
• 'Organisation' means a care provider or business that has registered an account
• 'Staff User' means an individual user account created by or for an Organisation
• 'Family User' means a family member or authorised representative of a service user
• 'Service User' means a person receiving care whose data may be held on the Platform
• 'Account' means a registered user account on the Platform
• 'Content' means any data, text, records, or information submitted to the Platform

2. Eligibility & Account Registration

2.1 Eligibility

To use the Platform you must:

• Be at least 18 years of age
• Have authority to enter into a binding agreement (for Organisations, this means the person registering must be authorised to act on behalf of the Organisation)
• Not be prohibited from using the Platform under applicable law

2.2 Account Registration

• You must provide accurate, complete, and current information when registering
• You are responsible for maintaining the confidentiality of your login credentials
• You must notify us immediately of any unauthorised access to your account
• We reserve the right to suspend or terminate accounts where we suspect unauthorised use

2.3 Organisation Accounts

Where an Organisation registers, the Organisation is responsible for:

• All Staff User and Family User accounts created under their Organisation account
• Ensuring all users are made aware of these Terms and our Privacy Policy
• Ensuring users are appropriately trained and authorised to access care data
• Maintaining their own compliance with CQC, ICO, and sector regulatory requirements

3. Acceptable Use

3.1 Permitted Use

You may use the Platform only for lawful purposes relating to care management, workforce governance, and related activities as described in the Platform's documentation.

3.2 Prohibited Use

You must not:

• Use the Platform for any unlawful purpose or in breach of any applicable regulation
• Input false, misleading, or inaccurate care records or staff compliance data
• Access another user's account or data without authorisation
• Attempt to circumvent security measures or access controls
• Use the Platform to harass, intimidate, or harm any individual
• Upload malicious code, viruses, or disruptive content
• Scrape, copy, or extract Platform data for use outside the Platform without our consent
• Share login credentials with unauthorised individuals
• Use the Platform in a way that could bring it into disrepute or harm vulnerable people

3.3 Care Data Obligations

Where the Platform is used to process data about service users, you must:

• Ensure you have a lawful basis for processing under UK GDPR
• Comply with all applicable care sector regulations including CQC requirements
• Not use the Platform as a substitute for professional clinical judgement
• Ensure appropriate safeguarding procedures are in place independently of the Platform

4. Data & Privacy

4.1 Data Processor / Controller Relationship

For data about your service users and staff that you input into the Platform:

• You are the Data Controller
• We are the Data Processor acting on your instructions
• A Data Processing Agreement (DPA) is incorporated into these Terms by reference and is published on our website: Data Processing Agreement

4.2 Your Data Responsibilities

As Data Controller, you are responsible for:

• Ensuring you have a lawful basis to process the data you input
• Providing appropriate privacy notices to service users and staff
• Responding to Subject Access Requests relating to data you control
• Reporting data breaches within your organisation to the ICO within 72 hours

4.3 Our Data Responsibilities

We will:

• Process your data only on your documented instructions
• Implement appropriate technical and organisational security measures
• Not engage sub-processors without your knowledge (the current list is in Annex 3 of the DPA)
• Assist you in responding to data subject rights requests
• Delete or return your data on termination of your account
• Notify you without undue delay in the event of a personal data breach affecting your data

5. Intellectual Property

• The Platform, including its software, design, and documentation, is owned by Creed Expressions Ltd and protected by intellectual property law
• These Terms do not grant you any ownership rights in the Platform
• You retain ownership of all data and Content you submit to the Platform
• By submitting Content, you grant us a limited licence to process it for the purpose of providing the Platform services
• You must not copy, modify, reverse-engineer, or create derivative works of the Platform

6. Availability & Service Levels

Service level commitments, where agreed, are set out individually with your organisation as part of your contract — they are not a standard, publicly published commitment. You should not rely solely on the Platform for time-critical care operations without backup processes.

7. Limitation of Liability

• To the maximum extent permitted by law, we exclude all liability for indirect, consequential, or incidental losses
• We do not exclude liability for death or personal injury caused by our negligence, fraud, or fraudulent misrepresentation
• We do not exclude liability for any liability that cannot be excluded under applicable law
• Our total aggregate liability to you in any 12-month period shall not exceed the fees paid by you in that period

Critical disclaimer for care settings:

8. Safeguarding Obligations

Use of the Platform does not transfer, reduce, or discharge any safeguarding obligations held by the Organisation or its staff. In particular:

• The Organisation remains responsible for reporting safeguarding concerns to the appropriate authorities
• The Platform's safeguarding reporting workflow is a tool to support — not replace — your organisational safeguarding procedures
• If a concern raised through the Platform suggests imminent risk to a person's safety, you must contact emergency services or the relevant local authority immediately — do not wait for Platform alerts to be processed
• We reserve the right to disclose safeguarding information to relevant authorities where there is an overriding legal duty or serious risk to life, without prior notice to you

9. Termination

9.1 Termination by You

You may close your account at any time by contacting us at hello@riisho.uk. On termination, we will delete or return your data in accordance with our Privacy Policy and Data Processing Agreement.

9.2 Termination by Us

We may suspend or terminate your access to the Platform immediately if:

• You breach these Terms
• We reasonably believe your use poses a risk to the safety of service users or third parties
• You fail to comply with applicable laws or regulations
• We decide to discontinue the Platform (with reasonable notice where possible)

9.3 Effect of Termination

• Your right to access the Platform ceases immediately on termination
• We will retain your data for the periods set out in our Privacy Policy
• Sections 4, 5, 7, 8, and 10 survive termination

10. General

10.1 Changes to These Terms

We may update these Terms from time to time. We will notify you of material changes at least 30 days before they take effect (or sooner if required by law). Continued use after the effective date constitutes acceptance.

10.2 Governing Law & Jurisdiction

These Terms are governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

10.3 Entire Agreement

These Terms, together with our Privacy Policy and Data Processing Agreement, constitute the entire agreement between you and us regarding the Platform and supersede all prior agreements.

10.4 Severability

If any provision of these Terms is found to be unenforceable, the remaining provisions continue in full force.

10.5 Waiver

Failure to enforce any provision of these Terms does not constitute a waiver of our right to enforce it in future.

10.6 Contact