Privacy notice

RiverCPD is run by Senior Internet Ltd, registered in England and Wales, company number 03901114. Registered office: Gothic House, Barker Gate, Nottingham, NG1 1JU. We are registered with the Information Commissioner's Office, registration number Z8248490.

For anything about your personal data, email dataprotection@senior.co.uk or write to us at the address above.

Who decides how your data is used depends on how you use RiverCPD. The law calls that person or organisation the controller.

When we act for your professional body or employer, we use your data only to run RiverCPD for them, under a data processing agreement. If you send us a request about that data, we'll pass it to them and help them answer it.

This table covers the data we are responsible for. For data we handle for your professional body or employer, their privacy notice sets out the purposes and lawful basis.

We keep invoices and payment records because tax law requires it (legal obligation).

Most of it comes from you. If you sign in through your professional body or employer, we also receive your name, email address and membership details from their system when you sign in. We do not receive your password.

We don't ask for health information or other special category data. Please don't include it in your record unless your scheme asks for it. Don't include patient, client or service-user details in your entries, reflections or evidence either.

The AI coach is optional. When you use it, we send the certificate or document you choose and the text of your entry, with your name taken out. Your name, email address, membership number, employer and team are never sent.

• The AI coach uses Anthropic's Claude models through Amazon Bedrock, run by Amazon Web Services in the EU. Anthropic has no access to what we send. The UK recognises the EU as giving adequate protection for personal data.
• Nothing we send is used to train any AI model, and request logging is switched off, so Amazon Bedrock keeps no copy of what we send.
• The drafted details and reviews stay with your entry. Raw responses from the model are kept for 90 days for troubleshooting, then deleted.
• You can switch AI help off in your profile at any time. Your professional body can switch it off for everyone.

The coach and AuditAssist never make decisions about you. They don't pass, fail or refer anyone back: a person always decides.

We don't send marketing to members of association schemes. We only send you marketing emails if you've agreed to them, or if you're a Pro subscriber and we're telling you about similar RiverCPD services. Every marketing email has an unsubscribe link.

We never sell your data.

• Your professional body or employer, if you use RiverCPD through them. Their staff see what their role allows: scheme administrators, auditors and managers each see only what they need. Your employer sees your CPD only if your scheme is set up that way and you've joined your employer's organisation in it.
• Our staff, only when they need to, for example to answer a support request. Our support staff work in several countries, some outside the UK. They access RiverCPD remotely, and your data stays stored in the UK.
• Our sub-processors, the companies that host and run parts of RiverCPD for us, under contracts that protect your data. They are listed at rivercpd.com/dpa/sub-processors.
• Others, only where the law requires it, for example a court order, or to protect someone from harm.

We store RiverCPD data in the UK, on Microsoft Azure. The RiverCPD app runs in Azure's UK South region, where every association has its own database. This website, including waiting-list and demo requests, runs in Azure's UK West region. AI coach requests are processed in the EU, as described above. Data is encrypted in transit and at rest.

Some of our staff and sub-processors work outside the UK, including in countries the UK has not recognised as giving adequate protection. When they access or receive personal data, we protect it with the safeguards the law requires, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We add our own controls, including multi-factor authentication on every staff account and no copies of your data kept on staff devices. You can ask us for details of these safeguards. Our staff may access data only from the countries on our published list at rivercpd.com/dpa/sub-processors.

You have the right to:

• get a copy of your personal data
• have inaccurate data corrected
• have your data deleted, in some circumstances
• restrict or object to how we use it, in some circumstances
• take your data with you, in a machine-readable format (your CPD record exports as CSV)
• withdraw your consent, where we rely on it, at any time

If you use RiverCPD through your professional body or employer, contact them first. They decide on requests about your record, and we help them. Otherwise, email dataprotection@senior.co.uk. We'll reply within one month and won't charge you.

If you're unhappy with how we've handled your data, please tell us first at dataprotection@senior.co.uk. We'll acknowledge your complaint within 30 days and tell you the outcome.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.

Wherever you live, you have the rights above. Your local law may give you more:

• European Economic Area and Switzerland: your rights under the GDPR or the Swiss data protection law. You can complain to your local data protection authority.
• Australia: your rights under the Privacy Act 1988, including access and correction. If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner.
• New Zealand: your rights under the Privacy Act 2020. You can complain to the Privacy Commissioner.
• United States: depending on your state, you may have the right to know what we hold about you, and to have it corrected or deleted. We don't sell or share personal information, as those laws define it, and we won't treat you differently for using your rights.
• Canada: your rights under PIPEDA or your provincial law. You can complain to the Office of the Privacy Commissioner of Canada.

If you use RiverCPD through your professional body or employer, contact them first: their notice and their local law apply to your record.

The rivercpd.com website uses only the cookies it needs to work and to keep it secure. It uses no advertising or analytics cookies.

The website loads its fonts from Google Fonts, which means your browser sends your IP address to Google when it downloads them.

We'll update this notice when how we use personal data changes. The date at the top shows when it last changed. If a change affects you significantly, we'll tell you by email or in the app.