Social Prescribing Hub and Service Directory Privacy Notice

Service provided by RIVIAM Digital Care

By using the service, you are accepting our Terms of Service and our Privacy Notice.

Privacy notice

At RIVIAM, we take the privacy and security of your information very seriously. We believe it's important you fully understand how your data is managed when you use this service.

When we refer to 'RIVIAM' we are referring to RIVIAM Digital Care, which provides this service and whose registered office is Cooper House, Lower Charlton Estate, Shepton Mallet, Somerset, England, BA4 5QE.

When we refer to the 'Hub' we mean the Social Prescribing Hub, used by Nuneaton & Bedworth PCN. 

When we refer to the 'Service Directory' we mean the public website listing local community and voluntary services, along with the directory accessible via the Hub. 

When we refer to ‘Referral’ we mean the referral form available to professional referrers via HSCN. The form includes the ability to refer to: 

• Nuneaton and Bedworth Primary Care Network (PCN) Services
  • Social Prescribing, Health and Wellbeing Coaching, Mental Health, Pain Management, Dietitians, and Care Coordinators
• Non-Engagement and Safeguarding (PCN Care Coordinators)
  • And for patients that are non-engaging or there is a safeguarding concern, request for a Care Coordinator to undertake an unannounced home visit (referrals to other services cannot be raised).

Data protection framework

RIVIAM Digital Care is based in the United Kingdom and is registered with the Information Commissioner's Office (ICO), registration number Z8885675. We have aligned this privacy notice with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, under the supervision of the ICO.

This privacy notice

This privacy notice sets out how we process and use your personal data while you use the Hub, or while your details appear in the Service Directory.

Personal data means information related to an individual who can be identified directly or indirectly from that data. Examples include your name, email address, phone number or postcode. You can read the ICO's definition of personal data for more detail.

The relationship between RIVIAM Digital Care and Nuneaton & Bedworth Primary Care Network (PCN)

For this service, RIVIAM is the data processor, and Nuneaton & Bedworth PCN is the data controller.

Nuneaton & Bedworth PCN has told us how to use your information, in a contract. Nuneaton & Bedworth PCN is responsible for having a lawful basis for this. 

If you have questions about how Nuneaton & Bedworth PCN captures and uses your personal data, please visit their website to read their privacy notice.

Who do we collect information from?

We collect the minimum set of data needed to provide you with the service.

What personal data do we collect and process?

Personal data about professional users 

If you are a health or care professional using the Hub, RIVIAM holds a profile for you, including your name, email address, mobile phone number, the organisation you work for and the service lines you can access. 

When the functionality to use NHS Care Identity Authentication (CIS2) to log in to the Hub is enabled (Autumn 2026), your profile will be linked to your NHS Care Identity when you sign in, see "NHS Care Identity Authentication (CIS2)" below.

Personal data about patients and service users

If a patient is referred to a service that uses the Hub, we also process personal data about the patient. This is given to us by Nuneaton & Bedworth PCN or the professional supporting the patient, for example through a referral form. Depending on the service, this can include:

• Patient name, email address and contact details
• Patient date of birth and, where relevant, other demographic information such as postcode or gender
• Patient NHS number, where this is enabled (see "Referral management and use of NHS England's Personal Demographic Service (PDS)" below)
• The details of the professional who referred the patient and the organisation the professional works for
• Details of the patient’s referral or the service requested, including the patient’s health or care needs, notes from consultations, appointments and the outcome
• Patient’s racial or ethnic origin, where this is recorded
• Patient’s next of kin or responsible person, where this is recorded.

Some of this is special category data. This means it needs extra protection under the UK GDPR, most often because it is health information, or racial or ethnic origin. As the processor, we do not decide why this data is used. Nuneaton & Bedworth PCN decides that, including which legal condition applies. We only use it when we need to, to deliver the service, and we apply extra safeguards such as controlling who can access it and encrypting it where appropriate.

Where a referral concerns a child or a vulnerable adult, we process their information in the same way, acting on Nuneaton & Bedworth PCN’s instructions. Because this information is sensitive, we take extra care to keep it secure, including controlling who can access it and training our staff to handle it responsibly.

Access to patient data will be via the Hub and only relevant professionals will be able to see referral/patient details allocated to their service and caseloads. Other teams will not be able to review other services referrals. A select number of superusers will have access to all referrals to ensure compliant processing and auditing. Superusers are to access via their own password protected Hub and information will not be shared between users. 

The Service Directory public website

The Service Directory public website publishes information about local community and voluntary organisations and the services they offer, including service descriptions, eligibility criteria and contact details, which may name individuals at those organisations. 

This web service holds no patient or service-user health information and has no log-in.

Listings are reviewed from time to time to keep them accurate. If you are named in a listing and want your details corrected or removed, please contact Nuneaton & Bedworth PCN via the contact page of Nuneaton & Bedworth PCN's website. 

Why we can use your information

Nuneaton & Bedworth PCN, as the organisation responsible for your care, must have a lawful reason for using your information. Data protection law calls this a "lawful basis".

The lawful basis is captured in Nuneaton & Bedworth PCN’s Data Protection Impact Assessment (DPIA) (this includes addressing Articles 6 and 9).

If your information appears in the Service Directory as a named contact for an organisation, that's a separate use of your information from care delivery. Nuneaton & Bedworth PCN, as a the data controller is also responsible for this provision. 

When RIVIAM enables functionality to enable organisations to update their own named contact for an organisation (expected end 2026), these organisations will then become the data controllers for that information. They must then have a lawful reason for using your information. 

NHS Care Identity Authentication (CIS2)

If you access the Hub, you will soon sign in using your NHS Care Identity credentials through NHS Care Identity Service 2 (CIS2). The identity access and management services for this are managed by NHS England. 

This functionality will be enabled during Autumn 2026. Initially you will login via your email and the password you set. 

NHS England is the controller for any personal information you provided to NHS England to get a national digital identity and authenticate your claim to that identity, and uses that personal information solely for that single purpose.

For any personal information handled this way, our role is a "processor" only, and we must act under the instructions provided by NHS England (as the "controller") when verifying your identity.

To see NHS England's Privacy Notice and Terms and Conditions, view the NHS Care Identity Service 2 page. This restriction does not apply to the personal information you provide to us separately, which is managed in accordance with this privacy notice.

Referral management and use of NHS England's Personal Demographic Service (PDS)

If the patient is receiving care from a health or care organisation, that organisation may share their NHS number with other organisations providing their care. This is so that the health and care organisations are using the same number to identify them while providing their care.

RIVIAM uses an NHS England service called the Personal Demographic Service (PDS) to look up a patient's NHS number, where this is enabled in this service.

A health or care organisation sends basic information such as the patient's name, address and date of birth to the PDS in order to find their NHS number.

Once retrieved from the PDS, the NHS number is stored in RIVIAM's case management system. 

Access to this information is strictly controlled, based on the role of the professional, and where the user has a direct care relationship with the patient.

Patients have the right to object to the processing of their NHS number in this way. This will not stop them from receiving care. If they wish to opt out of the use of the NHS number in this way, they can contact RIVIAM using the details below.

Only strictly necessary cookies are used for the Hub to function. The cookies do not collect personal data. There are no cookies used for the Service Directory public website.

Links to other websites

The Service Directory lists other organisations and may link to their websites. This notice does not cover the privacy of your data should you provide any while visiting those sites. Please read the privacy notice of any other website you visit.

How does RIVIAM use your personal data?

As the data processor, we use your personal data only for the following purposes:

• Authenticate you as a user
• Enable you to manage your referral and to record appointments and consultation notes.

RIVIAM does not use your data for automated decision-making.

How do we protect your personal data?

We are committed to ensuring that your information is always secure. RIVIAM has security safeguards in place, including compliance with the NHS Data Security and Protection Toolkit (DSPT), and holds Cyber Essentials Plus certification, to protect the confidentiality, integrity and availability of your personal information.

Your data is stored in secure data centres run by Amazon Web Services in England. All personal information is encrypted. Data is backed up daily to Microsoft Azure UK, and we have a business continuity plan in place in the event of service disruption.

If a personal data breach happens that affects your information, we follow our incident management process, which includes assessing the breach and, where the law requires it, notifying the ICO and Nuneaton & Bedworth PCN.

Who do we share your personal data with?

We will never pass on your information to other suppliers unless the law requires it or Nuneaton & Bedworth PCN instructs us to.

We use the following organisations to help us provide and support the service. Each only processes the limited data it needs to do its job:

We keep what we put in support and incident tickets to the minimum needed to sort out the problem.

Do we transfer your personal data outside the UK/EEA?

All your personal data is stored in secure data centres run by Amazon Web Services in England, UK, and is not transferred outside the UK.

If you contact us, or Nuneaton & Bedworth PCN, for support with this service, your query may be handled using Zoho Desk, which is hosted in the EU. The UK recognises the EEA as providing an adequate level of protection for personal data, so no extra safeguard is needed for this.

How long do we keep your personal data?

As the data processor, your personal data is kept while Nuneaton & Bedworth PCN is a customer of RIVIAM. Nuneaton & Bedworth PCN (the data controller) will inform RIVIAM (the data processor) regarding the retention period. Retention is applied across the service as a whole, rather than differently for each type of record. Once the contract ends, unless Nuneaton & Bedworth PCN instructs otherwise, your data is securely returned or deleted in line with the agreed exit arrangements.

Service Directory listings are organisation and service information, not a care record, so a care retention period does not apply to them. Instead, they are reviewed regularly to keep them current.

What are my rights?

You have several rights over your information under data protection law:

• The right to be informed: to find out what information is held about you, and why
• The right of access: to ask for a copy of it
• The right to rectification: to ask for mistakes to be corrected
• The right to erasure: to ask for it to be deleted, in some cases
• The right to restriction: to ask us to limit how it's used, in some cases
• The right to portability: to ask for your information to be moved to another organisation, in some cases
• The right to object: to object to how it's used, in some cases, for example where Nuneaton & Bedworth PCN relies on legitimate interests.

As RIVIAM is the data processor, please contact Nuneaton & Bedworth PCN. You can also ask RIVIAM directly by emailing [email protected], and we will pass this on to Nuneaton & Bedworth PCN. For more detail about your rights, see the ICO's website.

Consent

Where Nuneaton & Bedworth PCN relies on your consent for any part of this processing, you have the right to withdraw that consent at any time. This will not affect anything already done based on your consent before you withdrew it.

How do I opt out of the service?

If you would like to opt out of using the Hub, please contact Nuneaton & Bedworth PCN.

If you would like to stop information being shared from Nuneaton & Bedworth PCN to RIVIAM, you will need to contact Nuneaton & Bedworth PCN, who will need to make this update happen.

Contacting us or making a complaint

If you have a complaint about how your personal data is handled, please contact Nuneaton & Bedworth PCN first via the contact page of Nuneaton & Bedworth PCN's website. 

Nuneaton & Bedworth PCN will acknowledge your complaint within 30 days and aim to resolve it as quickly as they can.

For general data protection questions, or to use your rights, please also contact Nuneaton & Bedworth PCN, since Nuneaton & Bedworth PCN decides how your information is used for this service.

If your question is about how RIVIAM itself handles data, for example our security measures, you can email [email protected]

If you are still unhappy after Nuneaton & Bedworth PCN has responded, you can complain to the Information Commissioner's Office (ICO): Home or 0303 123 1113.

Changes to this privacy notice

We may change this privacy notice, and, if we do, we will add the changes to this page. If you continue to use the Hub after those changes take effect, you will have agreed to the revised notice.

Last updated September 2026.