Last updated: 31 August 2026
This document is issued in English, which is the governing language. If a signed contract or Data Processing Agreement with your organisation says something different, that signed document takes priority.
This policy explains how Arestechub, trading as Corieva, collects, stores, retrieves, uses, shares, retains and protects personal data. Corieva is built for UK children's services. That work involves some of the most sensitive information a public body holds. We take that responsibility seriously and design the service around UK data protection law, the common law duty of confidentiality, and statutory safeguarding duties.
Corieva is operated by Arestechub ("Arestechub", "we", "us" or "our"). We provide documentation, voice-to-record, report-drafting and related tools for local authorities, agency and locum teams, and other authorised children's services organisations in the United Kingdom.
For privacy requests, contact privacy@corieva.com. For general enquiries, contact hello@corieva.com. Arestechub is registering with the Information Commissioner's Office as a data controller and a data processor, and will publish its registration number here once it is confirmed.
This policy applies to personal data processed through our public website (including waitlist and demo requests), communications with us, and the Corieva platform.
Our website forms are intended for adults aged 18 or over contacting us in a professional capacity, and each form asks you to confirm this. We do not knowingly collect personal data from children through the website. If you believe a child has sent us their details, contact privacy@corieva.com and we will delete them.
It does not replace a local authority's own privacy notice to children, families or staff. Where we process case data for a council or other customer, that organisation's privacy information and our Data Processing Agreement also apply.
Under UK GDPR, the "controller" decides why and how personal data is processed. The "processor" processes data only on the controller's documented instructions.
Arestechub is the controller for website enquiries, waitlist and demo requests, account administration for our own staff, billing and contract records, security logs we keep to protect the service, and similar business data.
The customer (typically a local authority, or an agency contracting for children's services work) is the controller for children's, families' and practitioner case records, voice notes, photographs, assessments, court-report drafts, translations of family-facing forms, and related operational data. Arestechub is the processor for that data. Processing of controller data is described further in our Data Processing page and in the Data Processing Agreement signed with the customer.
The data we collect depends on how you use Corieva.
Website and waitlist visitors may provide: name, work email, organisation, role, organisation type, phone number, and any message you send us.
Authorised users of the platform may have: name, work contact details, job role, organisation, login credentials, language preference, device and usage data needed to operate and secure the service, and audit records of actions taken in the system.
Where a customer uses the platform for casework, we may process on their behalf: children's and families' identity and contact details; case history and Local Map stage; visit notes; voice recordings and transcripts; photographs; assessment and court-report material; translations; handover and allocation data; and other fields the customer's case forms require.
Children's services records routinely include special category data (UK GDPR Article 9), such as health, racial or ethnic origin, religious beliefs, and data concerning a person's sex life or sexual orientation. They may also include criminal offence data (UK GDPR Article 10 and the Data Protection Act 2018), for example allegations, convictions or police involvement relating to a parent or household member.
We process this data as processor only where a customer instructs us to do so as part of statutory or contracted children's services functions. We do not use special category or criminal offence data for marketing, profiling for commercial purposes, or to train general-purpose AI models.
Children cannot usually create a Corieva staff account. Families may receive pre-filled forms without creating an account. We still treat any data about a child as children's data and apply heightened security, access control and retention discipline.
We collect data that you submit (for example a waitlist form or a voice note), data your organisation loads or maps from an existing case system, data created in the platform (drafts, audit logs, translations), and limited technical data produced by your device when you use the website or app (such as browser type, approximate region, and security diagnostics).
The platform can operate offline for short periods. In that mode, visit notes, photos or drafts may be stored temporarily on the authorised device until they can be synchronised to UK-hosted systems. Offline copies remain customer data and must be protected by the same access rules as online records.
Production platform data, including children's services records, is stored and processed in data centres in the United Kingdom. We do not transfer children's services case data outside the UK.
Data is stored in encrypted form at rest. Backups are encrypted, access-controlled, and kept in the UK. Voice recordings, photographs and documents are stored separately from public website content, with stricter access rules.
Where the service works offline, a limited encrypted cache may sit on the signed-in device until sync completes. We design that cache to be user-bound and removable on logout, device wipe, or administrator revocation.
Website waitlist submissions are stored so we can contact you about demos and service updates. We do not put children's case records into marketing systems.
We do not sell personal data. We do not use customer case data as a shared training set across councils. Where a council chooses to have report-drafting tuned to its own writing, that model is built only from that council's material and is not shared with other customers.
Access to case data is role-based. A user should see only the cases and fields their organisation has authorised. Cross-authority allocation or handover (for example connecting a local worker to a child in another area) happens only where the relevant controller has authorised that sharing for a lawful operational or safeguarding purpose. Those events are logged.
We retrieve data in these main ways:
Subject access, correction and similar rights requests about a child's or family's case should normally be made to the local authority or other controller. We will assist that controller. Requests about website or waitlist data that we control can be sent to privacy@corieva.com. We will need enough information to verify identity before releasing personal data, and we may refuse or limit disclosure where the law allows (for example to protect another person's rights, ongoing safeguarding work, or legal privilege).
We use controller business data to respond to enquiries, run demos and waitlists, perform contracts, bill, keep accounts, secure our systems, and improve the public website.
We use customer case data only to provide the contracted service: capturing visit information, structuring notes against the customer's forms, drafting reports for human review, translating family-facing content while preserving the original English legal record, filing photos, supporting allocation and handover, maintaining audit trails, and submitting approved records into the customer's case system. How AI is used for those tasks is explained in "How we use AI" below.
For data we control, our lawful bases under UK GDPR Article 6 are typically: steps at your request before a contract or performance of a contract (enquiries and paid services); legitimate interests (securing the service, keeping limited business records, answering professional enquiries), balanced against your rights; and legal obligation (tax, accounting, regulatory and law-enforcement duties).
For children's services case data, the controller determines the lawful basis. That is commonly public task and/or legal obligation under the Children Act 1989, the Children Act 2004, Working Together to Safeguard Children 2023, and related statutory guidance. Special category data is typically processed under Data Protection Act 2018 Schedule 1 conditions for substantial public interest, including statutory and government purposes and safeguarding of children and individuals at risk. Criminal offence data is processed only under the conditions in the Data Protection Act 2018.
Consent is not usually the basis for statutory case recording. A family declining a form or a photo does not by itself stop a local authority from recording information it is required or entitled to record. Where we offer a genuine choice (for example a marketing email), we will say so and you can withdraw that consent.
Corieva uses artificial intelligence and other automated tools only as a documentation aid for authorised children's services teams. AI is there to reduce retyping, not to replace a social worker, a manager, or a decision under the Children Act. UK data protection law — including UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, and ICO guidance on AI — governs this processing. Children's data is treated as meriting specific protection.
We use AI, on the customer's instruction, to:
We do not use AI to:
All AI processing of children's services data happens in the United Kingdom, on the same UK-hosted systems as the rest of the platform. Prompts, transcripts, drafts and outputs are customer data. They are stored, accessed, retained and deleted under the same rules as other case records. They are not used to improve a foundation model that leaves the customer's tenancy.
Where a council asks us to tune report drafting to its own writing, that work uses only that council's historic reports and stays isolated to that council. We do not pool children's records across local authorities to make a better model for everyone.
AI output can be wrong, incomplete, biased, or over-confident. Under the accuracy and fairness principles, a draft is not a verified fact until a competent person has checked it. Users must review names, dates, who said what, risk language, and recommendations before anything is submitted or shared with a family or a court. If the AI infers health, ethnicity, or other special category information from a note, that inference is still special category data and is handled as such.
A Data Protection Impact Assessment covering this AI use has been completed and is available to customer information governance and DPO teams. We design for data minimisation: the model is given the case material needed for that task, not an open copy of the whole service.
The Data (Use and Access) Act 2025 replaced the old UK GDPR Article 22 with Articles 22A to 22D. A decision is "based solely on automated processing" only if there is no meaningful human involvement. A significant decision that uses special category data generally cannot be taken solely by a machine unless a strict legal condition is met.
Corieva is built so that significant decisions about a child or family are not taken by the software alone. Transcription, field mapping, drafts, flags and worker-match suggestions are inputs for a practitioner or manager who has the authority and information to change or reject the output before it has effect. Record submission, allocation, and any recommendation that goes to conference or court require that human step. Rubber-stamping a draft without reading it is not meaningful involvement, and customers must not configure the service to skip review.
Because the live case decision sits with the authorised human, Corieva is AI-assisted case recording, not solely automated decision-making about a child. If a customer ever asked us to switch on a solely automated significant decision, we would refuse unless the law clearly allowed it and the DPA was updated. Individuals can ask the controller (usually the local authority) how AI was used in their record; we will help that controller explain the logic in plain language so far as the system allows, without exposing other people's data or security detail.
Children's services production data is stored and processed in the United Kingdom. We do not transfer that data outside the UK. That includes voice audio, transcripts, photographs, case text, and any AI prompt or model output derived from them.
If a limited support or website tool ever involved a transfer of non-case business data, we would do so only with a UK GDPR-lawful mechanism (adequacy, UK International Data Transfer Agreement, or another approved safeguard) and would tell affected customers where that is material to a deployment.
We keep personal data only for as long as needed for the purpose we collected it, including legal, accounting, insurance and dispute purposes. We then delete or irreversibly anonymise it, unless the law requires a longer period.
Typical periods, unless a signed contract or statutory schedule says otherwise:
The right to erasure does not always apply to children's social care records. A controller may have to refuse deletion where records must be kept for a legal obligation, public task, legal claims, or safeguarding. We will not delete controller case data just because an individual asked us; we will point the request to the controller and assist them.
We apply technical and organisational measures appropriate to the risk of processing children's and families' data. Our public compliance commitments include UK hosting, ISO 27001-certified data centres, Cyber Essentials Plus, a completed Data Protection Impact Assessment, and ICO registration.
Measures include, as applicable to the service:
No method of transmission or storage is perfectly secure. Customers must also protect devices, accounts and physical papers. Users must not share passwords, photograph case screens onto personal cameras, or copy case data into unapproved tools such as personal email, consumer chat apps, or public AI services.
If we become aware of a personal data breach, we will investigate, contain it, and notify the controller without undue delay so the controller can meet ICO and individual notification duties. Where we are the controller, we will notify the ICO within 72 hours where required, and affected individuals where the law requires it.
Under UK GDPR you may have the right to access your data, correct it, erase it, restrict or object to certain processing, move it (data portability), and withdraw consent where processing is based on consent. You also have rights in relation to automated decision-making, as described above.
Those rights are not absolute. Children's social care records are often exempt or limited where disclosure would prejudice safeguarding, ongoing proceedings, or another person's rights, or where the controller must keep the record.
To exercise rights about waitlist or website data we control, email privacy@corieva.com. To exercise rights about a social care case, contact the local authority or other organisation that holds the case. We will help that organisation respond.
Nothing in this policy limits a lawful duty to share information to protect a child or to comply with a court order, Ofsted, the ICO, or the police. Records, audit logs, drafts and source audio may be disclosable in family or other proceedings. Users must not alter, hide or delete records in order to obstruct an investigation or a court.
We may preserve data beyond the usual retention period where we reasonably believe it is needed for a claim, incident, or legal hold.
Please contact privacy@corieva.com first so we can try to resolve the issue. You can also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, or 0303 123 1113.
We may update this policy when the law, the service, or our practices change. The "last updated" date will change. Material changes affecting a customer deployment will be notified through the contract contact or in-product notice where appropriate. Continued use of the website after an update constitutes notice of the new policy for website visitors.
Privacy: privacy@corieva.com. General: hello@corieva.com. Information governance teams may also request our DPIA, sub-processor list and security assessment.