What is recorded,
and who sees it.
Plain answers to the questions this app should have answered before it asked you for anything. If something here is not clear, ask your worker and they will go through it with you.
What is recorded
Only what you put in yourself, plus the ordinary things any account has: when you signed in, and when you opened something.
Your diary
Each entry keeps the day it happened, whether it was alcohol or another substance or neither, what you entered about it, and, if you gave them, units and what it cost. The app works out its own safety flags from that; you never send us a flag.
You can delete a diary entry, and deleting it removes the entry itself rather than hiding it.
Your check-ins
A check-in records which kind it was (alcohol, drugs, craving, mood, sleep, a trigger or a journal note), what you entered, and the time. Nothing else.
Craving sessions
A session records how strong the craving was, how it moved while you were in it, which tool you used, and how it ended, along with anything you typed or named.
Whether your worker can see it
It is not all the same, so here is each one on its own. Sharing is per entry, and you can change your mind about an entry after you have written it.
Your diary is shared by default
A diary entry goes to your worker unless you turn sharing off for that entry. That is the one place in this app where sharing is on to start with, and it is the thing people are most often surprised by, so it is said first.
When an entry is shared, your worker can see what you wrote in it. When it is not shared, they cannot see the entry at all.
Your check-ins are private, but the fact of them is not
What you write in a check-in stays private unless you choose to share it. Your worker sees the words only if you tick to share that check-in.
What they can always see is that you checked in, when, and whether the app's own safety rules marked it as worth a look. That is how the service notices somebody is having a hard fortnight without reading their words, and it is worth knowing that it works that way.
Craving sessions are private unless you share one
A craving session is not shared unless you choose to share it. If you do share one, what your worker sees is the shape of it: that there was a craving, how strong it was, what you tried, and how it ended.
Even on a shared session they do not see what you called it, what you wrote, or anything Rivo said to you.
- Shared unless you turn it off: diary entries.
- Private unless you turn it on: what you write in check-ins, craving sessions, medicines you add yourself, meetings you save.
- Always visible to your team: that you used the app, when, and whether a safety rule flagged something. Never the words behind it.
How your information may be used
For your care, and for keeping you safe. That is the whole of it.
To have a better conversation with you
What you share is there so an appointment can start from what actually happened rather than from what either of you can remember. That is the entire point of the diary.
To notice when something changes
The app applies its own rules to what you log and can mark an entry as worth a look. When it does, your team sees the reason the rule gave, not the note you wrote.
Every look at a shared entry is recorded
When a member of staff opens a diary entry you have shared, that is written down: who looked, at what, and when. You can ask to see that record.
Whether the coach is a machine
It is. Rivo is artificial intelligence, not a person, and it is worth knowing exactly what happens to something you say to it.
Rivo is AI
There is no person on the other end of it, at any hour. It is a language model run by Google, and every message goes through one controlled route on our own servers before it reaches that model.
Your name and details are taken out first
Before your message leaves our servers, things that identify you are replaced with placeholders: your name, your email, your phone number, your address and postcode, your NHS number, dates. The model sees the placeholders. Your reply gets the real words back afterwards.
What is kept, and for how long
Your message and the reply are kept for 28 days and then deleted, so that a safety concern can be checked afterwards. They are encrypted while they are kept.
In that time only a system administrator can open one, not your worker, and every time somebody opens one it is recorded as an exceptional access.
What the coach cannot give you
Some of this is what it is told not to do. Some of it is simply what it is unable to do. Both are worth saying.
It cannot give you medical advice
No doses, no amounts, no advice about detox, and nothing about starting, changing, reducing or stopping a medicine. If a reply strays into any of that, our own check throws the whole reply away and you get a fixed safe answer instead.
It cannot diagnose you or tell you what will happen
It does not name conditions and it does not predict how things will go for you. It offers things that may help, never things you must do.
It cannot do anything on your behalf
It can only write words back to you. It cannot book or move an appointment, send a message to your worker, change anything on your record, or contact anyone for you. Those are all things you do yourself, or ask a person to do.
It is not a crisis service
It is not staffed, it is not watched in real time, and it must never tell you a conversation is completely private. If it does, that reply is rejected before it reaches you.
If you need help now
Do not wait for the app. Ring somebody.
What the app does in a crisis
If something you say is recognised as a crisis, it is not sent to the AI at all. You get a fixed set of numbers instead, written by people rather than generated.
If you are talking to Rivo by voice, the numbers appear on the screen as well as being read to you, every time. A number you have to remember from audio is not a number.
A record of it is made for your team to review. That is a review, not an alarm: nobody is paged, and no one rings you back automatically, so if you need somebody now, use a number below.
Your own service
Your service's number and its opening hours are on the crisis page, which is kept up to date in one place so it cannot go stale here.
Still to be confirmed by a person
Two things on this page could not be answered from how the app is built, and rather than guess at them they are left open. They will be filled in by the service, not by the app.
- How long your information is kept. Messages to Rivo are deleted after 28 days, and that one is settled. How long a diary entry, a check-in or a craving session is kept has not been set down anywhere this page can read.
- Who to contact about your information. Asking for a copy, asking for a correction, or making a complaint currently goes through your worker. The named contact for information rights is still to be confirmed.