Website Privacy Notice
Last updated: 2 October 2026
1.Background
This notice (Privacy Notice) tells you how we look after your personal data when you visit our website at lief.care (Website), when you are a prospective customer of our business or when you are another type of business contact, such as a supplier or service provider to our business.
This notice sets out what information we collect about you, what we use it for and whom we share it with. It also explains your rights under data protection laws and what to do if you have any concerns about your personal data.
We may need to update this Privacy Notice from time to time to reflect new business practices or legal requirements. Please check it regularly to see whether any changes have been made.
2.Who We Are and Other Important Information
We are YERADO LIMITED, trading as Lief, registered in England and Wales with company number 14008556 and our registered address at 16 Croftdown Road, Birmingham, B17 8RB (we, us or our).
For all visitors to our Website, we are the controller of your information. This means we decide what information we collect and how it is used.
We are registered with the Information Commissioner’s Office (ICO), the UK regulator for data protection matters, under registration number ZB482173.
Where care providers use the Lief platform, the care provider is the controller of the records held in it and we act as their processor. If your question relates to information held in the Lief platform by a care provider, please contact that care provider. We will pass on any request we receive to them.
3.Contact Details
If you have any questions about this Privacy Notice or the way we use your information, please contact our Data Protection Officer:
Data Protection Officer: Prior Analytics Ltd
Email: [email protected]
4.The Information We Collect About You
Personal data means any information that does (or could be used to) identify a living person. We have grouped together the types of personal data we collect below.
Types of personal data:
- Identity Data: your name and your company’s name.
- Contact Data: your email address and telephone numbers.
- Technical Data: internet protocol (IP) address, browser type and version, time zone setting and generic location, browser plug-in types and versions and the operating system and platform of the devices you use to access our systems.
- Usage Data: information about how you use our systems.
- Marketing and Communication Data: your preferences for receiving marketing from us and your communication preferences.
We do not collect payment card data or similar data about your method of payment. You provide this directly to Stripe, which processes payments on our behalf. We only receive information about the timing and amount of your payment.
5.How We Use Your Information
We must have a legal justification (known as a lawful basis) for collecting and using your personal data. The lawful bases we rely on are consent, contract, legitimate interests and legal obligation.
The table below sets out the lawful basis we rely on for each purpose. If we intend to use your personal data for a new purpose that is not listed, we will update this Privacy Notice.
| Lawful basis | When we rely on it |
|---|---|
| Consent | Where you have consented to us using or sharing your information, or to receiving marketing material from us. |
| Contract | Where we need your personal data to enter into or perform a contract with you or your organisation, for example to provide our services or manage your account. |
| Legitimate interests | To respond to your enquiries, manage our relationships with business contacts and suppliers, send business-to-business marketing (which you can opt out of at any time), keep our Website and systems secure and improve the Lief platform using pseudonymised feedback (see 5.4). |
| Legal obligation | Where we must keep records to comply with the law, for example accounting records for HM Revenue & Customs. |
Where we need to collect your personal data (for example, to fulfil a contract we have with you), failure to provide it may mean we are not able to provide our services. Where we do not have the information we need to fulfil an order, we may have to cancel it.
Improving the Lief platform. When care providers use the AI features in the Lief platform, we use pseudonymised feedback from how their staff edit AI-generated drafts to improve the accuracy and quality of our product. For this limited purpose we act as a controller, and we rely on our legitimate interests in improving the Lief platform for the care providers who use it.
Before we use this feedback, names and other identifiers are replaced with random placeholders, and we do not attempt to re-identify anyone. We have assessed this use to make sure it is fair and proportionate. You have the right to object to it by contacting [email protected].
6.Who We Share Your Information With
We share (or may share) your personal data with:
- Our personnel: our employees and other workers, whose contracts contain confidentiality and data protection obligations.
- Our supply chain: other organisations that help us provide our services. These organisations only have access to the information they need to support us, and each has a contract with us that contains confidentiality and data protection obligations. They are listed below.
Lief platform sub-processors
| Supplier | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services | Hosting and storage | All customer data | UK | Not applicable (UK) |
| Auth0 (Okta) | User authentication | Email address and login credentials | EU | UK adequacy; SCCs with UK Addendum |
| Cloudflare | DNS, firewall and traffic routing | Data in transit only | US (UK/EU routing) | UK-US Data Bridge |
| Google Workspace | Internal email and documents | Customer (care provider) business and contact data; no resident data | US | UK-US Data Bridge |
| Mailgun (Sinch) | Invitation and notification emails | User email address and account information | EU | UK adequacy; SCCs with UK Addendum |
| Microsoft Azure OpenAI | AI-assisted speech-to-text, report and summary generation | Audio for transcription; pseudonymised report content | UK (UK data residency) | Not applicable (UK) |
| Slack | Internal staff communications | Customer (care provider) business and contact data; no resident data | US | UK-US Data Bridge |
| Trainn | Product training | Name and email address | US | SCCs with UK Addendum |
| Zapier | Internal workflow automation | Limited contact and account data | US | SCCs with UK Addendum |
| Zoho | CRM and helpdesk | Contact and account details of customer organisations’ staff | US | UK IDTA or Addendum |
| Our technical support team | Customer support and incident resolution | Customer data viewed within the UK-hosted platform only, when needed for a specific issue; no data stored outside the UK | India | UK IDTA, with a transfer risk assessment |
Other suppliers we use to run our business
| Supplier | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| AK Patel & Co. (Chartac Practice Ltd) | Accounting and payroll | UK | Not applicable (UK) |
| Atlassian | Engineering project management | US / EU | SCCs with UK Addendum |
| Hostinger | Marketing website hosting | US | Standard Contractual Clauses |
| Prior Analytics Ltd | Data Security and Protection Consulting | UK | Not applicable (UK) |
| Stripe | Payment processing and billing | US | SCCs with UK Addendum |
| Vanta | Compliance and security monitoring | US | SCCs with UK Addendum |
If we are asked to provide personal data in response to a court order or legal request (for example, from the police), we will seek legal advice before disclosing any information and carefully consider the impact on your rights.
7.Where Your Information Is Located or Transferred To
We store your personal data on servers in the UK, hosted by Amazon Web Services in London. Backups are also stored in the UK.
We only transfer personal data outside the UK where a valid legal mechanism is in place to ensure it continues to be protected. Depending on the supplier, we rely on:
- UK adequacy regulations, for transfers to the EU;
- the UK-US Data Bridge, for US organisations certified under it;
- Standard Contractual Clauses with the ICO’s UK Addendum; or
- the ICO’s International Data Transfer Agreement (IDTA).
Where required, we carry out a transfer risk assessment before the transfer takes place. The safeguard used for each supplier is shown in section 6.
8.How We Keep Your Information Safe
We have put security measures in place to prevent your personal data from being accidentally or unlawfully lost, used or accessed by anyone without permission. These include:
- certification to ISO/IEC 27001:2022 and Cyber Essentials Plus;
- achieving Standards Exceeded in the NHS Data Security and Protection Toolkit;
- encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);
- access controls, multi-factor authentication and audit logging; and
- internal IT and network security.
If there is an incident affecting your personal data and we are the controller, we will notify the regulator and keep you informed where required by data protection law. Where we act as the processor for the affected personal data, we will notify the controller and support them in investigating and responding to the incident.
If you notice any unusual activity on the Website, please contact us at [email protected].
9.How Long We Keep Your Information
Where we act as the controller, we only keep your personal data for as long as necessary to fulfil the purposes we collected it for.
To decide how long to keep personal data (its retention period), we consider:
- the volume, nature and sensitivity of the data;
- the potential risk of harm to you if an incident were to happen;
- whether we need the data to achieve our purposes, or could achieve them another way (for example, by using aggregated data instead); and
- any legal requirements (for example, minimum accounting records for HM Revenue & Customs).
We may keep Identity Data, Contact Data and certain other data (specifically, any exchanges between us by email or other means) for up to seven years after our contractual relationship with you ends.
If you browse our Website, we keep personal data collected through our analytics tools only for as long as necessary to fulfil the purposes we collected it for.
If you have asked us for information or subscribed to our mailing list, we keep your details until you ask us to stop contacting you.
10.Your Legal Rights
You have specific legal rights in relation to your personal data.
We may decide not to act on a request if we have been unable to confirm your identity (one of our security processes to keep information safe), or if we believe the request is unfounded or excessive. There is usually no charge for exercising your rights, but we may charge a fee if we decide to proceed with a request we believe is unfounded or excessive. If this happens, we will always tell you in writing.
We will respond to your request without undue delay and within one month of receiving it or confirming your identity, whichever is later. If your request is complex or we have received several requests at once, we may extend this by up to two months. If we need to extend the deadline, we will tell you and explain why.
We do not respond directly to requests about personal data for which we act as the processor. Instead, we forward your request to the relevant controller and wait for their instructions before taking any action.
To make a request, contact us at [email protected].
Your rights are:
- Access
- You can ask whether we are using your personal data, and request a copy of it along with information about how we use it.
- Correction
- You can ask us to correct personal data that is inaccurate or incomplete. We may need to verify the new information before making changes.
- Deletion
- You can ask us to delete your personal data if there is no good reason for us to keep it, or if you have asked us to stop using it. If we have a good reason to keep it (for example, to comply with regulatory requirements), we will tell you and explain why.
- Restriction
- You can ask us to temporarily limit how we use your personal data.
- Objection
- You can object to us using your personal data. If we have a good reason to continue using it, we will tell you and explain why.
- Portability
- You can ask us to send you, or another organisation, an electronic copy of your personal data.
How to make a data protection complaint
We are committed to protecting your personal information and responding promptly to any concerns. If you are unhappy with the way we have collected, used, shared, stored or otherwise processed your personal information, you can complain to us directly:
Yerado Limited
Email: [email protected]
Please give us as much information as possible about your concern so we can investigate it fully. We will:
- acknowledge your complaint within 30 days of receiving it;
- investigate the matter without undue delay;
- keep you informed of our progress where appropriate; and
- tell you the outcome of our investigation without undue delay.
If we need more information, we may contact you. Where a complaint is made on behalf of another person, we may ask for evidence that you are authorised to act for them.
If you are not satisfied with our response, or believe we have not handled your complaint properly, you can complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection authority:
- online at www.ico.org.uk/make-a-complaint
- by phone on 0303 123 1113
- by post to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
11.When We Send You Marketing Messages
We market to prospective and existing business customers (known as business-to-business, or B2B, marketing). We may send marketing communications to their staff using work contact details. If you are a member of staff and do not want to receive B2B marketing, please tell us at [email protected].
Opting out of marketing will not affect how we process your personal data in relation to any order you have with us, or where we need to use your personal data to fulfil that order or provide you with certain information.