Responsible AI and security
Trust depends on clear responsibilities, considered design and evidence. This page explains our approach and identifies the information available for technical and governance review.
Accountability
Human accountability
AI capabilities in iCura are intended for authorised staff in care organisations. They are designed to assist people, not to make decisions on their behalf.
AI-assisted information can be incomplete or incorrect. Staff should review the underlying evidence, follow their organisation’s procedures and escalate concerns through their usual routes. AI assistance does not replace safeguarding procedures or professional judgement.
Evaluation
Evaluation and change
Our commitments. Before an AI capability is released we evaluate it against agreed measures, record known limitations and review the results. Changes to models or versions go through the same review. We welcome feedback from users and treat reports of incorrect output as a priority. The approach we follow is described on our AI & Innovation page.
Data & access
Data, access and AI processing
Identity and access controls, separation between customer organisations, data minimisation, encryption and audit records are central to how we design iCura.
The specific arrangements for a deployment — including which data is processed by AI services, which subprocessors are involved, retention periods, hosting regions and contractual terms on model training — depend on that deployment. We discuss them during procurement and technical review rather than summarising them in general terms here.
Operations
Operational security
Monitoring, incident response, backup and recovery, and vulnerability management arrangements are available to discuss during technical review. We do not publish detailed security configuration.
Shared responsibility
Deployment responsibilities
RIAConsult
- Designing, building and maintaining iCura
- Securing the application and the services we operate
- Evaluating AI capabilities before release
Customer organisation
- Deciding who has access and at what level
- Reviewing AI-assisted information and making decisions
- Its own policies, procedures and regulatory obligations
Platform provider (Microsoft Azure)
- The physical infrastructure and the platform services it supplies
Security of this website is separate from security of iCura. This website does not process care records, and the enquiry form asks you not to include sensitive information.
Assurance
Assurance information
Organisations evaluating iCura can request a discussion covering security, data processing and AI governance. We will tell you which documents are available for your review.
Contact
Contact and reporting
To raise a security question or report a potential vulnerability in this website or iCura, email info@riaconsult.co.uk or use the contact form. Please do not include sensitive personal information.
Last reviewed 15 October 2026 by RIAConsult.
Request a security discussion
Tell us what your organisation needs to review, and we will arrange a conversation with the right people.