Legal

1.1 "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, PECR and any other law relating to personal data that applies in the UK, as amended from time to time, including by the Data (Use and Access) Act 2025; and, to the extent they apply to the Processor because it is established in Portugal, the EU GDPR (Regulation (EU) 2016/679) and Portuguese Law 58/2019. "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the UK GDPR.

1.2 "Customer Personal Data" means personal data in Customer Content processed by the Processor on behalf of the Controller. Annex 1 describes it.

2.1 The Controller is the controller and the Processor is the processor of Customer Personal Data.

2.2 The Processor will process Customer Personal Data only on the Controller's documented instructions, including with regard to international transfers, unless required to do otherwise by UK law or by the law of the EU or Portugal to which the Processor is subject. In that case the Processor will tell the Controller before processing, unless the law prohibits this. The Terms of Service, this agreement and the Controller's use of the Service's features are the Controller's documented instructions.

2.3 The Processor will tell the Controller immediately if, in its opinion, an instruction infringes Data Protection Law.

2.4 The Controller is responsible for the lawfulness of the processing it instructs, including having a lawful basis, a condition for any special category data (such as staff immunisation status), and giving privacy information to its staff and contractors.

2.5 The Controller must not upload patient data.

3.1 The Processor will ensure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and accesses it only as needed for the Service.

4.1 The Processor will implement the technical and organisational measures in Annex 2, which are designed to provide a level of security appropriate to the risk, as required by Article 32 UK GDPR. The Processor may update them provided the overall level of security is not reduced.

5.1 The Controller gives general authorisation for the Processor to engage the sub-processors listed in Annex 3.

5.2 The Processor will give at least 30 days' notice, by email and in the Service, before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the Terms of Service and receive a refund of prepaid Fees for the unused period.

5.3 The Processor will impose on each sub-processor, by written contract, data protection obligations that offer at least the same protection as this agreement. The Processor remains liable to the Controller for each sub-processor's performance.

5.4 Compliance consultants who carry out Consultant Review are sub-processors engaged by the Processor under clause 5.3. By accepting a quote that names a consultant, the Controller authorises that consultant to process the documents the Controller sends for that review, and nothing else.

6.1 The Processor is established in Portugal. The Controller's transfer of Customer Personal Data to the Processor relies on the UK's adequacy regulations for the European Economic Area.

6.2 The Processor will not transfer Customer Personal Data to any other country unless the transfer complies with Chapter V of the UK GDPR and, where it applies, of the EU GDPR, for example under adequacy decisions or regulations (including the EU adequacy decision for the UK), the EU-US Data Privacy Framework and its UK Extension for certified organisations, or the EU Standard Contractual Clauses with the UK Addendum, supported by a transfer risk assessment [lawyer to confirm]. Annex 3 shows each sub-processor's location and transfer mechanism.

7.1 Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organisational measures to respond to requests from data subjects exercising their rights. The Processor will pass on any request it receives directly within [5] working days and will not respond to it except on the Controller's instructions.

7.2 The Processor will assist the Controller with its obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments and prior consultation with the ICO or another supervisory authority), taking into account the information available to the Processor.

7.3 The Processor will provide reasonable assistance where the Controller receives a data protection complaint under section 164A of the Data Protection Act 2018 that relates to the Service.

8.1 The Processor will notify the Controller without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting Customer Personal Data.

8.2 The notice will include, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases.

8.3 The Processor will take reasonable steps to contain and remedy the breach, and will not notify the ICO, any other supervisory authority or data subjects on the Controller's behalf unless instructed or required by law.

9.1 During the subscription, the Controller can export and delete Customer Content in the Service.

9.2 After the Terms of Service end, the Controller can export Customer Content for the export period stated in the Terms of Service (30 days, or 60 days if the Terms end under clause 13.6 or 13.7). The Processor will then delete Customer Personal Data within [60] days (and may do so sooner), and from backups within [35] days of that, unless UK, EU or Portuguese law requires the Processor to keep it. The Processor will confirm deletion on request.

9.3 If the Processor stops trading without notice, it, or any person appointed to deal with its affairs, will use reasonable efforts to delete Customer Personal Data in line with clause 9.2, and may carry out the Processor's other duties under this agreement for that purpose.

10.1 The Processor will make available all information reasonably necessary to demonstrate compliance with Article 28 UK GDPR, including this agreement, Annex 2, and any relevant certifications or summary audit reports [e.g. Cyber Essentials, to confirm].

10.2 Where that information is not enough to show compliance, or where required by the ICO or another supervisory authority, the Controller (or an independent auditor it appoints, bound by confidentiality) may carry out an audit or inspection. It must give at least 30 days' notice, not more than once a year except after a personal data breach, during business hours, and at its own cost.

11.1 The Processor will keep a record of processing activities carried out on behalf of the Controller as required by Article 30(2) UK GDPR.

12.1 Each party's liability under this agreement is subject to the limitations in the Terms of Service, except that nothing limits either party's liability to data subjects under Article 82 UK GDPR.

12.2 This agreement lasts for as long as the Processor processes Customer Personal Data.

12.3 It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. [lawyer to confirm: English or Portuguese law and courts; English law is assumed because customers are in England]

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Two-step verification for user logins, enabled by default; role-based access with Manager, Approver and Staff roles.
• Logical separation of each practice's data.
• Access by Processor personnel limited to named staff, with least privilege, multi-factor authentication and logging.
• Daily encrypted backups, kept for [35] days, with tested restoration.
• Audit log of uploads, approvals, changes and messages, available to the Controller.
• Vulnerability management, timely patching and annual penetration testing [to confirm].
• Incident response plan, including breach assessment and notification procedures.
• Staff confidentiality agreements and data protection training.
• Supplier due diligence before engaging any sub-processor.
• [Target certification: Cyber Essentials / Cyber Essentials Plus. NHS DSP Toolkit, if practices request it, to confirm.]