Data Processing Addendum

Applies to: UK GDPR and the Data Protection Act 2018 (and EU GDPR where an EU controller is onboarded)

---

1. Introduction

This Data Processing Addendum ("DPA") forms part of the Atlacare Terms of Service (the "Agreement") between you and Atlacare Ltd. By accepting the Agreement, you accept this DPA.

This DPA applies when Atlacare processes Personal Data on your behalf under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where you are established in the EU, or otherwise subject to the EU General Data Protection Regulation, it applies to that processing too.

Capitalised terms have the meaning given in the UK GDPR or the Agreement.

---

2. Roles

2.1 You as Controller

For Customer Data, in particular Patient Data, you are the Data Controller. You determine the purposes and means of processing. Your responsibilities include:

• Establishing and documenting a lawful basis for your processing
• Identifying an appropriate Article 9 condition where special-category data is processed — typically Article 9(2)(h) (provision of health or social care or treatment) — and, where relevant, the corresponding Schedule 1 condition under the Data Protection Act 2018
• Providing privacy information to Data Subjects
• Responding to Data Subject rights requests
• Maintaining records of processing as required
• Determining applicable clinical retention periods
• Notifying your supervisory authority and affected individuals of personal data breaches affecting your patients within the required timeframes

Customer Data may include special-category personal data, including health data.

2.2 Us as Processor

For Customer Data, Atlacare is the Data Processor. We:

• Process Customer Data only on your documented instructions (given through the Service interface, the Agreement, or in writing)
• Implement appropriate technical and organisational measures
• Engage Sub-processors as set out in Section 6
• Assist you with Data Subject rights, impact assessments and supervisory authority consultations
• Notify you of Personal Data Breaches
• Return or delete Customer Data on termination

If we believe an instruction infringes the UK GDPR or other applicable data protection law, we will tell you.

2.3 Us as independent Controller

Atlacare acts as an independent controller for Account Data, Authentication Data and Security Data, where it determines the purposes and means of that processing. This includes account and organisation details, billing information, support interactions, credentials and two-factor settings, and technical, access and security logs.

This processing is necessary for us to operate, secure and bill for the Service, and is covered by our Privacy Policy rather than processed as Customer Data on your instructions.

---

3. Processing details

3.1 Subject matter. Processing of Customer Data to provide the Atlacare Service.

3.2 Duration. For the term of the Agreement, plus the post-termination period in Section 9.

3.3 Nature and purpose. Healthcare practice management, including patient record management, appointment scheduling, clinical notes, communication (email, SMS, video), workflow automation, reporting and analytics for your use, and customer support.

3.4 Types of data.

• Identification: names, dates of birth, contact details
• Health data (special category): clinical history, diagnoses, treatment plans, clinical notes, outcome measure responses
• Communication data: messages, appointment confirmations
• Financial data: invoice details (payment card processing handled by the payment provider directly)

3.5 Data Subjects. Your patients; your referrers (where you record them); your patients' emergency contacts (where you record them); your Authorised Users.

---

4. Our processing obligations

4.1 Confidentiality

People we authorise to process Customer Data are bound by confidentiality, are trained on data protection, and access Customer Data only as needed for their role.

4.2 Security measures

We implement appropriate technical and organisational measures. Full details are in the Annex. In summary:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• EU-resident infrastructure for clinical and patient data
• Multi-factor authentication available for all users
• Audit logging of access to Customer Data
• Role-based access control on a least-privilege basis
• Regular security patching and dependency vulnerability scanning

4.3 Helping you with your obligations

We provide tooling and reasonable assistance for Data Subject rights (Articles 15–22): access (export tools), rectification (editing tools), erasure (deletion tools, subject to your retention obligations), portability (exports in CSV, JSON and PDF), and restriction and objection (preference management).

For complex requests requiring engineering work beyond what the Service interface provides, we may charge a reasonable fee.

We also assist with Data Protection Impact Assessments (Article 35) by providing descriptions of our technical and organisational measures; with Records of Processing Activities (Article 30) by providing processing descriptions; and with supervisory authority consultations (Article 36).

4.4 Audit rights

You may, no more than once per year — or more frequently after a confirmed breach or where your supervisory authority requires — request our most recent security documentation and submit a security questionnaire. Enterprise customers may conduct an on-site audit on 60 days' notice and under confidentiality. We respond to reasonable security inquiries at no charge.

---

5. International transfers

5.1 Data location

Customer Data — in particular patient and clinical data — is hosted and stored within the European Economic Area, subject to limited remote access from outside the UK/EEA where necessary for support, security, incident response or other documented operational purposes and protected by appropriate transfer safeguards.

• Hosting and database: Railway, EU region
• File storage: Cloudflare, EU
• Email: Resend, EU region
• Video: Daily.co, EU region, configured EU-only, never recorded
• SMS delivery: The SMS Works, UK

5.2 Transfers outside the UK/EEA

Where a transfer outside the UK/EEA occurs, we use appropriate safeguards — such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, as applicable.

Current transfers outside the UK/EEA:

Limited support and emergency operations access may occur from outside the UK/EEA. Such access is to authorised personnel only, under least-privilege controls and audit logging, and subject to the safeguards above.

5.3 Standard Contractual Clauses

Where an international transfer requires Standard Contractual Clauses, the EU Commission's 2021 SCCs apply as appropriate to the transfer: Module 2 (Controller to Processor) where you, as Controller, transfer Customer Data to Atlacare as Processor, and Module 3 (Processor to Processor) where Atlacare transfers Customer Data onward to a Sub-processor. For UK transfers, the UK International Data Transfer Addendum applies where required. The relevant SCCs and UK Addendum are incorporated into this DPA by reference; where this DPA conflicts with them, they prevail.

---

6. Sub-processors

6.1 General authorisation. You authorise us to engage Sub-processors to help deliver the Service.

6.2 Current Sub-processors. The current list, with each provider's purpose, region and role, is maintained at atlacare.com/sub-processors. Depending on the service and data involved, a provider may act as our processor or as an independent controller.

6.3 New Sub-processor notification. We give at least 30 days' notice (by email to your Account email) before adding a new Sub-processor that will process Customer Data. If you object on reasonable and documented data protection grounds within the 30 days, we will work in good faith to address the objection; if it cannot be resolved, you may terminate the affected part of the Service (or the whole Service, if the Sub-processor is essential) with a pro-rata refund.

6.4 Sub-processor obligations. Where a Sub-processor acts as our processor, we impose data protection obligations no less protective than this DPA, and we remain liable to you for its performance.

6.5 Calendar sync. Where a clinic user connects their own Google or Microsoft calendar, appointment times (and, only if the user enables it, service or patient names) are sent to that user's calendar provider on the clinic's instruction. By default no patient data is included.

---

7. Requests for Customer Data

7.1 If a Data Subject contacts us directly

If your patient or another individual contacts us directly about their data, we will direct them to you as Controller, let you know where appropriate, and will not respond substantively without your instructions.

The exception is where the request relates to data we control as independent Controller — for example an Authorised User's account or a patient's Portal sign-in and security data — in which case we respond directly.

7.2 Your tooling

For Customer Data, you handle Data Subject requests directly. Our tooling supports patient record export (full clinical history), correction, deletion (subject to your retention obligations), data portability in standard formats, and access logs.

7.3 Erasure and retention obligations

Clinical records have minimum retention periods, which you determine as Controller according to the rules applicable to your practice and jurisdiction.

When a Data Subject requests erasure, you decide whether erasure is permitted under those obligations. Our tooling supports logical deletion — records are marked as deleted and hidden from normal access, then fully erased when the retention period you have configured ends.

---

7.4 Government and law enforcement requests

If we receive a binding request from a public authority, court or law enforcement body for Customer Data, we will notify you before disclosing it so that you can seek to challenge the request, unless we are legally prohibited from telling you or there is a risk to life. Where we are prohibited from notifying you, we will use reasonable efforts to obtain a waiver of that prohibition. We will disclose only the minimum data legally required, and we will keep a record of any such request and our response.

---

8. Personal Data Breach

8.1 We notify you

If a Personal Data Breach affects your Customer Data, we will notify you without undue delay after becoming aware of it. Where reasonably practicable, we aim to make an initial notification within 24 hours.

Notification is by email to your Account email, and to a data protection contact you have given us, if any.

8.2 What we tell you

Our notification will include, to the extent known: the nature of the breach; the categories and approximate number of Data Subjects and records affected; the likely consequences; the measures taken or proposed; and a contact for further information. We provide updates as more becomes known.

8.3 Cooperation

We will cooperate with your investigation, help with notifications to supervisory authorities and affected Data Subjects as required by law, and implement remediation measures.

8.4 Your obligations

As Controller, the regulatory notification obligation is yours. You are responsible for deciding whether to notify your supervisory authority — generally without undue delay and, where feasible, within 72 hours of becoming aware — and whether to notify affected Data Subjects, and for making any required notifications. We do not notify supervisory authorities or Data Subjects directly unless you authorise us to.

---

9. Term and termination

9.1 Term. This DPA applies for the duration of the Agreement.

9.2 Return or deletion of Customer Data. When the Agreement ends, return and deletion follows the process in the Terms of Service:

• Customer Data remains available for export for 90 days after termination (the "Export Window")
• We notify you when the Export Window starts and ends, and keep export tools available throughout
• We delete or anonymise Customer Data from production systems on the earlier of your confirmation that you have completed your export, or the end of the Export Window
• For a further 30 days you may ask us by email to retrieve your data if we still hold it; after that it may be permanently deleted and cannot be recovered
• Backup copies, where retained, are handled in accordance with Atlacare’s applicable backup retention and deletion procedures

Exception — retained data. We may retain a limited amount of Customer Data only where necessary:

• to comply with a legal obligation;
• for accounting and tax records;
• for security and fraud prevention;
• to establish, exercise or defend legal claims; or
• as a record of the deletion itself.

Retained Customer Data is not used for marketing, unrelated analytics, product profiling or AI training. It remains subject to this DPA. We provide confirmation of deletion on request.

9.3 Your retention obligations. You are responsible for exporting any Customer Data you need to keep before the Export Window ends. Clinical record retention is your obligation as Controller, not ours.

---

10. General

10.1 Order of precedence. If documents conflict: the SCCs and UK Addendum (where applicable) prevail; then this DPA; then the main Agreement; then the Privacy Policy.

10.2 Liability. Liability under this DPA follows the limits in the main Agreement, except where applicable law requires otherwise.

10.3 Changes. We may update this DPA to reflect changes required by law, changes to the industry-standard SCCs, or improvements to security measures, or otherwise with your consent. We give at least 30 days' notice of material changes.

10.4 Governing law. This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, consistent with the main Agreement.

10.5 Severability. If any provision is unenforceable, the rest continue in force, and the unenforceable provision is modified only so far as necessary to make it enforceable.

---

Contact

ATLACARE LTD Company number 17284670 96 Sirius Close, Wokingham, England, RG41 3DT Privacy and data protection: [email protected]

---

Annex — Technical and organisational measures

Every measure listed below is a contractual representation and reflects a control that is in place. Measures that are planned but not yet operating are deliberately omitted, and will be added only once they are in place.

Encryption

• TLS 1.2+ for data in transit; AES-256 for data at rest
• Customer Data is never transmitted in plain text

Access control

• Role-based access control (RBAC); multi-factor authentication available for all users
• Staff production access to Customer Data is limited to authorised personnel with a legitimate business need, under least-privilege controls and audit logging
• Where practicable, support access to identifiable Customer Data is obtained with Customer authorisation

Network and application security

• Regular security patching
• Secure development lifecycle, code review, and dependency vulnerability scanning

Physical security

• We do not operate physical data centres; our Sub-processors operate certified data centres

Separation of customer data

• Each customer’s data is segregated, so that one customer cannot access another customer’s Customer Data

Error monitoring

• Patient health information is filtered out of error reports before transmission

Incident handling

• Breach notification in accordance with Section 8, followed by post-incident review

Personnel

• Confidentiality agreements; security awareness training; access revoked promptly on departure

Sub-processor management

• Vendor assessment before engagement; contractual data protection obligations; periodic review