Data processing agreement

This is a schedule to our terms of service and forms part of them. Accepting those terms accepts this, so there is nothing separate for you to sign.

It records the terms required by Article 28(3) of the UK GDPR where we act as your processor.

Which of us is which. Your practice is the controller for the content you publish on your website, including the names, roles and photographs of your staff. We are your processor for that content: we store it, serve it and back it up on your instructions, and for no purpose of our own.

We are a controller in our own right for your account and billing relationship with us, which is not covered by this schedule. Our privacy notice covers that.

Where we say "personal data" below, we mean personal data we process on your behalf.

Subject matter. Hosting and serving your practice website.

Duration. For as long as your subscription runs, and 30 days after it ends.

Nature and purpose. Storing the content you publish, serving it to the public, and giving your staff a way to edit it. We do not analyse it, profile anyone from it, or use it to train any model.

Types of personal data. Names, job titles, roles and photographs of practice staff, and the contact details your practice chooses to publish. Anything else your practice puts on its website.

Categories of data subject. Your staff, and any other individual your practice names on its website.

No patient data. The website is not a clinical system and holds no patient records. Publishing patient identifiable information on it would breach our terms.

We process personal data only on your documented instructions, including on transfers out of the UK, unless we are required to do otherwise by law. If we are, we will tell you before processing unless the law forbids us from saying so.

Your documented instructions are: this schedule, our terms of service, and what you do in the admin panel. Saving a page instructs us to publish it. Deleting it instructs us to remove it.

If we think an instruction infringes the UK GDPR or other data protection law, we will tell you.

We will not process the data for any purpose of our own, and we will not sell it, share it for marketing, or use it to train any model.

Access to your content is limited to those who need it to run the service. Today that is one person, the founder, which we say plainly because it is both the honest answer and a relevant fact about a small supplier.

Anyone we authorise is bound by a duty of confidence, either by contract or by a statutory duty, and that duty survives the end of their engagement.

We take the measures required by Article 32. In summary:

• All traffic is encrypted in transit using TLS
• Content is stored by a managed provider with encryption at rest
• Admin passwords are stored as salted scrypt hashes and are never recoverable in plain text
• Sessions are signed, scoped to one practice, expire on their own, and are set httpOnly, secure and sameSite=lax
• Sign-in attempts are rate limited
• Each practice's content is isolated by key, and every request is checked against a session bound to that practice
• The stack has no relational database, no WordPress and no plugins, which removes the most common route into a GP website

Our security and service information page sets out the full picture, including the limitations of the single shared password and the fact that independent scheduled backups are not currently included. Read it as part of this schedule rather than separately: an accurate account of what we do not do is part of what you are being asked to accept.

You give us general authorisation to appoint the sub-processors listed on our security and service information page. That list is the current one at any time.

Before we add or replace a sub-processor, we will email the address on your account at least 30 days beforehand.

If you object on reasonable data protection grounds within those 30 days, tell us and we will try to accommodate you. If we cannot, you may cancel and we will refund the unused part of your year. Nothing obliges you to stay on terms you have objected to.

Every sub-processor is engaged under a written contract imposing data protection obligations no less protective than these. We remain fully liable to you for their performance.

Taking into account the nature of the processing, we will help you meet your obligation to respond to requests from individuals exercising their rights.

In practice, most of this you can do yourself and faster: your content is editable at any time, so correcting or removing a member of staff's details is immediate and needs nothing from us.

If a request reaches us directly, we will not respond to it ourselves. We will pass it to you without undue delay, and help you answer it.

There is no charge for this assistance.

We will tell you about a personal data breach affecting your data without undue delay after becoming aware of it, and in any event in time for you to meet your own 72 hour obligation to the ICO.

Our notification will describe the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and what we have done or propose to do about it. Where we cannot give you everything at once, we will give you what we have and the rest as it comes.

We will also help you, on request and taking into account the information available to us, with:

• Data protection impact assessments
• Prior consultation with the ICO
• Your own security obligations under Article 32
• Notifying affected individuals where that is required

Report anything you think is a breach to [email protected] with "Security" in the subject.

You can export your entire website as a single file at any time, from Advanced settings in your admin panel. That file is the same format the template reads, so it is a working copy rather than a printout. You do not need to ask us, and you do not need to be leaving.

When your service ends, we keep your data for 30 days so you can retrieve it if you need to, then delete it.

If you want it deleted sooner, ask and we will do it. If you want it returned in some other form, ask and we will do our best.

We will not keep copies afterwards except where the law requires us to, and we will tell you if that ever applies.

We will make available all information necessary to demonstrate compliance with Article 28, and allow and contribute to audits and inspections carried out by you or an auditor you appoint.

Most of what an audit would look for is already public and does not require an appointment: our security page describes the architecture, the access model and its limitations, and the entire source code is published under the MIT licence at github.com/JLHITS/simple-surgery-template. You can read exactly what the software does rather than take our description of it.

For anything that is not covered by those, email us. We will answer a due diligence questionnaire or a documented set of questions at no charge, within 20 working days.

For an on-site or live audit, give us reasonable notice, no more than once a year unless a breach or a regulator's instruction makes another one necessary. We will not charge for a first audit in any year.

Application processing and primary content storage are configured for the London region. Delivery, email and payment processing involve suppliers that may process data internationally, as set out in our privacy notice.

Where personal data is transferred outside the UK, it is covered by the terms of the relevant supplier's data processing agreement, which incorporate the UK International Data Transfer Addendum to the European Commission's standard contractual clauses.

We will not make a transfer on a basis other than that without telling you first.

The limits of liability in our terms of service apply to this schedule.

If anything in this schedule conflicts with the rest of our terms, this schedule wins on data protection matters. If anything in it conflicts with the UK GDPR, the UK GDPR wins and the rest of the schedule stands.

This schedule is governed by the law of England and Wales.