Data Processing Agreement

1. Parties and roles

The Customer (the care home) is the Controller of resident and staff personal data entered into Carestead. The processor is the legal entity named on the Order Form, trading as Carestead. This template does not name that company or a company number. The processor is an independent controller only for its own account administration (billing, security logs).

2. Subject matter and duration

Processing covers care coordination: resident demographics, medications, MAR/visit logs, incidents, risk assessments, documents, messaging, and related audit trails, for the term of the subscription and any agreed retention/deletion period after termination.

3. Nature and purpose

Hosting, storage, retrieval, transmission, and display of Customer Data to authorised users; support, security monitoring, and backups.

4. Types of data and data subjects

Residents, relatives, and staff. May include special category health data (UK GDPR Art. 9) such as medications, allergies, incidents, and clinical documents uploaded by the Customer.

5. Customer instructions

The Processor processes Customer Data only on documented instructions from the Customer (including configuration of the Service and support tickets), unless required by UK/EU law. The Customer is responsible for the lawfulness of instructions and for obtaining any required consents or Art. 9 conditions for health data.

6. Confidentiality and security

Personnel with access are bound by confidentiality. Technical and organisational measures include TLS in transit, access control and Row Level Security, encrypted storage for uploaded documents, logging, and account deletion tooling. See the Trust centre for the current security posture summary.

7. Subprocessors

Customer authorises engagement of subprocessors listed on the Trust centre (including Supabase, Vercel, Stripe, Resend, and Twilio when SMS is enabled). Material changes will be notified with a reasonable objection window where contractually required.

8. International transfers

Where Customer Data is transferred outside the UK/EEA, the Processor uses appropriate safeguards (e.g. UK IDTA / SCCs) with the relevant subprocessor.

9. Assistance

Taking into account the nature of processing, the Processor assists with data subject requests, DPIAs, and consultations with the ICO, insofar as possible via product features (export, access controls, deletion) and reasonable support.

10. Breach notification

The Processor will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with information reasonably available to support the Customer's own notification duties.

11. Deletion and return

The Customer must export care records before the contract ends. Adult care records are often kept for years under the Customer's own duties. The product default, about 30 days after the contract ends, is only when the processor deletes its copy. It is not the Customer's legal retention period. After that export window the Processor deletes or returns Customer Data, except where the Order Form states a longer period or the law requires the processor to keep a copy.

12. Audits

Upon reasonable written notice, the Processor will make available information necessary to demonstrate compliance with this DPA (security summaries, questionnaire responses). On-site audits require mutual agreement on scope, timing, and cost.

13. Governing law

This DPA is governed by the law specified in the Master Terms / Order Form (typically England and Wales for UK facility customers).