Data Processing Agreement

1. Subject matter and duration

This agreement covers the processing of personal data, including special category health data, via the CareStead platform, for the duration of your subscription plus a data export window of at least 30 days after termination.

2. Processor obligations

• Process personal data only on your documented instructions.
• Ensure staff who access personal data are bound by confidentiality.
• Implement appropriate technical and organisational measures, including encryption in transit, role-based access control, row-level security, and append-only audit logs.
• Assist with data subject requests and data protection impact assessments.
• Delete or return personal data at the end of the contract, unless retention is required by law.
• Notify you without undue delay of any personal data breach, and within 72 hours where feasible.

3. Sub-processors

Our current sub-processor list is published at carestead.co.uk/legal/sub-processors. We give at least 30 days’ notice before adding a new sub-processor, and you may object on reasonable grounds relating to data protection.

4. Audits

You may audit our processing activities on reasonable notice, no more than once per year, or request a summary report in lieu of an on-site audit.

5. International transfers

We do not transfer personal data outside the UK/EEA without an adequacy decision or appropriate safeguards such as the UK International Data Transfer Addendum.

Annex A — Processing details

Annex B — Sub-processors

See the current, versioned list at /legal/sub-processors.

Contact

For a signed copy of this DPA or questions about it, email legal@carestead.co.uk.