1. Definitions

In this DPA the following terms have the meanings set out below:

• "Applicable Data Protection Law" means the UK GDPR (as defined in section 3(10) of the Data Protection Act 2018 as supplemented by section 205(4)), the Data Protection Act 2018, and any other applicable UK data protection legislation as amended from time to time.
• "Data Controller" means the clinic or practitioner who registers for and uses Clinic Insight and determines the purposes and means of processing personal data through the platform.
• "Data Processor" means Clinic Insight, which processes personal data on behalf of the Data Controller.
• "Personal Data" has the meaning given in the UK GDPR and includes all client, patient, and staff data entered into the platform.
• "Special Category Data" means personal data revealing health information, including medical history, treatment records, clinical notes, photographs, and any other health-related data entered into the platform.
• "Processing" has the meaning given in the UK GDPR.
• "Sub-processor" means any third party engaged by the Data Processor to process Personal Data in connection with the platform.

2. Roles and Responsibilities

The parties acknowledge that for the purposes of Applicable Data Protection Law:

• The Data Controller is responsible for determining the lawful basis for processing, obtaining necessary consents from data subjects (clients/patients), responding to data subject rights requests, and complying with all Data Controller obligations under Applicable Data Protection Law.
• The Data Processor (Clinic Insight) processes Personal Data only on behalf of and under the instructions of the Data Controller, as documented in this DPA and the platform's Terms of Service.

3. Nature and Purpose of Processing

Element	Details
Subject matter	Operation of an aesthetic clinic management platform
Duration	For the duration of the Data Controller's active account, plus any retention period required by law
Nature of processing	Storage, retrieval, display, analysis, PDF generation, transmission of transactional communications, and deletion of personal and special category data
Purpose	Client management, clinical record keeping, treatment planning, consent management, appointment scheduling, and practice analytics
Types of Personal Data	Names, contact details, dates of birth, photographs, medical history, treatment records, clinical notes, consent signatures, and session data
Categories of data subjects	Clients and patients of the Data Controller; clinic staff and practitioners

4. Data Processor Obligations

The Data Processor agrees to:

• Process Personal Data only on documented instructions from the Data Controller, unless required to do so by applicable law.
• Ensure that all personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.
• Implement and maintain appropriate technical and organisational security measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
• Not engage any Sub-processor without prior general authorisation from the Data Controller (a current list of Sub-processors is set out in section 7) and impose equivalent data protection obligations on each Sub-processor.
• Assist the Data Controller, insofar as reasonably possible, to respond to requests from data subjects exercising their rights under Applicable Data Protection Law.
• Assist the Data Controller in ensuring compliance with its obligations relating to security, breach notification, data protection impact assessments, and prior consultation.
• At the Data Controller's election, delete or return all Personal Data upon termination of the agreement, and delete existing copies unless storage is required by applicable law.
• Make available to the Data Controller all information necessary to demonstrate compliance with this DPA and permit audits (including inspections) conducted by the Data Controller or an auditor appointed by the Data Controller, subject to reasonable notice and confidentiality obligations.
• Notify the Data Controller without undue delay (and in any event within 72 hours where feasible) upon becoming aware of a Personal Data breach affecting the Data Controller's data.

5. Data Controller Obligations

The Data Controller agrees to:

• Ensure there is a lawful basis for all Personal Data entered into the platform, including obtaining valid consent from clients where required.
• Provide clients with appropriate privacy notices explaining how their data will be processed, including that a software platform processes data on the clinic's behalf.
• Ensure that any Special Category Data (health data) entered into the platform is processed in compliance with Article 9 UK GDPR.
• Maintain appropriate records of processing activities as required by Article 30 UK GDPR.
• Not instruct the Data Processor to process Personal Data in a way that would violate Applicable Data Protection Law.
• Comply with all applicable medical record-keeping obligations, including UK guidance on 7-year minimum retention for adult records.

6. Security Measures

The Data Processor implements and maintains the following technical and organisational measures:

• Encryption: Data is encrypted in transit using TLS 1.2 or higher. Databases are encrypted at rest.
• Access control: Multi-clinic data isolation ensures each clinic can only access its own data. Role-based access controls limit data access to authorised users.
• Authentication: Password hashing using industry-standard algorithms. Session-based authentication with secure session management.
• Data segregation: Complete logical separation of data between clinics (multi-tenancy isolation).
• Backups and recovery: The hosting and database providers maintain managed backup and recovery controls in accordance with their applicable service terms and data processing agreements. Provider-specific recovery windows and backup locations may vary by service plan.
• Audit logging: Key data actions (consent signing, data export, deletion) are logged with user and timestamp information.
• Vulnerability management: Regular security reviews and dependency updates.

7. Sub-processors

The Data Controller grants general authorisation for the Data Processor to engage the following Sub-processors. The Data Processor will notify the Data Controller of any intended changes (additions or replacements) and give the Data Controller an opportunity to object:

Sub-processor	Purpose	Location	Safeguards
Replit Inc.	Cloud hosting and infrastructure	USA	Standard Contractual Clauses (SCCs); SOC 2 compliance
Neon, Inc. / PostgreSQL hosting	Managed database storage, including account, client, clinical, consent, photograph, audit, and application analytics data	AWS us-west-2, Oregon, USA	Encryption at rest and in transit; access controls
Twilio Inc. (SendGrid)	Transactional email delivery, including recipient details, message content, attachments, and delivery events where applicable	Global service, including processing in the USA	Twilio Data Protection Addendum; applicable international transfer safeguards
Stripe	Subscription billing and payment processing. Clinic Insight does not receive or store full payment card numbers or security codes.	International processing, including the UK, EEA, USA, and service-provider locations	Stripe Data Processing Agreement; applicable international transfer safeguards
OpenAI (API)	AI-assisted consultation questions, SOAP/SBAR documentation, treatment suggestions, and assessment of medications, allergies or conditions not recognised by local safety rules. Depending on the feature, prompts may include health history, medicines, allergies, conditions, treatment history, skin type, concerns and free-form clinical notes. Free-form notes may contain identifying information entered by a user.	Processing may take place outside the UK; the account-specific processing region has not been verified.	API requests use encrypted connections. The account-specific data processing terms, retention controls and international transfer safeguards must be verified; UK-only processing or zero retention is not asserted.

AI processing: Clinical information may be sent to OpenAI when AI-assisted consultation features are used, and when a medical-history safety scan encounters an item not recognised by local rules. Medication-name lookup using NHS Scotland data is a separate process. AI output is decision support and does not replace a practitioner's clinical judgement. Stored client names are removed from some prompts, but free-form text cannot be guaranteed to contain no identifiers. OpenAI's published API documentation describes default abuse-monitoring retention of up to 30 days unless approved alternative controls apply; the settings for this account have not been verified. The Data Processor must verify its contractual and international transfer arrangements and notify affected Data Controllers of this sub-processor change, including an opportunity to object.

8. International Transfers

Where Personal Data is transferred outside the UK to a country not covered by UK adequacy regulations, the Data Processor will ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved for use under UK law (the UK International Data Transfer Agreement or UK Addendum to EU SCCs), or other lawful transfer mechanisms.

9. Data Retention and Deletion

• Personal Data is retained for the duration of the active account plus any legally required retention period.
• UK guidance recommends a minimum of 7 years for adult medical records. Data Controllers are responsible for ensuring their retention periods comply with applicable law.
• Accounts with no client/treatment records: upon termination, or upon a free trial ending without conversion to a paid subscription, the Data Processor will lock account access, send reminder notices, and retain Personal Data for 30 days to allow export, after which it will be securely deleted.
• Accounts with client or treatment records: the Data Processor will not delete Personal Data on a fixed timer after termination. Data will be retained securely in a paused state until the Data Controller requests export or deletion, or until the Data Controller's applicable clinical retention period has passed, consistent with the Data Controller's obligations under Section 7 above.
• Deletion from provider-managed backups is governed by each provider's applicable service terms, retention controls, and data processing agreement. Backup copies may remain for a limited period after deletion from the live service where required for security, recovery, or legal compliance.

10. Data Subject Rights

The Data Processor provides tools within the platform to assist the Data Controller in fulfilling data subject rights requests, including:

• Right of access: Client data export in CSV format available from the client profile.
• Right to erasure: Client deletion functionality with confirmation workflow available from the client profile.
• Right to rectification: Full client profile editing is available to authorised clinic users.

The Data Controller remains responsible for receiving, assessing, and responding to data subject rights requests within the statutory timeframes.

11. Personal Data Breaches

The Data Processor will notify the Data Controller without undue delay upon becoming aware of a Personal Data breach. Notification will include, where available, a description of the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed to address the breach.

The Data Controller is responsible for notifying the ICO (Information Commissioner's Office) where required under Article 33 UK GDPR, within 72 hours of becoming aware of the breach.

12. Term and Termination

This DPA remains in force for the duration of the Data Controller's use of the Clinic Insight platform. It automatically terminates when the Data Controller's account is closed. Obligations relating to the security and confidentiality of Personal Data processed prior to termination survive termination of this DPA.

13. Governing Law and Jurisdiction

This DPA is governed by the laws of England and Wales. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Contact

For any data protection queries, to exercise data subject rights, or to report a suspected breach, please contact:

• Data Protection contact: Clinic Insight — via the support contact provided within the platform
• ICO (supervisory authority): ico.org.uk · 0303 123 1113