Practice Data Processing Agreement

This data processing agreement (DPA) forms part of the agreement between the Controller and Azimuth Associates LTD t/a Unpack for the provision of Unpack.

It applies only where and to the extent that Azimuth Associates LTD t/a Unpack processes personal data on the Controller’s behalf. It does not alter or limit those situations in which Azimuth Associates LTD t/a Unpack acts as an independent controller for its own account, administrative, billing, security or legal-compliance purposes, as described in the Privacy Policy.

This DPA is framed by the UK GDPR and the Data Protection Act 2018. Both the law and regulatory guidance can change, and the parties acknowledge that this DPA may need updating to reflect that.

The Controller determines the purposes and means of the processing carried out on its behalf, and remains responsible for:

• the lawfulness of the processing and its Article 6 lawful basis;
• identifying an Article 9 condition where special category health data is involved;
• transparency information given to patients, staff and other data subjects;
• the authority or consent required before recording patients or colleagues, where applicable;
• deciding whether a data protection impact assessment is required.

The Processor processes Controller personal data only on the Controller’s documented instructions. The Controller’s instructions consist of this DPA, the service agreement, and the Controller’s and its users’ use and configuration of Unpack features. Where UK law requires the Processor to process personal data otherwise, the Processor will inform the Controller of that legal requirement before processing, unless the law prohibits it.

The Processor will tell the Controller without undue delay if, in its opinion, an instruction infringes applicable data protection law.

The Processor ensures that people authorised to process Controller personal data are bound by an appropriate duty of confidentiality, whether contractual or statutory, and that access is limited to those who need it to provide, support or secure the service.

The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing.

The measures are set out in full in the Security & Technical Measures statement, which is intended to become Schedule 2 to this agreement once reviewed. In summary, the measures currently in place are:

• authenticated access to the application;
• row-level access policies in the Supabase database;
• encryption of data in transit using TLS;
• use of managed infrastructure with the provider’s own access controls;
• restricted production access and server-side handling of secrets, as described in the current Privacy Policy;
• administrative and audit logging where implemented;
• account and content deletion controls available to users;
• an optional on-device biometric lock in the iOS app.

For the avoidance of doubt, the Processor makes no claim of end-to-end or application-level encryption of transcripts, and makes no claim to hold ISO 27001, Cyber Essentials or SOC 2 certification or to have completed an independent penetration test. Any such claim will only be made once it is verifiably true.

The Processor may update its security measures over time, provided the overall level of protection is not materially reduced.

The Controller gives the Processor general written authorisation to engage the subprocessors listed in the current Subprocessor Register.

The Processor will give the Controller reasonable prior written notice of any intended addition or replacement of a subprocessor that processes Controller personal data, and will allow the Controller a reasonable opportunity to object on legitimate data-protection grounds.

The Processor will put in place a written arrangement with each subprocessor imposing data protection obligations equivalent in substance to those set out in this DPA, and remains responsible to the Controller for the performance of its subprocessors to the extent required by applicable law and the parties’ contract.

The Processor does not assert that every existing vendor contract already contains each of these clauses. Where a provider term has not been verified directly by the Processor, this is stated in the Subprocessor Register rather than assumed.

Controller personal data held in Unpack’s core database, authentication and file storage is hosted inside the European Union, in the AWS eu-central-1 region (Frankfurt, Germany).

The Processor will not make a restricted transfer of Controller personal data except in accordance with applicable UK data protection law and, where required, using an appropriate transfer mechanism — for example a finding of adequacy, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any transfer risk assessment required.

The Processor does not assert which mechanism applies to each provider until that has been verified. The Subprocessor Register records the verified transfer position for each provider as that information becomes available. The EU location of the core data store does not mean that all processing remains in the EU: AI, transcription, network and application-platform providers may process personal data in other locations as described in that register.

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, to fulfil the Controller’s obligation to respond to requests to exercise data subject rights, including access, rectification, erasure, restriction, portability and objection.

If the Processor receives a request directly from a data subject that relates to Controller personal data, it will forward that request to the Controller without undue delay unless legally prohibited from doing so, and will not respond independently as if it were the Controller without the Controller’s authorisation. This does not affect the Processor’s handling of requests about personal data for which it is itself the controller.

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data.

The Processor will provide the information reasonably available to it to assist the Controller in meeting its obligations under Articles 33 and 34, and will take appropriate steps to investigate, contain and remediate the incident.

No fixed notification deadline in hours is stated here, because no such internal service level has yet been documented and tested.

Taking into account the nature of the processing and the information available to it, the Processor provides reasonable assistance to the Controller with data protection impact assessments and any prior consultation with the ICO.

The Processor will provide due-diligence information reasonably needed by the Controller for its own data protection governance.

At the end of the provision of services, at the Controller’s choice and subject to technical capability and the agreed service terms, the Processor will delete or return Controller personal data and delete existing copies, unless UK law requires continued storage.

Reflecting the current architecture of the service:

• audio recordings are retained only until processing has completed successfully, and failed-audio expiry is designed for seven days, but the scheduled sweep was missing at audit. Verified remediation remains outstanding; no seven-day deletion guarantee is made;
• account deletion is subject to a 30-day grace period;
• backups may persist until they expire on their routine cycle;
• material shared at practice level, or held in de-identified or aggregated form, requires treatment according to role and contract rather than simple per-user deletion.

The current position for each data type, and the periods still to be formally agreed, are set out in the Data Retention Schedule. That schedule is a working document; the periods marked outstanding there must be agreed before final execution of this agreement.

The Processor will make available to the Controller the information reasonably necessary to demonstrate compliance with Article 28, and will allow for and contribute to reasonable audits and inspections conducted by the Controller or an auditor it mandates.

Such audits are subject to reasonable notice, confidentiality obligations, the Processor’s security requirements, minimising disruption to the service, and avoiding access to other customers’ data.

Where independent audit or certification reports become available in future, the parties may agree that reasonable reliance on them satisfies part of this clause. No such report is available today.

The Controller is responsible for:

• the lawfulness of the processing it instructs, and its Article 6 and, where relevant, Article 9 basis;
• privacy notices and transparency to patients, staff and participants;
• its own rules on recording patients and colleagues;
• data minimisation in what its users record, import or upload;
• managing user access, roles and offboarding within its Unpack account;
• its clinical and professional record-keeping obligations, which Unpack does not replace;
• deciding on and carrying out any DPIA;
• handling data subject rights requests and keeping data accurate;
• the accuracy and lawfulness of the instructions it gives.

The Controller must not instruct the Processor to process personal data unlawfully.

Liability between the parties is governed by the main commercial agreement and applicable law. No indemnity or liability cap is created or varied by this DPA.

Where there is a conflict between this DPA and the main commercial agreement in relation to data-processing obligations, this DPA prevails to the extent required by data protection law.

This DPA may be updated where required by changes in law, regulatory guidance, or the architecture of the underlying providers, with appropriate notice to the Controller.

Any material change to the nature of the processing, or to the subprocessors engaged, is handled under the service agreement and under clause 6 above.

This section records the parties’ signatures. Unpack does not currently provide electronic signature of this document.