This Addendum forms part of the Services Agreement between Vahue Ltd and the Customer. It applies whenever we process Customer Personal Data on the Customer’s behalf, and it is intended to meet the requirements of Article 28 of the UK GDPR. If it conflicts with the Services Agreement on data protection, this Addendum takes priority.
1. Definitions
“Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where they apply to the Customer, the EU GDPR and other national laws. “Controller”, “Processor”, “Personal Data”, “Data Subject”, “Personal Data Breach” and “Processing” have the meanings given in that law. “Customer Personal Data” means Personal Data we process for the Customer through the service, and “Sub-processor” means another processor we engage to help with that processing.
2. Roles and purposes
The Customer is the Controller of Customer Personal Data, and we are its Processor. Annex A describes the data, the people it relates to, and the purposes of the processing. Where a group of clinics shares an account, the Customer confirms that it can give instructions on behalf of each of them.
We are a Controller for a limited set of data about our own customer relationship, such as account contacts and billing, as described in our Privacy Policy.
3. The Customer’s obligations
The Customer is responsible for having a lawful basis and an Article 9 condition for processing health data, for the accuracy of the data, for telling patients about the processing, including any use of AI, and for carrying out a data protection impact assessment where one is needed.
4. Our obligations
We will:
- process Customer Personal Data only on the Customer’s documented instructions, including this Addendum and the Customer’s use of the service, unless the law requires otherwise, in which case we will say so if we can;
- make sure that everyone authorised to process it is bound by confidentiality;
- keep the technical and organisational measures in Annex B in place;
- tell the Customer if we believe an instruction breaks Data Protection Law;
- make available the information needed to show we meet this Addendum, and allow for audits as set out in section 11.
5. No sale of data
We do not sell Customer Personal Data, and we do not use it for our own marketing or advertising.
6. Data subject rights
Patients make requests to their clinic. If one reaches us directly, we will pass it to the Customer without responding ourselves, unless the law requires us to. The service lets the Customer find, correct, export and delete data, and we will give reasonable further help where it cannot do so itself.
7. Personal data breaches
We will notify the Customer without undue delay, and in any case within [48] hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. We will tell the Customer what we know, as we learn it, so it can meet its own duties to the Information Commissioner’s Office and to patients.
8. Location and transfers
Customer Personal Data for UK customers is hosted in the [UK (AWS London region)]. If we or a Sub-processor transfer it outside the UK, we will use a lawful transfer mechanism, as described in Annex C.
9. Sub-processors
The Customer authorises the Sub-processors listed at [sub-processor list URL]. We will give at least [30] days’ notice before adding or replacing one, and the Customer may object on reasonable data protection grounds. We will bind each Sub-processor to obligations that are no less protective than these, and we remain liable for its performance.
10. Artificial intelligence
AI features process Customer Personal Data only to provide the service to the Customer. We do not use Customer Personal Data to train general-purpose AI models, and we require our AI Sub-processors not to do so. The Customer controls which AI features are on, and how much each may do without review.
11. Audits
We will answer reasonable written questions about our data protection measures, and share relevant reports and evidence under confidentiality. If that is not enough to meet a legal requirement, or a regulator requires it, the Customer may carry out an audit once a year on [30] days’ notice, during business hours, without disrupting the service or seeing other customers’ data.
12. Term, return and deletion
This Addendum lasts as long as we process Customer Personal Data. When the Services Agreement ends, the Customer can export its data for [30] days. We will then delete the data, with backups following within [90] days, unless the law requires us to keep it. Health record retention remains the Customer’s responsibility, so it should export its records before that window closes.
13. Liability and general
Each party’s liability under this Addendum is subject to the limits in the Services Agreement, except where the law does not allow this. This Addendum is governed by the same law as the Services Agreement.
Annex A. Processing details
| Item | Details |
|---|---|
| Subject matter | Providing Sovica, the clinic management and AI service, to the Customer. |
| Duration | The term of the Services Agreement, and the deletion period after it. |
| Purposes | Booking, intake and forms, clinical notes, payments and insurance claims, patient messages, recalls, workflows, AI features, reporting and support. |
| Data subjects | Patients and enquirers, their carers and contacts, and the Customer’s staff. |
| Personal data | Identity and contact details, appointments, billing and insurance details, messages, call recordings and transcripts where enabled, and account and usage data. |
| Special category data | Health data, including clinical notes, consent forms, photographs, prescriptions and lab results, and any other special category data the Customer records. |
Annex B. Security measures
- Encryption of data in transit and at rest.
- Logical separation of each customer’s data, enforced at database level.
- Role-based access, multi-factor authentication and an audit trail of activity in the service.
- Restricted, logged access for our own staff, granted only where needed.
- Regular backups, and tested recovery procedures.
- Vulnerability management, independent testing, and an incident response process.
- [Further measures and any certifications, to be confirmed before publication.]
Annex C. International transfers
Where a transfer from the UK is not covered by UK adequacy regulations, the parties rely on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, as issued by the Information Commissioner, along with a transfer risk assessment. Where the EU GDPR applies, the EU standard contractual clauses apply to transfers it restricts.