Data Processing Agreement

1. Subject matter and duration

We process the Customer's personal data to provide the Service, for as long as the subscription lasts and for the 30-day export window after it ends.

2. Nature and purpose of processing

Hosting, storage, retrieval, structuring, display, export and deletion of records the Customer creates or uploads, and transmission of notifications to the Customer's own users. We do not use the Customer's personal data to train models, to build products, or for any purpose of our own.

Where a user of the Customer's account uses an assistive AI feature, processing also includes sending the prompt and the account content needed to answer it to the model providers named in the Sub-processors document, and returning the answer. That is processing on the Customer's instruction, given by the user each time they ask.

Where the Customer requests support, or where we must investigate a fault or a security incident, processing also includes access to the account by our authorised staff, including viewing the Service as one of the Customer's users sees it. Every such access is recorded and the record is available to the Customer.

3. Types of personal data

• •Staff data: names, work contact details, roles, training and acknowledgement records, supervision and competence notes the Customer chooses to record.
• •Data about people the Customer supports, where the Customer enters it: names or initials, room or reference identifiers, and the content of risk assessments, incident and audit records.
• •Special category data, where the Customer enters it: health and care information, and information capable of revealing disability. The Customer decides what to enter.
• •Uploaded files and evidence attachments, whose contents the Customer controls.

The Service does not require identifiable resident data to work. Risk assessments, incident records and audits can be recorded against initials or a reference. We recommend that, and the demonstration data is written that way deliberately. Minimising what goes in is the single most effective control available to the Customer, and it is the Customer's to exercise.

4. Categories of data subject

• •The Customer's employees, workers, volunteers and agency staff.
• •People the Customer supports, and their relatives or representatives where recorded.
• •Visiting professionals named in records.

5. Our obligations

1. 1.We process only on the Customer's documented instructions, which include use of the Service's features. Where we are required by law to process otherwise, we will tell the Customer first unless the law forbids it.
2. 2.Everyone we authorise to process the data is bound by a duty of confidentiality that survives the end of their engagement.
3. 3.We implement the technical and organisational measures described in the Security Statement, appropriate to the risk, and keep them under review.
4. 4.We assist the Customer, taking into account the nature of processing and the information available to us, with data subject requests, with security obligations, with breach notification, and with data protection impact assessments and prior consultation.
5. 5.At the Customer's choice we delete or return the personal data at the end of the contract, and delete existing copies unless law requires retention. Our default is deletion after the 30-day export window.
6. 6.We make available the information needed to demonstrate compliance with Article 28 and allow for and contribute to audits — see section 10.
7. 7.We tell the Customer immediately if, in our opinion, an instruction infringes data protection law.

6. Sub-processors

The Customer gives general authorisation for us to appoint sub-processors. The current list, what each does and where it processes, is published in the Sub-processors document.

We will give at least 30 days' notice by email and on that page before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a pro-rata refund of Charges paid for the unexpired term — an express exception to the no-refund rule in the Terms.

We impose on every sub-processor obligations no less protective than these, and we remain fully liable to the Customer for their performance.

On the AI model providers specifically, because it is the question every information governance lead asks. They are sub-processors, they are named, and they are contracted on zero-retention, no-training terms: the Customer's content is used to produce the answer and is not kept beyond that, and it is never used to train a model. If a provider changes that position we will treat it as a change of sub-processor, give the 30 days' notice, and the objection right in this section applies.

7. Automated processing and AI

The assistive AI features draft text and answer questions. They do not make decisions about any data subject, and no output is acted on without a person reviewing it. There is no solely automated decision-making producing legal or similarly significant effects within the meaning of Article 22.

The features are scoped to a single organisation's account. Retrieval is constrained to the requesting organisation's data and to our own library, and the constraint is enforced in the database by row-level security rather than only in the instructions given to the model — so a failure of the instruction layer does not become a failure of isolation.

The Customer decides what its users type into a prompt. We recommend, and the Acceptable Use Policy repeats, that identifiable detail about a person the Customer supports is not entered into a prompt where an initial or a reference would do.

Prompts and answers are retained for 90 days for abuse detection and fault diagnosis, then deleted.

8. International transfers

Primary hosting is in the United Kingdom and the European Economic Area. Where a sub-processor processes outside the UK we rely on UK adequacy regulations or, failing that, on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. We will not transfer the Customer's personal data outside the UK without one of those safeguards in place.

9. Personal data breaches

We will notify the Customer without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting their data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide everything at once we will provide it in phases without further undue delay.

The Customer, as controller, decides whether to notify the ICO within 72 hours and whether to tell the individuals concerned. That decision is not ours to make and we will not make it for them — but we will give them what they need to make it, quickly, and in writing.

The full procedure is in the Security Incident and Breach Response document.

10. Audit

On reasonable written notice, no more than once in any twelve months unless a breach or a regulator requires otherwise, we will respond to a written security questionnaire and provide our current security documentation. Customers completing the NHS Data Security and Protection Toolkit may use that material as supplier evidence.

An on-site or hands-on audit may be conducted at the Customer's cost, during business hours, subject to confidentiality, and arranged so that it does not compromise the security or confidentiality of other customers' data.

11. Liability

The limitation of liability in the Terms of Service applies to this Agreement, save that nothing here limits liability that cannot be limited by law.

Stated plainly because it is often misunderstood: a contractual cap between us governs claims between us. It has no effect on a data subject's right to bring a claim under Article 82 of the UK GDPR, or on a regulator's power to act against either party. Neither of us can contract that away, and neither of us should present the contract as though we had.

12. Order of precedence

If this Agreement conflicts with the Terms of Service on the processing of personal data, this Agreement prevails.

Contact for anything in this Agreement: hello@careshieldcompliance.co.uk.