Data processing agreement

1. Parties and scope

This agreement is between the organisation that uses the Pathlyn platform under our platform terms (the “Customer”), as controller, and Pathlyn Ltd (“Pathlyn”), as processor.

It forms part of the agreement between the Customer and Pathlyn and applies whenever Pathlyn processes personal data on the Customer's behalf. On data protection matters it takes priority over the platform terms.

2. Definitions

• “Data Protection Law”: the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any law that replaces them.
• “Customer Personal Data”: personal data that Pathlyn processes on the Customer's behalf, as described in Annex 1.
• “Sub-processor”: another processor that Pathlyn engages to process Customer Personal Data.
• “Anonymised Data”: information derived from Customer Personal Data that no longer relates to an identified or identifiable person.
• Other terms, such as “controller”, “processor”, “personal data breach” and “special category data”, have the meanings given in Data Protection Law.

3. Roles

The Customer is the controller of Customer Personal Data and Pathlyn is its processor. Pathlyn is a controller only of the limited information described in its privacy notice, such as staff sign-in records kept for security and the Customer's billing contacts.

4. The Customer's obligations

The Customer confirms that it has a lawful basis for the processing, including a condition under Article 9 of the UK GDPR for health data (usually the provision of health care under Article 9(2)(h)). It also confirms that it gives its Patients a privacy notice explaining the processing, that it does not instruct Pathlyn to do anything unlawful, and that it is responsible for the accuracy of the data it enters and for the way it configures the platform.

5. Pathlyn's obligations

Pathlyn will:

• process Customer Personal Data only on the Customer's documented instructions, which are this agreement, the platform terms and the Customer's use and configuration of the platform, unless the law requires otherwise, in which case Pathlyn will tell the Customer first unless the law forbids it;
• tell the Customer promptly if it believes an instruction breaks Data Protection Law;
• make sure that everyone authorised to process Customer Personal Data is bound by confidentiality;
• apply the technical and organisational security measures in Annex 2;
• help the Customer, through the platform and otherwise, to respond to requests from people exercising their data protection rights;
• help the Customer meet its obligations on security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the nature of the processing;
• keep a record of its processing activities on the Customer's behalf.

6. Sub-processors

The Customer gives general authorisation for Pathlyn to use Sub-processors, and approves those listed in Annex 3. Pathlyn will give at least 30 days' notice before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may end the affected part of the service without penalty.

Pathlyn will put a written contract in place with each Sub-processor that gives Customer Personal Data the same protection as this agreement, and remains responsible to the Customer for each Sub-processor's performance.

7. International transfers

Customer Personal Data is hosted in Germany (European Economic Area), with Hetzner Online GmbH. Pathlyn will not transfer Customer Personal Data outside the UK and the European Economic Area, or allow a Sub-processor to, unless the transfer is covered by UK adequacy regulations or an appropriate safeguard such as the ICO's International Data Transfer Agreement or its Addendum to the EU standard contractual clauses.

8. Personal data breaches

Pathlyn will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as it is known, the nature of the breach, the categories and approximate numbers of people and records affected, the likely consequences, and the measures taken or proposed. Pathlyn will give further information as it becomes available and will cooperate with the Customer's investigation.

The Customer decides whether to notify the ICO and the people affected. Pathlyn will not notify them on the Customer's behalf without its agreement unless the law requires it.

9. Anonymised data

The Customer instructs and authorises Pathlyn to create Anonymised Data from Customer Personal Data, following the ICO's guidance on anonymisation, and to use it to operate, secure and improve the platform and to produce aggregated statistics. Pathlyn will:

• never attempt to re-identify any person from Anonymised Data, or combine it with other information in order to do so;
• never publish statistics that identify the Customer without its consent;
• never sell personal data.

Anonymised Data is not personal data. Pathlyn may keep it after this agreement ends.

10. Information and audits

Pathlyn will make available the information reasonably needed to show that it complies with this agreement. The Customer, or an independent auditor bound by confidentiality, may audit that compliance once a year on 30 days' written notice, during business hours and with minimal disruption, or at any time after a personal data breach. Current security certifications and audit reports may be provided instead where they answer the Customer's questions.

11. Return and deletion

When the agreement ends, the Customer can export its Customer Personal Data for 30 days. Pathlyn will then delete it, including the Customer's separate clinical record store, within a further 60 days, unless the law requires it to be kept. Copies in backups are deleted as the backups expire, and are protected until then. Pathlyn will confirm the deletion in writing on request.

12. Liability and duration

Each party's liability under this agreement is subject to the limitations in the platform terms, except where Data Protection Law does not allow liability to be limited. This agreement lasts for as long as Pathlyn processes Customer Personal Data.

Annex 1: Details of the processing

Annex 2: Security measures

• Hosting in ISO 27001-certified data centres in Germany.
• Each Customer's clinical records are held in a separate record store, and every request is checked on the server against the Customer and the user's role before any record is returned.
• Two-factor authentication for all staff; access by role (organisation administrator, prescriber, operations); Pathlyn's own administrators cannot open patient records.
• Encryption in transit (TLS 1.2 or higher) and encrypted backups.
• Audit logs of clinical, prescribing and administrative actions.
• Daily backups, with restores tested regularly.
• Prompt security updates for the operating system and software dependencies.
• Confidentiality obligations for everyone with access, and access removed promptly when it is no longer needed.
• A documented process for responding to security incidents and personal data breaches.

Annex 3: Sub-processors

These are not Pathlyn's Sub-processors, because the Customer contracts with them directly: Stripe, which processes Patient payments through the Customer's own Stripe account, and the Customer's pharmacy, which dispenses and delivers prescriptions.