Data Processing Agreement

Parties

1. The Customer: the organisation named in the signature section of this Agreement, acting as data controller.
2. Novare, of Lewin Road, Streatham, SW16 6JZ, United Kingdom (support@novare-pwa.co.uk), provider of AI Protect for Health and Social Care, acting as data processor.

Background

The Customer subscribes to AI Protect for Health and Social Care (the Service). The Service is a browser extension, with related settings and administration features, that helps stop identifiable information about patients, service users and staff being shared with artificial intelligence (AI) tools. To provide parts of the Service, Novare may process personal data on the Customer's behalf. This Agreement sets out how Novare will do so, as required by Article 28 of the UK GDPR.

1. Definitions

In this Agreement: Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any other law relating to personal data that applies in the United Kingdom, as amended or replaced from time to time. Controller, processor, data subject, personal data, personal data breach, processing and special category data have the meanings given in the UK GDPR. Customer Personal Data means personal data that Novare processes on the Customer's behalf in providing the Service, as described in Schedule 1. A Sub-processor is any third party that Novare engages to process Customer Personal Data.

2. How the Service handles information

2.1 The Service checks text, and files attached to AI tools, on the Customer's own devices. That text and those files are never sent to Novare, and Novare cannot see them.

2.2 Names that the Customer chooses to always block are stored only as salted cryptographic fingerprints (SHA-256), not as readable names, whether they are held on the Customer's devices or on Novare's systems.

2.3 Where Customer Personal Data is held only on the Customer's own devices, Novare has no access to it. This Agreement applies to any Customer Personal Data that Novare does process, including through central administration features that store settings, fingerprint lists and activity counts on Novare's systems.

3. Roles

3.1 The Customer is the controller and Novare is the processor of Customer Personal Data.

3.2 Novare is the controller of the personal data it needs to run its own business, such as the contact details of the Customer's signatory and administrators, billing records and support correspondence. It handles that data under its privacy policy.

4. Novare's obligations

Novare will:

1. process Customer Personal Data only on the Customer's documented instructions, which are given by this Agreement and by the Customer's use and configuration of the Service, unless the law requires otherwise. If so, Novare will tell the Customer before processing, unless the law prevents this;
2. tell the Customer promptly if, in its opinion, an instruction breaks Data Protection Law;
3. ensure that anyone it authorises to process Customer Personal Data is bound by a duty of confidentiality;
4. take the technical and organisational security measures described in Schedule 2, as required by Article 32 of the UK GDPR;
5. use Sub-processors only as set out in clause 6;
6. taking into account the nature of the processing, help the Customer by appropriate technical and organisational measures to respond to requests from data subjects exercising their rights. Novare will pass any such request it receives to the Customer without undue delay and will not respond to it unless the Customer instructs it to;
7. help the Customer meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation with the Information Commissioner (Articles 32 to 36 of the UK GDPR), taking into account the nature of the processing and the information available to Novare;
8. at the end of the Service, delete all Customer Personal Data within 30 days, and remove it from backups within a further 35 days, unless the law requires Novare to keep it. On request before deletion, Novare will return any data that can be returned in a usable form. Fingerprint lists cannot be turned back into names;
9. make available all information reasonably needed to show compliance with this clause and with Article 28 of the UK GDPR, and allow and contribute to audits, including inspections. Audits will be on at least 30 days' written notice, no more than once in any 12 months unless a personal data breach has occurred, and will normally be met first by written answers and documents.

5. Personal data breaches

5.1 Novare will tell the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

5.2 The notice will include, as far as is known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to deal with it. Novare will provide further information as it becomes available.

5.3 Novare will co-operate with the Customer and take reasonable steps to contain and investigate the breach and reduce its effects. Unless the law requires otherwise, it is the Customer's decision, as controller, whether to notify the Information Commissioner or data subjects.

6. Sub-processors

6.1 The Customer gives general written authorisation for Novare to use the Sub-processors listed in Schedule 3.

6.2 Novare will tell the Customer at least 30 days before adding or replacing a Sub-processor. If the Customer objects on reasonable data protection grounds, the parties will discuss the objection in good faith. If it cannot be resolved, the Customer may end the Service without penalty.

6.3 Novare will impose data protection obligations on each Sub-processor that are no less protective than those in this Agreement, and remains responsible to the Customer for each Sub-processor's performance.

7. International transfers

7.1 Customer Personal Data stored by Novare is held in Google Cloud's London region (europe-west2).

7.2 Some parts of the Sub-processors' services operate globally. These include the network that delivers web pages and, where used, account sign-in. Novare will only transfer Customer Personal Data outside the United Kingdom where the transfer is permitted by Data Protection Law, for example under UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

8. The Customer's obligations

The Customer will:

1. make sure it has a lawful basis for the processing it instructs, and that its instructions comply with Data Protection Law;
2. tell its staff that the Service is installed on their devices and what it does, for example through its information governance or AI policy;
3. add only the names it needs to its block lists, and keep them up to date;
4. keep its own administrator accounts secure;
5. not include identifiable details of patients, service users or staff in support requests to Novare.

9. Liability

Each party is responsible for its own compliance with Data Protection Law. Nothing in this Agreement limits or excludes any liability that cannot be limited or excluded by law. Any limitations of liability in the subscription terms agreed between the parties also apply to this Agreement.

10. Duration and changes

10.1 This Agreement starts on the date it is signed and continues for as long as Novare processes Customer Personal Data. Clauses 4(h), 5 and 9 continue after it ends to the extent needed.

10.2 Novare may update this Agreement to reflect changes in Data Protection Law or guidance from the Information Commissioner, giving the Customer at least 30 days' written notice. Any other change requires the written agreement of both parties.

10.3 Novare intends to carry on the Service through a limited company. Novare may transfer its rights and obligations under this Agreement to that company, or to another company carrying on the Service, by giving the Customer written notice. The protections in this Agreement will continue unchanged.

10.4 If there is any conflict between this Agreement and any other agreement between the parties about the processing of Customer Personal Data, this Agreement takes priority.

11. Law

This Agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule 1: Details of the processing

Schedule 2: Security measures

• Data minimisation by design: text and files are checked on the Customer's devices and are never sent to Novare. Names are stored only as salted fingerprints.
• Encryption: all data is encrypted in transit (TLS) and at rest (Google Cloud default encryption).
• Location: the database is in Google Cloud's London region (europe-west2).
• Access control: database rules allow each organisation to reach only its own data. Novare's administrative accounts use multi-factor authentication, and access is limited to the people who need it.
• Monitoring and resilience: administrative access is logged, and backups are kept so that data can be restored.
• Secure development: changes are tested before release, including automated tests of the detection and access rules.
• Incident response: a documented breach procedure, in line with clause 5.
• Assurance: Novare is working towards Cyber Essentials certification and will tell the Customer when it is achieved.

Schedule 3: Authorised Sub-processors