This Data Processing Agreement forms part of the agreement between Therapy Diary App and each therapist using the service where Therapy Diary App processes personal information on the therapist’s behalf.
1. Agreement and parties
This Data Processing Agreement (“DPA”) applies between [FULL LEGAL NAME], a sole trader trading as Therapy Diary App (“Therapy Diary App”, “we”, “us” or the “Processor”), and the therapist or therapy practice using the service (the “Therapist” or “Controller”).
This DPA applies whenever Therapy Diary App processes personal information on behalf of the Therapist through the Therapy Diary App service.
This DPA forms part of the Therapy Diary App Terms of Service. By entering into the Terms of Service and using Therapy Diary App to process client information, the parties agree to this DPA.
If there is a conflict between this DPA and the Terms of Service concerning the processing of personal information on behalf of the Therapist, this DPA will take priority in relation to that processing.
2. Data-protection roles
The Therapist normally determines why and how information about their clients is collected and used. For that information, the Therapist acts as the controller.
Therapy Diary App processes that information on behalf of the Therapist in order to provide the service and therefore acts as the processor.
Therapy Diary App remains a separate controller for information it processes for its own purposes, such as therapist account, billing, security and support information. That processing is covered by the Therapy Diary App Privacy Policy and is not governed by this DPA.
3. Details of the processing
| Subject matter | Personal information about clients entered into or processed through Therapy Diary App by or on behalf of the Therapist. |
|---|---|
| Duration | For the duration of the Therapist’s account and for the limited period required to return, delete or remove information from active systems and backups following termination. |
| Nature of processing | Collection, recording, organisation, storage, retrieval, display, updating, scheduling, transmission where required to provide the service, backup and deletion. |
| Purpose | To provide diary, appointment-management, client-management, self-booking, client-portal and related communication functionality requested by the Therapist. |
| People concerned | Clients and prospective clients whose information is entered into Therapy Diary App by the Therapist or by the individual through booking or client-portal features. |
| Personal information | Client names, email addresses, appointment dates and times, appointment duration, booking and cancellation information, client account and authentication identifiers, self-booking permissions and other information that the Therapist chooses to enter into available fields. |
Therapy Diary App is designed as a diary and appointment-management service. It does not provide dedicated fields for diagnoses, symptoms, treatment records or clinical therapy notes.
Therapists should not enter unnecessary health information, detailed clinical records or therapy notes into general appointment fields.
4. Processing on the Therapist’s instructions
Therapy Diary App will process personal information covered by this DPA only on documented instructions from the Therapist, unless processing is required by applicable law.
The Therapist instructs Therapy Diary App to process client information as necessary to provide and maintain the features of the service that the Therapist chooses to use.
Instructions may also be provided through the Therapist’s use and configuration of the service or through written communications with Therapy Diary App.
If applicable law requires Therapy Diary App to process information other than on the Therapist’s instructions, we will inform the Therapist before doing so unless the law prohibits us from providing that information.
The Therapist’s responsibilities
The Therapist is responsible for ensuring that:
- their instructions comply with applicable data-protection law;
- personal information is collected lawfully;
- an appropriate lawful basis is identified;
- clients receive appropriate privacy information;
- information entered into the service is relevant and appropriate;
- any required conditions for processing special-category information are satisfied; and
- Therapy Diary App is not instructed to process information in an unlawful manner.
5. Confidentiality
Therapy Diary App will ensure that people authorised to process personal information covered by this DPA are subject to an appropriate duty of confidentiality.
Access to client information will be limited to people who require access in order to operate, maintain, secure or support the service.
6. Security
Therapy Diary App will implement appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Measures may include, where appropriate:
- account authentication and access controls;
- encrypted network connections;
- restricted administrative access;
- security logging and monitoring;
- backup and recovery procedures;
- software updates and vulnerability management;
- appropriate password protection;
- data minimisation; and
- confidentiality requirements.
Security measures will take account of the nature of the information processed, available technology, implementation costs and the risks to individuals.
7. Sub-processors
The Therapist gives Therapy Diary App general written authorisation to use sub-processors where reasonably necessary to provide, host, secure or support the service.
Therapy Diary App will ensure that each sub-processor that processes personal information on behalf of the Therapist is bound by written data-protection obligations providing an appropriate level of protection for that information.
Therapy Diary App remains responsible for the performance of its sub-processors in relation to the processing covered by this DPA as required by applicable data-protection law.
Our current sub-processors, the services they provide and information about where they process data are listed on our Subprocessors page.
Therapy Diary App may update its sub-processors as the service develops. Where required, we will provide reasonable notice of material changes so that the Therapist can raise legitimate data-protection concerns about a new sub-processor.
8. Helping with individual rights
Taking into account the nature of the processing, Therapy Diary App will provide reasonable assistance to help the Therapist respond to requests from individuals exercising their data-protection rights.
These rights may include access, correction, deletion, restriction, objection and data portability where applicable.
If Therapy Diary App receives a request directly from one of the Therapist’s clients relating to information controlled by the Therapist, we will normally direct that individual to the Therapist and may notify the Therapist of the request.
9. Assistance, security incidents and breaches
Taking into account the nature of the processing and the information available to us, Therapy Diary App will provide reasonable assistance to the Therapist with applicable data-protection obligations relating to:
- security of processing;
- personal-data breaches;
- data-protection impact assessments; and
- consultation with a supervisory authority where legally required.
Personal-data breaches
Therapy Diary App will notify the Therapist without undue delay after becoming aware of a personal-data breach affecting personal information processed on the Therapist’s behalf.
Where reasonably available, we will provide information necessary to help the Therapist assess the breach and meet any applicable notification obligations.
10. International transfers
Therapy Diary App will not transfer personal information covered by this DPA outside the United Kingdom except as permitted by applicable data-protection law and in accordance with the Therapist’s documented instructions, including the instructions contained in this DPA.
Where an international transfer requires additional safeguards, Therapy Diary App will use an appropriate lawful transfer mechanism. This may include a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another legally permitted safeguard.
11. Return and deletion of information
When the Therapist’s account ends, Therapy Diary App will, at the Therapist’s choice and subject to applicable law, return or delete personal information processed on the Therapist’s behalf.
Requests for the return of information should be made before deletion from the service. Therapy Diary App will provide the information in a reasonably usable electronic format where technically practicable.
Client information will normally be removed from active systems within [CLIENT DATA DELETION PERIOD] following account closure, unless a longer period is required by law or reasonably necessary to complete an agreed return of the information.
Remaining backup copies will be removed through the normal backup rotation process within [BACKUP RETENTION PERIOD] .
Where immediate deletion from a backup is not technically practicable, the information will remain protected and will not be restored or otherwise processed except where necessary for disaster recovery or as required by law.
12. Compliance information and audits
Therapy Diary App will make available information reasonably necessary to demonstrate compliance with the processor obligations applicable under this DPA and Article 28 of the UK GDPR.
Therapy Diary App will allow for and contribute to reasonable audits or inspections by the Therapist or an independent auditor appointed by the Therapist where necessary to demonstrate compliance.
Audits must, where reasonably possible, be arranged with reasonable advance notice, take place during normal business hours, respect the confidentiality and security of other customers and avoid unnecessary disruption to the service.
Where appropriate, Therapy Diary App may first satisfy an audit request by providing relevant security, compliance or data-protection information.
13. Instructions that may breach data-protection law
If Therapy Diary App believes that an instruction from the Therapist infringes applicable UK data-protection law, we will inform the Therapist without undue delay.
Therapy Diary App may suspend the affected processing where reasonably necessary while the parties clarify or correct the instruction.
14. General terms
The terms “controller”, “processor”, “personal data”, “processing”, “personal-data breach” and “data subject” have the meanings given to them under applicable UK data-protection law.
This DPA remains in effect for as long as Therapy Diary App processes personal information on behalf of the Therapist.
We may update this DPA where necessary to reflect changes to the service, our sub-processors or applicable data-protection law. Where a change materially affects the Therapist’s data-protection rights or obligations, we will provide appropriate notice.
This DPA is governed by the same law and jurisdiction provisions as the Therapy Diary App Terms of Service.
15. Contact
Questions about this DPA or the processing of personal information on behalf of a Therapist can be sent to:
[FULL LEGAL NAME] trading as Therapy Diary App [BUSINESS ADDRESS] [PRIVACY EMAIL]