Status: DRAFT for review. This Data Processing Agreement is a working draft prepared to give the platform a complete controller–processor framework. It must be reviewed and approved by a qualified data protection adviser (and the Data Protection Officer) before it is relied upon or countersigned. It does not yet constitute legal advice or a concluded contract.
This Data Processing Agreement ("DPA") forms part of, and is subject to, the Terms & Conditions between RefClin ("Processor", "RefClin", "we") and the practice, clinic or organisation that has accepted those Terms and uses RefClin (the "Controller", "you"). It governs the Processing of Personal Data carried out by RefClin on your behalf. Where this DPA conflicts with the Terms in respect of data protection, this DPA prevails.
1. Definitions
Terms such as "Personal Data", "Special Category Data", "Processing", "Controller", "Processor", "Data Subject", "Sub-processor" and "Personal Data Breach" have the meanings given in UK GDPR — the retained EU General Data Protection Regulation (Regulation (EU) 2016/679) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018 — and the Data Protection Act 2018 (together, "Data Protection Law"). "Patient Data" means Personal Data relating to a Data Subject who is a patient of the Controller, including Special Category Data concerning health.
2. Roles of the parties
2.1 The Controller determines the purposes and means of Processing Patient Data and is the Controller of that data. RefClin acts solely as Processor of Patient Data, Processing it only on the Controller's documented instructions.
2.2 The Data Subjects are the Controller's patients (and, where relevant, its staff whose data the Controller enters). RefClin does not have, and does not seek, a direct relationship with those Data Subjects, and does not determine the purposes of Processing their Patient Data.
2.3 Where a referral is sent to another practice or specialist through the platform, each practice is an independent Controller of the Patient Data it holds. RefClin remains Processor for both. The transmitting Controller is responsible for having a lawful basis and, where required, the patient's consent to share that data with the receiving Controller (see the referral consent recorded in-app).
2.4 For RefClin's own business data (staff accounts, billing, support and consented analytics), RefClin is the Controller; that Processing is described in the Privacy Policy and is outside the scope of this DPA.
3. Scope, subject-matter and duration
3.1 The subject-matter, nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects are set out in Schedule 1 (Details of Processing).
3.2 This DPA applies for as long as RefClin Processes Personal Data on the Controller's behalf, and survives termination of the Terms until all such Personal Data has been returned or deleted in accordance with clause 11.
4. The Controller's obligations
4.1 The Controller warrants that it has a valid lawful basis under Article 6 and, for Special Category (health) Data, a valid condition under Article 9 (typically Article 9(2)(h) — the provision of health or social care) for all Personal Data it submits, and that it has provided all privacy information and obtained any consent required (including, for external referrals, the patient's consent to share data with the receiving practice).
4.2 The Controller's instructions to RefClin are constituted by this DPA, the Terms, and its configuration and use of the platform's features. The Controller must not instruct RefClin to Process Personal Data in breach of Data Protection Law.
5. The Processor's obligations
RefClin shall:
(a) Process only on documented instructions — Process Personal Data only on the Controller's documented instructions (including regarding international transfers), unless required to do otherwise by law, in which case it will inform the Controller first unless the law prohibits it;
(b) Confidentiality — ensure that persons authorised to Process the Personal Data are bound by an appropriate duty of confidentiality;
(c) Security — implement the technical and organisational measures set out in Schedule 2 to ensure a level of security appropriate to the risk, taking account that the data includes Special Category (health) Data (Article 32);
(d) Sub-processors — engage Sub-processors only under clause 8;
(e) Assist with Data Subject rights — taking into account the nature of the Processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, to fulfil its obligation to respond to requests to exercise Data Subject rights (access, rectification, erasure, restriction, portability and objection). RefClin will promptly notify the Controller if it receives such a request directly and will not respond to it itself except on the Controller's instructions;
(f) Assist with compliance — assist the Controller in ensuring compliance with its obligations under Articles 32–36 (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of Processing and the information available to RefClin;
(g) Deletion or return — at the Controller's choice, delete or return all Personal Data at the end of the provision of services, as set out in clause 11;
(h) Records and audits — make available to the Controller all information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits as set out in clause 10.
6. Special Category (health) Data
The parties acknowledge that Patient Data includes Special Category Data concerning health. RefClin applies enhanced safeguards to it: encryption in transit and at rest, strict per-tenant isolation, role-based least-privilege access, and append-only audit logging of access and changes. Patient clinical data is not used for any purpose other than delivering the service to the Controller, and is never used to train third-party AI models.
7. International transfers
7.1 RefClin stores and Processes Patient Data within the United Kingdom or the European Economic Area. RefClin will not transfer Patient Data outside the UK/EEA without the Controller's prior authorisation, except as set out in Schedule 3 or as required by law.
7.2 Where a Sub-processor Processes Personal Data outside the UK/EEA, RefClin ensures an appropriate transfer mechanism is in place — an adequacy decision, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses — together with any supplementary measures required following a transfer risk assessment.
7.3 The AI drafting and document-extraction feature uses a US-based Sub-processor (OpenAI) under contractual data-protection terms; the relevant transfer safeguards and the data-minimisation applied to that feature are recorded in Schedule 3 and the DPA register. This feature Processes only the content the Controller submits for drafting and is subject to the "no model training" commitment in clause 6.
8. Sub-processors
8.1 The Controller gives general written authorisation to RefClin to engage the Sub-processors listed in Schedule 3 to Process Personal Data.
8.2 RefClin will impose on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and remains fully liable to the Controller for the Sub-processor's performance.
8.3 RefClin will give the Controller reasonable prior notice of any intended addition or replacement of a Sub-processor, giving the Controller the opportunity to object on reasonable data-protection grounds. If the parties cannot resolve an objection, the Controller may terminate the affected part of the service.
9. Personal Data Breach
9.1 RefClin will notify the Controller without undue delay, and in any event within 48 hours, of becoming aware of a Personal Data Breach affecting the Controller's Personal Data.
9.2 The notification will describe, to the extent known: the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. RefClin will provide further information as it becomes available and will cooperate with the Controller so the Controller can meet its own notification duties to the ICO and, where required, to affected Data Subjects. Determining whether the breach is notifiable to the ICO remains the Controller's decision.
10. Audit
RefClin will make available, on reasonable written request and no more than once per year (unless required by a supervisory authority or following a Breach), the information reasonably necessary to demonstrate compliance with this DPA, and will contribute to audits conducted by the Controller or an independent auditor it mandates, subject to reasonable confidentiality and security conditions and to not compromising other customers' data.
11. Return or deletion
On termination of the service, or earlier on the Controller's written request, RefClin will — at the Controller's choice — return the Personal Data in a commonly used format and/or securely delete it, together with existing copies, within 30 days, unless retention is required by law. Append-only audit logs required for security and accountability may be retained for the period stated in the Privacy Policy. On request, RefClin will certify deletion in writing.
12. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability agreed in the Terms. Nothing in this DPA limits any liability that cannot lawfully be limited.
Schedule 1 — Details of the Processing
- Subject-matter: provision of the RefClin clinical-referral platform.
- Duration: the term of the Terms, plus the return/deletion period in clause 11.
- Nature and purpose: hosting, transmitting, storing, organising and
displaying referral and consultation data and documents between practices; AI drafting of clinical letters at the Controller's request; and related support.
- Types of Personal Data: patient identifiers and demographics; contact
details; medical and dental history; clinical notes; radiographs and uploaded documents; referral and consent records; and Controller staff account data.
- Special Category Data: data concerning health.
- Categories of Data Subjects: the Controller's patients; the Controller's
clinicians and staff.
Schedule 2 — Technical and organisational measures (Article 32)
- Encryption of Personal Data in transit (TLS) and at rest.
- Strict logical isolation of each tenant's data, enforced in the application layer
and by database row-level security as a second line of defence.
- Role-based, least-privilege access control and individual authenticated accounts.
- Append-only audit logging of access to, and changes of, clinical records.
- Redaction of Personal Data from application logs.
- Secure software development, dependency management and change control.
- Regular backups with restricted, monitored access.
- Measures to restore availability and access to Personal Data in a timely manner
after an incident, and a process for regularly testing and evaluating the effectiveness of these measures.
Schedule 3 — Authorised Sub-processors
The current list of Sub-processors, the Processing they perform, and their location, is maintained in the platform's DPA register. As at the date of this draft it includes: object/document storage (S3-compatible, UK/EEA); transactional email delivery; and the AI drafting provider (OpenAI, United States, under contractual safeguards and the "no model training" commitment in clause 6). The authoritative, up-to-date register is available from privacy@refclin.ai.
Questions about this agreement or data protection generally: privacy@refclin.ai.