Data Processing Agreement (UK GDPR)

Last Updated: 31 May 2026 Status: Effective from the "Last Updated" date (UK GDPR / Data Protection Act 2018).

This Data Processing Agreement ("DPA") is intended for use where DentiEasy Solutions LTD provides the DentiPlanner service to dental clinics, dental laboratories, and related customers (each, a "Customer") and processes Personal Data on the Customer’s behalf.

This DPA should be read together with the Terms of Service and any order form(s). It describes how we process Personal Data on behalf of Customers using the Service and may be updated from time to time as described herein.

1) Parties and Acceptance

1. Customer: the legal entity or individual that creates an account for, accesses, or uses the Service (the "Customer", acting as "Controller" for Customer Data, including Patient Data).
2. Processor: DentiEasy Solutions LTD (Company No. 16811814), 128 City Road, London, EC1V 2NX, United Kingdom ("Processor").

Controller and Processor are referred to together as the "Parties".

Acceptance. This DPA is accepted electronically. By subscribing to, accessing, or using the Service (including by clicking an “I agree” checkbox presented in-app or during checkout), Customer agrees to be bound by this DPA.

DPA notices (Processor): [email protected]

2) Background and Order of Precedence

1. This DPA applies where and to the extent that Processor processes Personal Data on Controller’s behalf in connection with the DentiPlanner service (the "Service").
2. This DPA forms part of, and is incorporated into, the agreement between the Parties governing the Service (the "Agreement") (for example, Terms of Service and/or an order form).
3. In the event of conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA will prevail to the extent of the conflict.

3) Definitions

Terms used but not defined in this DPA have the meanings given in UK GDPR and the Data Protection Act 2018.

Key definitions:

• "UK GDPR" means the UK General Data Protection Regulation as amended and incorporated into UK law, including the Data Protection Act 2018.
• "Personal Data" means personal data processed by Processor on behalf of Controller under this DPA.
• "Customer Data" means data (including Personal Data) submitted to the Service by or on behalf of Controller, including Patient Data and related clinical, operational, and financial data entered by Controller’s users.
• "Patient Data" means Personal Data relating to Controller’s patients (typically Special Category Data).
• "Special Category Data" has the meaning given in UK GDPR (including data concerning health).
• "Processing" and "Process" have the meanings given in UK GDPR.
• "Sub-processor" means any third party appointed by Processor to process Personal Data on behalf of Controller under this DPA.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

4) Scope and Roles (Controller / Processor)

1. Controller is the Controller of Customer Data (including Patient Data) and is responsible for complying with its obligations under applicable data protection laws, including providing notices to patients and obtaining any required consents or authorisations.
2. Processor processes Customer Data (including Patient Data) only on behalf of and under the documented instructions of Controller, as described in this DPA and the Agreement.
3. Processor as Controller (excluded from this DPA): Certain data is processed by Processor as an independent Controller rather than on Controller’s behalf, including Processor’s own account-administration data, billing and subscription records, payment-recovery records, fraud-prevention data, and platform security and audit logs required to operate, secure, and enforce the Service. Such data is governed by Processor’s public Privacy Notice and not by this DPA.

5) Details of Processing

The subject matter, duration, nature, and purpose of Processing, as well as the types of Personal Data and categories of data subjects, are set out in Annex 1 (Description of Processing).

6) Controller Obligations

Controller shall:

1. Ensure it has a valid lawful basis and, where applicable, a condition for processing Special Category Data, for all Personal Data it submits to the Service.
2. Provide all required notices to data subjects (including patients) and obtain all necessary consents/authorisations.
3. Ensure its users are authorised and trained to access and use the Service.
4. Maintain appropriate technical and organisational measures for its own systems and devices (including exported records).
5. Not instruct Processor to Process Personal Data in a way that violates applicable law.

7) Processor Obligations

Processor shall:

1. Process Personal Data only on documented instructions of Controller, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by applicable law (in which case Processor will inform Controller, unless prohibited).
2. Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Implement appropriate technical and organisational measures ("TOMs") to protect Personal Data, as described in Annex 2.
4. Not materially decrease the overall security of the Service during the term of the Agreement.
5. Assist Controller as described in Sections 9 and 10.

8) Sub-processors

1. General authorisation: Controller authorises Processor to appoint Sub-processors for the performance of the Service, subject to the requirements of this DPA.
2. Processor shall:

• Maintain a list of Sub-processors in Annex 3 (Approved Sub-processors) or otherwise make it available to Controller.
• Impose data protection obligations on Sub-processors that are no less protective than those in this DPA.
• Remain responsible to Controller for the performance of its Sub-processors under this DPA.

1. Changes to Sub-processors:

• Processor will provide reasonable prior notice of any intended addition or replacement of Sub-processors (for example, by posting an update in-app or on a policy page, or via email to an admin contact).
• Controller may object on reasonable grounds related to data protection by notifying Processor within 14 days of the notice. If the Parties cannot resolve the objection, Controller may terminate the affected Service (or the Agreement) as its sole and exclusive remedy, to the extent permitted by the Agreement.

9) Assistance with Data Subject Requests

Taking into account the nature of the processing, Processor shall assist Controller by appropriate technical and organisational measures, insofar as possible, for the fulfilment of Controller’s obligation to respond to requests for exercising data subject rights under UK GDPR.

This includes, where applicable:

1. Enabling Controller to access, correct, export, restrict, delete, or de-identify data via the Service features and workflows.
2. Providing reasonable assistance upon written request where Controller cannot complete a request using self-service features.

Controller remains responsible for determining whether a request is valid, and for responding to the data subject within statutory deadlines.

10) Assistance with DPIAs and Regulatory Enquiries

Processor shall provide reasonable assistance to Controller with:

1. Data protection impact assessments (DPIAs), and
2. Prior consultation with the ICO (or other competent authority),

to the extent required under UK GDPR, taking into account the nature of processing and the information available to Processor.

This assistance may be subject to reasonable fees where permitted by the Agreement and where requests are excessive.

11) Security Incident Management and Breach Notification

1. Processor shall notify Controller without undue delay after becoming aware of a Security Incident affecting Personal Data.
2. The notification will include, to the extent known and reasonably available:

• A description of the nature of the incident.
• The categories and approximate number of data subjects and records concerned (where feasible).
• Likely consequences of the incident.
• Measures taken or proposed to address the incident and mitigate potential adverse effects.

1. Processor will take reasonable steps to contain, investigate, and remediate the Security Incident.
2. Controller is responsible for determining whether notification to affected individuals or regulators is required, and for making such notifications.

12) Audits and Compliance Information

1. Processor shall make available to Controller information reasonably necessary to demonstrate compliance with this DPA.
2. Controller may audit Processor’s compliance only:

• Upon reasonable prior written notice (e.g., 30 days),
• No more than once per year unless a Security Incident or regulator request requires otherwise,
• During normal business hours,
• Subject to confidentiality obligations,
• Using a qualified independent auditor, where appropriate.

1. Processor may satisfy audit obligations by:

• Providing summaries of security measures and compliance documentation,
• Providing third-party certifications/attestations (if any),
• Facilitating remote reviews of relevant policies and procedures.

1. Controller shall bear its own audit costs and reimburse Processor for reasonable time and expenses incurred for audits, where permitted by the Agreement.

13) International Transfers

1. Processor hosts the core production database, storage, and related service infrastructure with Supabase in the EU, Frankfurt, Germany. UK-to-EEA transfers are covered by UK adequacy.
2. Processor may use Sub-processors and support operations that involve processing or transfers outside the UK or EEA, as described in Annex 3.
3. Where Personal Data is transferred outside the UK to a country not recognised as providing adequate protection, the Parties shall ensure appropriate safeguards are in place, such as:

• The UK International Data Transfer Agreement (IDTA), or
• The UK Addendum to EU Standard Contractual Clauses (where applicable), and/or
• Other lawful transfer mechanism recognised under UK GDPR.

1. Processor will provide information about transfer safeguards upon request.

14) Return, Suspension Archive, and Deletion of Personal Data

1. Upon suspension, termination, or expiry of the Service, and subject to Controller’s instructions, the Agreement, and technical feasibility, Processor may keep Customer Data (including Personal Data) in an archived and recoverable state for up to ninety (90) days from the effective date of suspension, termination, or expiry for the limited purposes of reactivation, support handling, billing resolution, legal compliance, security review, and data export or return to Controller.
2. During this archived recovery period, Processor may restrict access to the Service and Customer Data, but may keep available reasonable export, support, or restoration workflows where applicable.
3. At Controller’s choice and to the extent technically feasible, Processor shall, during or at the end of the archived recovery period:

• return Customer Data (including Personal Data) to Controller, and/or
• delete Customer Data (including Personal Data).

1. If deletion is requested, or if no restoration or return is requested within the archived recovery period, Processor may delete or irreversibly anonymise Customer Data that it is not legally required or permitted to retain.
2. Processor may retain Personal Data to the extent required or permitted by applicable law, regulation, legal process, accounting or tax obligations, fraud-prevention needs, security purposes, dispute resolution, or the establishment, exercise, or defence of legal claims. In such case, Processor shall:

• retain only the minimum necessary,
• apply access restrictions and appropriate safeguards, and
• delete or further minimise the retained data when the applicable retention basis ends.

1. Controller acknowledges that certain routine backups may persist for a limited rolling period after deletion, suspension, termination, or expiry and will be overwritten in the ordinary course of disaster recovery processes.

15) Confidentiality

Processor shall ensure that personnel authorised to process Personal Data are bound by confidentiality obligations and have access only as necessary to perform their duties.

16) Records of Processing and Cooperation

Processor shall:

1. Maintain records of processing activities as required by UK GDPR (where applicable).
2. Cooperate with the ICO and other competent authorities in relation to processing under this DPA, where required by law.

17) Liability

Liability under this DPA will follow the liability and limitation provisions of the Agreement, except where prohibited by applicable law.

18) Term

This DPA remains in effect for the duration of Processor’s processing of Personal Data on behalf of Controller under the Agreement.

19) Governing Law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales shall have exclusive jurisdiction, unless the Agreement states otherwise.

20) Signatures (Optional)

This section is optional. The Parties agree that this DPA may be accepted electronically as described in Section 1 (Parties and Acceptance). If the Parties choose to sign a written copy (for example for enterprise procurement), they may do so below.

Controller (Customer) Name: __________________________ Title: __________________________ Date: ___________________________

Processor (DentiEasy Solutions LTD) Name: __________________________ Title: __________________________ Date: ___________________________

Annex 1 - Description of Processing

1. Subject matter: Provision of the DentiPlanner Service to Controller, including hosting and processing of Customer Data entered into the Service.
2. Duration: For the term of the Agreement and, where applicable, for any limited period after suspension, termination, or expiry required for:

• up to ninety (90) days of archived and recoverable storage to allow reactivation, support handling, billing resolution, and export/return of Customer Data,
• lawful retention (e.g., accounting/tax),
• security investigations, and
• disaster recovery backups (rolling period).

1. Nature of processing: Hosting, storage, structuring, retrieval, transmission, viewing, updating, exporting (where enabled), de-identification/redaction, and deletion of Customer Data as instructed/initiated by Controller’s users and per Service workflows.
2. Purpose of processing: To provide Service features including, where applicable, hosting, secure access, support, suspension handling, reactivation, export/return, deletion, and other workflows initiated by Controller or required under the Agreement.
3. Categories of data subjects:

• Controller’s patients,
• Controller’s staff and authorised users,
• labs/dentists involved in collaboration features (as applicable),
• patient portal users (as applicable).

1. Types of Personal Data (examples, depending on Controller use):

• identifiers: name, contact details (phone/email), internal IDs, patient numbers,
• demographic/admin data: address, age/date of birth (if entered),
• clinical/health data: dental/medical history, allergies, clinical notes, images/x-rays, prescriptions, treatment plans,
• financial data: invoices, payments, credits, statement numbers, claims/ERA data, payment references,
• operational data: appointment data, reminders metadata, communications metadata,
• security/usage data: login/session metadata, device and access logs, audit trails.

1. Special Category Data:

• health/clinical data relating to patients (as uploaded/entered by Controller).

Annex 2 - Technical and Organisational Measures (TOMs) - Summary

Processor maintains technical and organisational measures designed to protect Personal Data, which may include:

1. Access control:

• authentication controls,
• role-based access control aligned to dentist/lab/patient separation,
• restricted admin access to sensitive operations.

1. Encryption:

• encryption in transit (TLS),
• encryption at rest where supported by infrastructure providers.

1. Data segregation:

• logical tenant separation controls,
• row-level access controls (for example via database security rules).

1. Audit and monitoring:

• logging of sensitive operations (including deletion/redaction workflows),
• monitoring for availability and security signals.

1. Secure development and change control:

• code review and controlled deployment practices (as applicable),
• security patching/updating processes.

1. Incident response:

• processes to detect, triage, investigate, and remediate security incidents,
• breach notification workflow.

1. Data lifecycle:

• deletion and de-identification workflows for user and patient data,
• retention controls for categories requiring legal/accounting retention.

This Annex is a summary. A fuller TOMs description may be provided on request, subject to security and confidentiality constraints.

Annex 3 - Approved Sub-processors

Controller authorises Processor to use the following Sub-processors for the purposes described below. Processor may update this list in accordance with Section 8.