Data processing agreement

1. Who this agreement is between

This agreement is between you, the practitioner with a Footnotes account (the controller), and us (the processor). Footnotes is provided by Garry Finch, a sole trader, trading as The Finch Workshop, of [postal address for notices] (“we”, “us”). It forms part of our terms of use, and you accept it when you create an account. If the terms and this agreement conflict on how patients' records are handled, this agreement wins.

Words such as personal data, controller, processor, data subject and personal data breach mean what they mean in the UK GDPR.

2. What we process for you

Subject matter and purpose

Providing Footnotes so you can keep patient records, run bookings and visits, and email patients.

Nature of the processing

Storing, organising, displaying, syncing to your devices, emailing at your request, exporting, backing up and deleting.

Duration

While you have an account, then until deletion under section 9.

People the data is about

Your patients, who may include children, and their emergency contacts. GPs are named.

Types of personal data

Name, address, phone, email, date of birth, GP and emergency contact; appointments and services booked; consent records with signatures.

Special category data

Health data: medical history, medicines, mobility, foot assessments, foot maps, risk levels, treatment, referrals, and before and after photos of the feet.

3. Your instructions

• We process patients' personal data only on your documented instructions. Your instructions are this agreement, the terms, and what you do in the app (for example adding, exporting or deleting a record, or sending an email).
• The law may require us to process data otherwise. If so, we'll tell you first, unless the law forbids it.
• We'll tell you straight away if we think an instruction breaks data protection law.
• We never use your patients' data for our own purposes, including marketing, analytics, research or training AI systems.

4. Confidentiality

Only people who need access to run, support or secure Footnotes can reach patients' data, and each is bound by a duty of confidentiality. They look at it only when you ask for help, or when it's needed to fix a fault or security problem, and only as far as needed.

5. Security

We take appropriate technical and organisational measures to protect patients' data, as UK GDPR Article 32 requires. The measures in place now are listed in Annex A. We may improve them, but won't reduce the overall protection they give.

6. Sub-processors

• You authorise us to use the sub-processors in Annex B. Each is bound by a written contract giving the same protection as this agreement, and we remain responsible to you for them.
• We'll email you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you can close your account before the change, and section 9 applies.

7. Helping you meet your obligations

• Patients' requests. The app lets you export a patient's full record, correct it (with dated amendments for finished visits) and delete it. If a patient contacts us directly, we'll pass the request to you without delay and won't answer it ourselves unless you ask us to.
• Breaches. If we become aware of a personal data breach affecting your patients' data, we'll tell you without undue delay, and within 48 hours at most, with what we know about what happened, the data and people likely to be affected, the likely consequences and what we're doing about it. We'll keep you updated, so you can meet your 72-hour duty to report to the ICO and tell patients where needed.
• Assessments. We'll give you the information you reasonably need for a data protection impact assessment, or a consultation with the ICO, about your use of Footnotes.

8. Information and audits

We'll give you the information you reasonably need to show that this agreement is being kept to, and answer reasonable questions about it. If that isn't enough, or the ICO asks, we'll allow an audit by you or an independent auditor you choose, with reasonable notice, at a reasonable time, under a duty of confidentiality, and no more than once a year unless there's been a breach. Each side pays its own costs.

9. When your account ends

When your account closes or Footnotes ends, you'll have 30 days to export your patients' records using the app (we'll help if you can't sign in). We then delete all of them, including from backups, within 90 days, unless the law requires us to keep them. We'll confirm in writing when it's done.

10. International transfers

Patients' data is stored in the EU (Ireland), which the UK recognises as adequate. We'll only transfer it to, or allow access from, another country if UK data protection law allows it, such as with the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework (see Annex B).

11. Your responsibilities

You confirm that you have a lawful basis, and where needed a condition for processing health data, for everything you record in Footnotes, that you've told patients how their data is used (including that you use Footnotes), and that your instructions to us are lawful.

12. Liability and changes

Each side is responsible for its own breaches of data protection law. The limits in section 11 of the terms apply to this agreement, except where the law doesn't allow them to. We'll change this agreement only as described in the terms, or where the law requires it. Questions to hello@myfootnotes.co.uk.

Annex A: Security measures

• Sign-in: password of at least 12 characters plus an authenticator app code; a full sign-in at least weekly; password reset also needs the authenticator code.
• Access control: row-level security in the database, so each practitioner can reach only their own patients, and only once signed in with both steps.
• Encryption: in transit (HTTPS) everywhere, and at rest on the servers.
• Devices: records kept for use with no signal are encrypted (AES-256) with a key protected by a PIN, locked after 30 minutes idle, wiped after five wrong PINs and cleared on sign-out. Nothing about patients is stored unencrypted on the device.
• Activity log: every view, change, export and deletion of a patient record is logged with the time and record IDs, and can't be edited.
• Integrity: finished visit records can't be changed, only amended with dated additions.
• Minimising data: no patient details in web addresses, logs, analytics or error tracking; patient emails exclude clinical notes and medical history; photos have location and device details removed.
• Storage location: EU (Ireland), with the providers' own certified physical and network security and backups.
• Development: changes are reviewed and tested before release, including automated tests of the access rules.

Annex B: Sub-processors