Terms

1. What is this agreement about?

1.1 Purpose. The parties, as set out in Annex I, are entering into this Data Processing Agreement (DPA) for the purpose of processing personal data on behalf of Controller in connection with the Main Agreement.

1.2 Definitions. Adequate country, Controller, data subject, personal data, personal data breach, process/processing, Processor, special category data, Sub-processor and supervisory authority have the same meanings as in the Data Protection Laws. Main Agreement means the Dentascribe Terms of Service (or other agreement) under which Processor provides the Services to Controller. Details of how Dentascribe processes personal data are also described in our Privacy Policy.

1.3 Structure. Annex I sets out the parties, the description of processing, the competent supervisory authority, and the governing law and jurisdiction. Annex II sets out the technical and organisational security measures. Annex III sets out the approved sub-processors and the transfer safeguards for each.

2. What are each party’s obligations?

2.1 Controller obligations. Controller is responsible for having a lawful basis (and, for health data, an applicable condition for processing special category data) for the processing, for providing any required transparency information to data subjects, and for ensuring its instructions to Processor comply with Data Protection Laws.

2.2 Processor obligations. Processor will:

(a) only process personal data on the documented instructions of Controller, which are set out in this DPA and the Main Agreement and include Controller’s use and configuration of the Services, unless required to do otherwise by law, in which case Processor will inform Controller before processing unless the law prohibits this,

(b) not sell, retain or use any personal data for any purpose other than as permitted by this DPA and the Main Agreement,

(c) not use personal data to train, fine-tune or improve artificial intelligence models, and ensure its sub-processors are contractually prohibited from doing so,

(d) inform Controller immediately if, in its opinion, any instructions infringe Data Protection Laws,

(e) implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as set out in Annex II,

(f) notify Controller of a personal data breach without undue delay and in any event within the Breach Notification Period, with the information reasonably available to Processor at that time,

(g) ensure that anyone authorised to process personal data is committed to confidentiality obligations,

(h) provide Controller with reasonable assistance in responding to a personal data breach and in meeting Controller’s breach notification obligations,

(i) without undue delay, provide Controller with reasonable assistance with:

(i) data protection impact assessments and prior consultations,

(ii) responses to data subjects’ requests to exercise their rights under Data Protection Laws, and

(iii) engagement with supervisory authorities,

(j) if requested, provide Controller with information necessary to demonstrate its compliance with its obligations under Data Protection Laws and this DPA,

(k) allow for and contribute to audits, including inspections, at Controller’s reasonable request, provided that audits are limited to once a year, on reasonable notice and during business hours, except in the event of a personal data breach or where required by a supervisory authority, and

(l) on termination of the Main Agreement, at Controller’s choice, delete or return personal data within 30 days, unless retention is required by law. Personal data held in encrypted backups will be deleted in line with the normal backup rotation cycle.

2.3 Warranties. The parties warrant that they and any staff and/or subcontractors will comply with their respective obligations under Data Protection Laws for the Term.

3. Sub-processing

3.1 Use of sub-processors. Controller gives general written authorisation for Processor to use sub-processors when processing personal data. Processor’s existing sub-processors are listed in Annex III.

3.2 Sub-processor obligations. Processor will:

(a) enter into a written contract with each sub-processor imposing data protection obligations equivalent to those in this DPA,

(b) ensure appropriate safeguards are in place before transferring personal data internationally to a sub-processor, and

(c) remain liable to Controller for the acts, errors and omissions of its sub-processors under this DPA.

3.3 Changes. Processor will notify Controller in writing of any intended addition or replacement of a sub-processor at least the Sub-processor Notification Period before the change takes effect.

3.4 Objections. Controller may reasonably object in writing to any new sub-processor within the Sub-processor Notification Period. If the parties cannot agree on a solution within a reasonable time, Controller may terminate the affected Services.

4. International personal data transfers

4.1 Authorised transfers. Controller authorises transfers of personal data to the sub-processors and locations listed in Annex III. Processor will not otherwise transfer personal data outside the UK, the EEA or an adequate country without Controller’s documented instructions, unless required by law.

4.2 Transfer mechanism. Where personal data is processed outside the UK, the EEA or an adequate country, the Transfer Mechanism stated in Annex III will apply. Transfer Mechanism means, as applicable, the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or the UK Extension to the EU-U.S. Data Privacy Framework.

4.3 Additional measures. If the Transfer Mechanism is insufficient to safeguard the transfer, the data importer will promptly implement additional or replacement measures as necessary to ensure personal data is protected to the same standard as under Data Protection Laws.

4.4 Disclosures. If Processor or a sub-processor receives a request from a public authority to access personal data, it will, if legally possible:

(a) challenge the request where there are reasonable grounds to do so and promptly notify Controller about receiving it, and

(b) if it is necessary to disclose personal data, only disclose the minimum amount required and keep a record of the disclosure.

5. Other important information

5.1 Survival. Any term of this DPA which is intended to survive termination will remain in full force.

5.2 Order of precedence. In case of a conflict between this DPA and other relevant terms, they will take priority in this order:

(a) Transfer Mechanism, (b) DPA, (c) Main Agreement.

5.3 Notices. Formal notices under this DPA must be in writing and sent to the Contacts in Annex I, as may be updated by a party to the other in writing.

5.4 Third parties. Except for affiliates, no one other than a party to this DPA has the right to enforce any of its terms.

5.5 Entire agreement. This DPA, together with the Main Agreement, constitutes the entire agreement between the parties with respect to the processing of personal data and supersedes all prior discussions and agreements on that subject.

5.6 Amendments. Any amendments to this DPA must be agreed in writing, except that Processor may update Annex III in accordance with clause 3.

5.7 Assignment. Neither party can assign this DPA to anyone else without the other party’s consent.

5.8 Waiver. If a party fails to enforce a right under this DPA, that is not a waiver of that right at any time.

5.9 Governing law and jurisdiction. The Governing Law applies to this DPA and all disputes will only be litigated in the courts of the Jurisdiction.

Annex I: Variables

Annex II: Technical and organisational measures to ensure the security of the data

1. Access Control

• System access control: We use strong password policies, multi-factor authentication, role-based access control and regular access reviews to prevent unauthorised system access.
• Least privilege: Dentascribe personnel are granted the minimum access necessary to perform their tasks.
• Data access control: Dentascribe personnel do not access the content of clinical notes, letters, transcripts or audio. Synced clinical content is stored only as ciphertext that Dentascribe cannot decrypt. Content sent for AI processing is handled by automated systems and is not viewed by Dentascribe personnel.
• Transmission control: All personal data is encrypted in transit using TLS.

2. Data Security and Integrity

• Encryption: All stored data is encrypted at rest. Synced clinical drafts (appointments, notes, letters and tasks) are additionally encrypted on the user’s device with AES-256-GCM, using a key derived from the user’s own encryption passphrase, before they are uploaded.
• Transient processing of audio: Audio is sent to our servers only for transcription. It is processed in memory, passed to transcription sub-processors and not stored by Dentascribe after the request completes.
• AI sub-processors: AI sub-processors are contractually prohibited from using personal data to train, fine-tune or improve their models. Personal data sent to them is processed only to return a result and is not retained except as strictly necessary for security or abuse monitoring under their contracts with Dentascribe.
• Photo transfer: Photos of appointment lists sent from a phone to a desktop are encrypted on the device and deleted after transfer, and in any event within 24 hours.
• Integrity controls: Dentascribe does not alter Controller’s personal data except as instructed through use of the Services (for example, generating or editing a draft at the user’s request). AI-generated content is presented as a draft for clinician review.
• Backups: We maintain secure, encrypted daily backups for disaster recovery. Backups of synced clinical content contain ciphertext only.

3. Data Minimisation

• User-controlled processing: Personal data is only processed when a user actively uses a feature that requires it, such as starting a recording, generating a note, syncing a draft or sending a letter.
• Privacy mode: Users can disable syncing for individual appointments, in which case clinical content is kept only on the user’s device.
• Retention:
  • Synced clinical drafts are automatically deleted from our servers no later than 100 days after they were last updated. Users can delete them at any time before then.
  • Audio is not retained by Dentascribe after transcription.
  • Photos of appointment lists are deleted after transfer and in any event within 24 hours.
  • On termination of the Main Agreement, personal data is deleted in accordance with clause 2.2(l).

4. Purpose Limitation

Personal data is processed only to provide the Services, namely:

• Transcription and AI generation: helping Controller draft clinical notes, letters and tasks from appointment audio, dictation and text.
• Synced drafts: saving clinical drafts and making them available across Controller’s devices.
• Letter sending: delivering letters by email to recipients chosen by the user.

Personal data is not used for marketing, profiling, analytics or AI model training.

5. Organisational Measures

• Data protection policy: We maintain a data protection policy that is regularly reviewed, documented and enforced.
• Data protection lead: Our designated data protection contact (see Annex I) handles privacy enquiries and compliance matters.
• Sub-processor management: We carry out due diligence on each sub-processor, including its security practices, data retention and model training terms, and maintain a data processing agreement with each.
• Product analytics: Product analytics and error tracking are configured so that clinical content and patient data are not sent to them.
• Incident response: We maintain an incident response plan for personal data breaches.
• Audits: We carry out internal data protection audits twice a year, covering access controls, data security and adherence to our data protection policies. Findings are used to drive continuous improvement.

Annex III: List of approved sub-processors