Data processing agreement

1About this agreement

This data processing agreement ("DPA") is between Hizmedia Ltd ("Hizmedia", "we", "us") and the clinic that uses Drawn ("you"). It forms part of our terms of service, and you accept it when you sign up.

It sets out how we process personal data on your behalf, as Article 28 of the UK GDPR requires. If this DPA and the terms of service conflict about personal data, this DPA wins.

2Words we use

• Data protection law means the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations, as amended or replaced from time to time.
• Clinic personal data means the personal data we process for you in Drawn, described in section 4.
• Controller, processor, data subject, personal data breach and processing have the meanings given in the UK GDPR.
• Sub-processor means another company we use that processes clinic personal data.

3Who is responsible for what

For clinic personal data, you are the controller: you decide why and how your patients' and staff's data is used. We are your processor: we process it only to provide Drawn to you.

For your account, billing and our own website, we are the controller. That is covered by our privacy policy, not this DPA.

4Details of the processing

5Processing only on your instructions

We process clinic personal data only on your documented instructions. These terms, this DPA, and the way you set up and use Drawn are your instructions. You can give further instructions by email, and we'll follow them where they're reasonable and consistent with how Drawn works.

If the law requires us to process clinic personal data in another way, we'll tell you first, unless the law forbids it. If we think an instruction breaks data protection law, we'll tell you straight away.

We never sell clinic personal data, use it for advertising, or use it for any purpose of our own.

6Your responsibilities

As controller, you're responsible for:

• having a lawful basis for the processing, and a condition under Article 9 of the UK GDPR for health data;
• giving patients a clear privacy notice before they book. Drawn won't let your booking page go live without one;
• collecting only what you need, such as turning on dates of birth only if you have a reason, which Drawn asks you to give;
• deciding which of your staff can see test reports, and keeping their access up to date;
• carrying out any data protection impact assessment your processing needs;
• answering your patients' requests about their data, with our help as set out in section 11.

7Our people

Only people at Hizmedia who need it to provide, support or secure Drawn can access clinic personal data, and each is bound by a duty of confidentiality. We don't look at your patients' records as a matter of course. We do so only when you ask us for support that needs it, when it's needed to keep Drawn secure or working, or when the law requires it.

8Security

We protect clinic personal data with technical and organisational measures suited to health data. They include:

Encryption and hosting

• Every connection to Drawn uses HTTPS, with HSTS. Connections between Drawn and its database use verified TLS.
• The database and file storage are encrypted at rest by our providers. Report files use keys managed in AWS Key Management Service, and every access to them is recorded by AWS CloudTrail, kept for 24 months.
• Drawn runs in London, its database is in London, and report files are stored in Sweden.

Keeping clinics apart and limiting access

• Each clinic's data is separated by row-level security, which the database enforces on every request your staff make.
• Staff see only what their role needs. Test reports are visible only to clinicians and to staff an admin has given access to, with a reason recorded.
• Report download links expire after 60 seconds. Patients see a report only after a clinician releases it.

Signing in

• Staff passwords must be at least 12 characters, every staff sign-in also needs a one-time code sent by email, staff sessions end after 8 hours, and repeated attempts are rate limited.
• Patients sign in with a one-time code by email, and their sessions end after 2 hours.
• The private links in patients' emails use random tokens, stored only as hashes.

Records and minimisation

• An audit log records views, downloads, exports, changes and deletions of records, by ID only. Its entries can't be altered, and they're deleted after 24 months.
• By default, texts, emails and links never name the tests a patient booked.
• Our application logs leave out patients' details. Drawn has no analytics or advertising trackers.
• Records are deleted automatically on the retention periods you set, as set out in section 14.

We review these measures as Drawn changes and as risks change, and we may improve them. We won't reduce the overall level of protection.

9Sub-processors

You authorise us to use the sub-processors listed on our sub-processors page, which forms part of this DPA.

• Each sub-processor is bound by a written agreement with data protection duties at least as strict as ours under this DPA.
• Before we add or replace one, we update that page and email your admins at least 30 days in advance. You may object on reasonable data protection grounds. If we can't resolve your objection, you may end your subscription, and we'll refund any period you've paid for and won't use.
• We remain responsible to you for our sub-processors' work.

10Transfers outside the UK

We transfer clinic personal data outside the UK only where data protection law allows it: to a country the UK recognises as adequate, such as those in the European Economic Area, or with appropriate safeguards. These include the UK Extension to the EU-US Data Privacy Framework and the UK's International Data Transfer Addendum to the EU standard contractual clauses. The sub-processors page shows where each provider handles data.

11Helping with patients' rights

Drawn gives your staff the tools to answer requests from patients without needing us. For each patient, your admins can:

• export their record as JSON or CSV, for access and portability requests;
• correct their details;
• restrict their record, which stops it being changed and hides it from the patient's own account;
• stop marketing or text reminders straight away, when they object;
• erase their record, with their bookings, reports and files. Their invoices stay, with their name, email and postcode removed, until tax law no longer requires them.

Each of these is recorded in the audit log. If a patient contacts us directly, we'll pass the request to you without delay and won't answer it ourselves unless you ask us to. If you need more help with a request, email us and we'll assist.

12Personal data breaches

If we become aware of a personal data breach affecting clinic personal data, we'll tell your clinic's admins without undue delay, and in any case within 48 hours. As soon as we can, we'll tell you:

• what happened, and the kinds and approximate number of people and records affected;
• the likely consequences;
• what we've done and will do to deal with it and limit the harm;
• who to contact for more information.

We'll help you meet your own duties to report the breach to the Information Commissioner's Office within 72 hours and, where needed, to tell the patients affected.

13Impact assessments and the ICO

We'll give you the information you reasonably need about Drawn to carry out a data protection impact assessment, and to consult the Information Commissioner's Office if you need to. Our DPIA template for clinics has Drawn's part already filled in.

14Deleting and returning data

While you use Drawn

• Drawn deletes records every night once they pass the retention periods you set in Settings > Privacy notice.
• Cancelled bookings are deleted after 30 days.
• A booking with an invoice, and its patient, are kept for 6 years from the invoice date, because tax law requires invoices to be kept.
• Reports for patients seen as children are kept until their 25th birthday.

When you leave

• If your subscription or trial ends, we delete all clinic personal data 30 days later. We email you at least 7 days before, and confirm the deletion by email afterwards.
• If you close your clinic in Settings, we delete it straight away.
• Before you leave, you can export each patient's record, and you should keep any records the law requires you to hold, such as invoices. If you'd like all your records in one machine-readable export, ask us before your account ends and we'll provide it.
• Our database provider keeps short-term backups for recovery. They expire automatically on a rolling cycle, and deleted data isn't restored from them except to recover from a fault.

15Information and audits

We'll give you the information you reasonably need to show that we meet this DPA. If that isn't enough, you may audit our compliance once a year, or after a personal data breach, with at least 30 days' notice, during business hours, at your own cost, and under a duty of confidentiality. An independent auditor may do this for you. We may meet a request with up-to-date documents or certifications where they answer it.

16Requests from authorities

If a court, regulator or law enforcement body asks us for clinic personal data, we'll direct them to you where we can. If we must disclose it, we'll tell you first unless the law forbids it, and disclose only what we're required to.

17Liability and how long this lasts

Each of us is liable under this DPA as set out in the liability section of the terms of service, and as data protection law requires.

This DPA lasts as long as we process clinic personal data for you. We may update it as described in the terms of service, and we'll never reduce its protection without telling you first. Questions to director@hizmedia.com.