Data Processing Agreement

The Customer (the pharmacy) is the controller. Digitalpharm Ltd trading as AIPA is the processor. This agreement is entered into under Article 28 of the UK GDPR and, where the Customer is established in the EU, Article 28 of the EU GDPR, and applies for as long as we process personal data for you.

Where the Customer is itself a processor for an NHS body or another organisation, AIPA acts as sub-processor on the same terms.

• Subject matter — provision of the AIPA patient assistant and related dashboard.
• Duration — the term of the subscription, plus the deletion period in section 10.
• Nature and purpose — collecting, storing, generating replies to, analysing and displaying patient enquiries; capturing contact details and form submissions; notifying pharmacy staff.
• Types of personal data — patient name, phone, email, postcode or town, message content, conversation metadata, and any health-related information a patient voluntarily types. Also pharmacy staff names, emails and roles.
• Categories of data subject — patients and website visitors of the pharmacy, and the pharmacy's own staff.
• Special category data — health data may occur incidentally where a patient types it. The assistant is configured to deflect clinical questions and to avoid soliciting health details.

• We process personal data only on your documented instructions, which include the configuration you set in the dashboard, unless UK law requires otherwise. We will tell you if we believe an instruction breaches data protection law.
• We ensure staff with access are bound by confidentiality and receive data protection training.
• We implement the technical and organisational measures in section 6.
• We assist you, taking account of the nature of processing, with data subject requests, data protection impact assessments and prior consultation with the ICO.
• We make available the information needed to demonstrate compliance and allow audits as set out in section 9.

• You determine the purposes of processing and confirm you have a lawful basis, and a valid Article 9 condition for any health data.
• You publish your own privacy notice covering the assistant and, where required, obtain consent for non-essential cookies before the widget loads.
• You configure escalation rules, retention settings and the content the assistant is allowed to use.
• You keep your dashboard access under control and remove leavers promptly.

We will notify you without undue delay if we receive a request from a data subject, and we will not respond directly unless you instruct us to. The dashboard lets you search, export and delete conversations and enquiries so you can meet access and erasure requests yourself. Where you need more help, contact privacy@aipax.co.uk.

• Encryption of data in transit (TLS) and at rest.
• Row-level security so each pharmacy can only reach its own records.
• Role-based access control, with separate superadmin, admin and staff tiers.
• Least-privilege service credentials, secrets held in a managed secret store and never in client code.
• Domain allow-listing so the widget only runs on approved pharmacy domains.
• Audit logging of administrative actions and automated incident detection with alerting.
• Regular dependency scanning and patching.
• Daily automated database backups retained for 7 days by our hosting provider, with point-in-time recovery available on request, and periodic restore testing.
• Penetration testing is not currently carried out on a fixed schedule. We will update this agreement when a testing programme is in place.

You give general authorisation for us to appoint sub-processors. We impose data protection terms on each one that are no less protective than this agreement, and we remain liable for their performance. We will give at least 30 days notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

Pharmacies must disclose AIPA as a processor in their own privacy notice. See our policy template for pharmacies for wording you can adapt.

Where personal data is transferred outside the UK, we rely on UK adequacy regulations, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Where personal data is transferred outside the EU/EEA, we rely on EU adequacy decisions or the EU Standard Contractual Clauses. In each case we carry out a transfer risk assessment and apply supplementary measures where needed.

On reasonable written request, and no more than once a year unless a regulator requires otherwise, we will provide information about our security measures and respond to a written security questionnaire. On-site audits may be carried out at your cost with reasonable notice, at a time that does not disrupt the service.

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data. The notification will describe the nature of the breach, the likely consequences, the categories and approximate numbers affected, and the measures taken. We will co-operate with your reporting to the ICO and to data subjects.

On termination you may export your data from the dashboard. Unless UK law requires us to keep it, we will delete personal data processed on your behalf within 30 days of the end of the subscription, and remove it from backups within the normal backup rotation.

This agreement is governed by the laws of England and Wales. Where it conflicts with the Terms of Service on data protection matters, this agreement prevails. If you require a signed copy or a bespoke DPA for an NHS contract, email privacy@aipax.co.uk.