Clinic Data Protection & Platform Participation Agreement

This Agreement sets out the data-protection, information-governance, security and platform-participation requirements between EveryClinic Ltd (“EveryClinic”) and the Clinic identified in the signature section. It must be signed before the Clinic is registered and activated on the EveryClinic platform.It operates alongside the EveryClinic Privacy Notice, Privacy Policy, Record of Processing Activities (ROPA), Data Protection Impact Assessment (DPIA), Data Retention and Data Deletion Policy, International Data Transfer Policy and Incident Response & Personal Data Breach Management Policy.This Agreement does not automatically make either party the processor of the other. Controller/processor status depends on the particular processing activity and the purposes and means of that processing.

It also operates alongside the EveryClinic Master Security Controls Document and Staff Training on Health Data. Those documents describe EveryClinic's internal technical and organisational security controls and personnel requirements. Where a requirement in those documents applies specifically to EveryClinic's internal operations, it does not impose responsibility for EveryClinic's internal systems on the Clinic unless expressly stated in this Agreement.

For this Agreement, “EveryClinic” means EveryClinic Ltd, operator of the EveryClinic digital healthcare platform; “Clinic” means the healthcare provider seeking registration; “Platform” means the EveryClinic website, applications, booking functionality and related services; “Clinic EHR” means the Clinic’s own electronic health record or clinical system; “Personal Data” and “Special Category Data” have the meanings given by applicable UK data-protection law; and “Patient” means an individual using EveryClinic to identify, select or connect with a Clinic.

Unless a different arrangement is expressly documented for a specific processing activity:

• EveryClinic acts as a Data Controller for personal data it processes for its own platform purposes, including account administration, bookings, communications, support, payment-related administration, security, provider management, reviews, analytics and legal or regulatory purposes.
• The Clinic acts as an independent Data Controller for clinical and health information it collects and processes for the provision of healthcare and related clinical purposes.
• The Clinic is not automatically a processor of EveryClinic merely because it participates on the platform.
• EveryClinic is not automatically a processor of the Clinic merely because it facilitates the patient’s connection with the Clinic.
• If a future processing activity requires one party to act as processor for the other, the parties shall put an appropriate Article 28-compliant agreement in place before that processing begins.
• The parties shall review their respective roles where the nature, purpose or means of processing changes. The parties must not rely solely on the labels used in this Agreement where the actual processing arrangements indicate a different controller or processor relationship.
• Where joint determination of purposes and means arises, the parties shall document their respective responsibilities and provide appropriate transparency to affected individuals.

The current EveryClinic journey is intended to operate as follows:

Patient → EveryClinic platform → selected Clinic → Clinic EHR → patient enters clinical/health information

The Clinic is responsible for clinical information entered by the patient into its own EHR. EveryClinic does not ordinarily collect, store or access the patient’s full clinical records, consultation notes, treatment histories or other clinical records.

• Clinical questionnaires or intake forms should be presented and stored within the Clinic’s clinical environment.
• The Clinic must notify EveryClinic if its technical integration changes so that clinical information may enter, pass through, be logged by, or be stored within EveryClinic systems.
• A material change must be assessed before implementation and may require updates to the ROPA, DPIA, data-flow mapping, privacy information or lawful-basis assessment.
• If clinical or other special category information is unintentionally transmitted to EveryClinic, the Clinic must notify EveryClinic without undue delay and cooperate with containment, investigation, secure deletion, return or other remedial measures.
• EveryClinic may temporarily suspend the relevant integration, form, booking field or data flow where reasonably necessary to protect personal data or prevent further unauthorised processing.

Depending on the service used, EveryClinic may process the following platform information:

• Name, date of birth, gender, email address and telephone number.
• Booking and appointment information.
• Clinic, healthcare provider.
• Communications, enquiries, feedback, complaints and reviews.
• IP address, device/browser information, approximate location and security/access information.
• Cookie and analytics information, subject to applicable configuration and privacy requirements.
• Clinic/business and practitioner information for provider registration and administration.
• Payment-related transaction information such as payment amount and payment intent/reference information. Full payment-card details are processed by the authorised payment provider and are not stored by EveryClinic.

The Clinic shall not intentionally submit unnecessary clinical records or Article 9 health information to EveryClinic through booking fields, free-text fields, support requests, reviews, URLs, analytics or other platform functionality.

The Clinic shall configure and use its integrations, booking fields, links, forms and communications so that only information reasonably necessary for the documented platform purpose is transmitted to EveryClinic.

The Clinic shall not include clinical narratives, diagnoses, treatment details, medication information, test results, photographs, consultation notes or other unnecessary health information in platform communications, URLs, analytics parameters, reviews or support requests.

Each party is responsible for identifying and documenting the lawful basis applicable to its own processing. UK GDPR consent is not automatically required for every booking or patient connection.

• EveryClinic shall use an applicable Article 6 UK GDPR basis appropriate to the purpose, including contract, legitimate interests, legal obligation or consent where appropriate.
• If EveryClinic actually processes Special Category Data, it must identify an applicable Article 9 condition in addition to Article 6.
• The Clinic is responsible for its own Article 6 bases and Article 9 conditions for clinical and health-data processing.
• The Clinic is responsible for appropriate clinical privacy information and healthcare confidentiality requirements.
• Any consent relied upon must be appropriate, specific, informed and demonstrable.
• Each party shall provide privacy information appropriate to its own processing and shall cooperate where information about the other party's processing is reasonably necessary to ensure that patients understand the relevant data flows.
• Neither party shall represent that it processes personal data solely on behalf of the other unless that arrangement has been formally documented and accurately reflects the actual processing relationship.

Each party shall implement appropriate technical and organisational measures proportionate to the risks of its processing.

• Maintain appropriate access controls, least privilege and authentication.
• Use MFA where applicable and protect data in transit and at rest.
• Maintain appropriate logging, monitoring and audit trails.
• Restrict personnel access to what is necessary and maintain confidentiality obligations and training.
• Maintain secure retention, deletion, backup and recovery processes.
• Prevent unnecessary clinical data from entering EveryClinic logs, analytics, URLs, support tools or other non-clinical systems.
• EveryClinic will maintain its platform security arrangements in accordance with its Master Security Controls Document and applicable internal security procedures.
• The Clinic shall maintain security measures appropriate to its own healthcare processing and shall ensure that its personnel, systems and integrations do not undermine the security of EveryClinic data or agreed platform data flows.
• Where a party becomes aware of a material security weakness affecting the other party's data or systems, it shall notify the other party without undue delay and cooperate on proportionate remedial action.

Each party is responsible for rights requests relating to personal data for which it is the relevant Controller. The parties shall provide reasonable cooperation where the other party’s information is relevant.

• EveryClinic handles rights requests concerning personal data it holds.
• The Clinic handles rights requests concerning clinical records and health information held in its EHR.
• The parties shall cooperate where a request, complaint, investigation or regulatory enquiry requires clarification of the data flow.
• Where a data subject request is received by the wrong party, that party shall, where lawful and appropriate, promptly direct the request to the party responsible for the relevant processing or inform the requester of the appropriate contact route.
• The parties shall cooperate without undue delay where information, correction, deletion, restriction, objection or other action involving both parties' processing is reasonably necessary.

Each party shall maintain an appropriate incident and personal-data breach response process.

• Each party shall notify the other without undue delay where an incident materially affects the other party’s platform, data, patients, systems or agreed data flows.
• The notification should include available information on affected systems/data, likely consequences and containment/remediation.
• The notifying party shall provide further information as it becomes available and shall promptly communicate any material change in the assessed impact, affected data, affected individuals or containment arrangements.
• Each party shall preserve relevant evidence and shall not make public statements or notify affected individuals on behalf of the other party without prior coordination, except where required by law or necessary to protect individuals from immediate harm.
• Nothing in this Agreement prevents either party from fulfilling its own legal or regulatory notification obligations.
• Each party remains responsible for determining its own legal notification obligations.
• The Clinic shall promptly inform EveryClinic if clinical data has entered an EveryClinic system contrary to the agreed architecture.

The parties shall only provide or access personal data where necessary for the documented purpose and where the processing is lawful.

• EveryClinic shall make booking/account/platform information available to the Clinic only where necessary for the relevant service or another documented lawful purpose.
• The Clinic shall use EveryClinic-supplied information only for legitimate and documented purposes connected with the patient’s interaction with the Clinic and other lawful purposes.
• The Clinic shall not use EveryClinic patient information for unrelated marketing or secondary purposes unless it has an appropriate lawful basis and complies with applicable direct-marketing rules.
• The Clinic shall not upload clinical records to EveryClinic unless a separate arrangement has been agreed and assessed.
• Neither party shall disclose personal data received from the other party to an additional recipient, supplier or third party unless the disclosure is necessary for a documented lawful purpose and the relevant privacy, security, contractual and transfer requirements have been assessed.
• The Clinic shall ensure that any onward use of EveryClinic-supplied information remains consistent with the purposes communicated to patients and with applicable data-protection law.

Each party is responsible for retaining and deleting the personal data for which it is responsible in accordance with applicable law and its documented retention requirements.

• EveryClinic applies its Data Retention and Data Deletion Policy to data held by EveryClinic.
• The Clinic applies its own clinical-record retention requirements to clinical and health information held in its EHR.
• EveryClinic rolling backups may retain deleted platform data for the documented backup period.
• Deletion from EveryClinic does not delete clinical records held in the Clinic EHR, and EveryClinic is not responsible for the Clinic’s clinical retention schedule.
• Where personal data has been shared between the parties and one party lawfully requires deletion, correction or restriction of that data, the parties shall cooperate reasonably to identify the relevant records and complete the required action.
• Each party shall maintain appropriate evidence of deletion or other disposal actions where required by law, contractual obligations or its documented retention procedures.

Each party is responsible for its own processors, sub-processors, suppliers and international data transfers.

• EveryClinic shall maintain appropriate supplier due diligence and transfer safeguards for relevant providers, including AWS, Resend, Google Analytics and Stripe as applicable.
• Restricted transfers must use an applicable UK transfer mechanism or other lawful basis, such as adequacy regulations, the UK IDTA, UK Addendum to EU SCCs or an applicable derogation, as appropriate.
• The Clinic is responsible for its EHR provider, clinical software suppliers and other processors/sub-processors and their contractual and transfer safeguards.
• Neither party shall introduce a material new data flow involving the other party without appropriate privacy and security assessment.
• Each party shall notify the other without undue delay of any material change to its processing arrangements that may affect the other party's data, including:
• a new processor or sub-processor;
• a change in processing or storage location;
• a new international transfer;
• a material change to an integration;
• a significant change to data categories; or
• a material security or privacy incident.
• The parties shall cooperate where the change requires updates to data-flow mapping, transfer assessments, contractual arrangements, the ROPA, DPIA or privacy information.

Signing this Agreement is a condition of Clinic registration and activation on EveryClinic.

• It has authority to enter into this Agreement.
• Information supplied to EveryClinic about the Clinic and practitioners is accurate and kept up to date.
• It has appropriate privacy, confidentiality, security and information-governance arrangements.
• Its EHR/clinical system securely receives and stores clinical information entered by patients.
• It will not intentionally route unnecessary clinical information through EveryClinic systems.
• It will notify EveryClinic of material changes affecting the EveryClinic relationship.
• It will cooperate with reasonable compliance, security and data-protection enquiries.

EveryClinic may delay activation, suspend access or remove a Clinic where reasonably necessary to protect patients, personal data, platform security or legal/regulatory compliance, including a material breach or significant unresolved data-protection/security risk.

EveryClinic may request reasonable information or evidence from the Clinic to verify compliance with this Agreement, including information about privacy notices, security arrangements, integrations, EHR providers, incident management, staff training and relevant processor arrangements.

The Clinic shall provide such information within a reasonable period and shall cooperate with proportionate remedial actions where a compliance or security weakness is identified.

The parties shall maintain sufficient records and evidence to demonstrate compliance with their respective responsibilities.

• EveryClinic shall maintain its ROPA, DPIA, data-flow mapping, supplier records, incident records and relevant training/compliance evidence.
• The Clinic shall maintain evidence appropriate to its healthcare processing, including privacy information, security controls, confidentiality/training, incident management and relevant processor arrangements.
• The parties shall cooperate reasonably with regulatory enquiries concerning the documented relationship or data flow.
• Review this Agreement at least annually and following material changes to the platform, EHR integration, data categories, suppliers, logging, retention or international transfers.
• Any compliance review or information request shall be proportionate to the relevant risk and shall, where possible, avoid unnecessary access to clinical records or confidential information unrelated to the EveryClinic platform relationship.
• Information obtained through compliance reviews must be handled confidentially and used only for legitimate data-protection, security, contractual or regulatory purposes.

This Agreement takes effect when signed by authorised representatives of both parties and remains in force while the Clinic participates on the EveryClinic platform, unless terminated earlier under the parties’ wider commercial arrangements.

Termination does not remove legal obligations concerning personal data already processed. Each party shall continue to retain, delete or otherwise handle its data in accordance with applicable law and its documented requirements.

By signing below, the Clinic confirms that it:

• has read and understood this Agreement;
• agrees to comply with the data-protection, confidentiality, security and platform requirements;
• understands that it is responsible for its own clinical and Article 9 health-data processing;
• understands that clinical information is intended to be entered directly into its own EHR and not stored by EveryClinic;
• will notify EveryClinic promptly of material changes;
• will use only approved integrations, forms and platform functionality for submitting information to EveryClinic;
• will not intentionally submit unnecessary clinical or special category information to EveryClinic;
• will maintain appropriate security, confidentiality, privacy and incident-management arrangements; and
• will cooperate with reasonable requests concerning data-protection, security, supplier or international-transfer compliance.
• accepts that this Agreement is a condition of registration and continued participation on EveryClinic.

Document owner: EveryClinic Compliance / Privacy

DPO: Lakhbir Dhillon | dataprotection@everyclinic.com

Review: at least annually and following material changes to the platform or Clinic data flows.