Data Processing Agreement

Last updated: draft, 25 October 2026

1. What this agreement is

This agreement is between you, the clinician with an account, and [company name — to be added] Ltd ("we", "us"), which runs The Exercise Database. It forms part of our terms of service, and you accept it when you create an account.

It covers your patients' personal data that you put into the service. For that data:

• you are the controller: you decide what is recorded about your patients and why
• we are your processor: we store and process it only on your instructions, to provide the service

It does not cover your own account details, for which we are the controller. Our privacy policy covers those.

If this agreement and the terms of service disagree about your patients' data, this agreement wins.

"Clinician" means anyone with an account, whatever their profession.

2. The processing

3. Your instructions

We process your patients' data only on your documented instructions. Your instructions are:

• this agreement and the terms of service
• what you do in the service: adding, editing, sending, archiving and deleting patients and their records
• the retention rule the service applies, which you instruct us to apply by using it: a clinical record is kept for 8 years after last contact, or until the patient's 25th birthday if later (26th if they were 17 at last contact), then deleted automatically
• any other written instruction you send us that we agree is within the service

If we think an instruction breaks data protection law, we will tell you and need not follow it. If the law requires us to process the data in another way, we will tell you first, unless the law forbids that.

4. Your responsibilities as controller

You are responsible for having a lawful basis and an Article 9 condition for every patient's data, and for telling your patients how it is used. The terms of service, section 9, set out what that means, including that if you are not a registered health professional, you must obtain your patient's explicit consent before recording information about their health.

5. Confidentiality

Everyone we allow to process your patients' data is bound by confidentiality. Today that is one person: the company's director. We only open your patients' records to fix a fault, or because you asked us to, never otherwise. Access through the service is recorded in the patient's access log. Access through our database provider's own tools is not recorded there.

6. Security

We take the measures Article 32 requires. They are listed in schedule 1, and kept up to date in our internal information security policy. A summary is available on request.

7. Sub-processors

You give us general authorisation to use the sub-processors listed at /sub-processors.

• We will email you at least 30 days before adding or replacing a sub-processor, saying who, what for and where.
• You can object within that time. If we cannot address your objection, you can leave the service, taking your patients' records with you, before the change takes effect.
• Each sub-processor is bound by a written contract with data protection terms at least as protective as these.
• We remain responsible to you for what our sub-processors do.

8. Data leaving the UK

Your patients' data is stored and processed in Frankfurt, Germany, which UK law treats as adequate. Two things go further:

• Emails to patients go through Resend in the United States. They carry the patient's first name, email address and link. The transfer is protected by the UK international data transfer addendum to the EU standard contractual clauses, and Resend is certified under the UK Extension to the EU-US Data Privacy Framework.
• Access by our database and hosting providers from outside the UK and EEA is covered by the same approved clauses in their contracts.

Encrypted backups are held by Google. Google has no key and cannot read them.

We will not move your patients' data anywhere else outside the UK without updating the sub-processor list under clause 7.

9. Helping you

Your patients' rights. The service gives you the tools to answer your patients' requests yourself: the data report for a copy, editing to correct, archiving to restrict, and deletion where the retention rule allows. If a patient contacts us instead, we will pass the request to you within two working days, and not answer it ourselves.

Breaches. If we become aware of a personal data breach affecting your patients' data, we will tell you without undue delay, and within 48 hours at most. We will tell you what happened, which of your patients are affected, what data, what we have done and what we are still doing, and give you what you need to decide whether to report it to the ICO and tell your patients. That decision is yours, as controller.

DPIAs. We have written a data protection impact assessment of the service, which you can adopt or build on. We will help with any further assessment or consultation with the ICO that you need.

10. When you leave

• Before you can leave while holding patient records, you download a copy of them. That copy is how we return the data to you.
• Leaving archives your patients for 30 days, so you can change your mind. After that, we delete our copy automatically.
• If you want our copy deleted sooner, tell us in writing.
• Copies in our encrypted backups age out within six months. They are never restored selectively in the meantime.
• If a patient is also a patient of another clinician on the service, the parts of the record that belong to that clinician are kept for them.

11. Showing that we comply

We will give you the information you reasonably need to show that this agreement is being kept, including a summary of our security measures.

If that is not enough, you, or an auditor you appoint who is bound by confidentiality, can audit our compliance, on at least 30 days' notice, no more than once a year unless the ICO requires or there has been a breach, and at your own cost. Audits cover our own systems. Our sub-processors are audited through the certifications and reports they publish.

12. Our own duties

This agreement does not take away any responsibility we have as a processor under data protection law. We keep a record of our processing, cooperate with the ICO, and are directly responsible for our own failures.

Liability between us is governed by the terms of service, section 13.

13. Law

This agreement is governed by the law of Scotland, and the Scottish courts have exclusive jurisdiction.

Schedule 1: Security measures