Draft — to be reviewed by a solicitor before launch
Data Processing Agreement
Last updated:
The short version
Your practice controls its enquiry data. We process it only to provide the service and follow your lawful instructions. We protect it, help you meet your data protection duties, notify you of a personal data breach without undue delay and within 48 hours of becoming aware, and return or delete it when you leave.
1. Parties and scope
This DPA is between the subscribing dental practice identified in its account (the controller, you) and [Company legal name], trading as OpenDent (company number [Company number]), of [Registered address] (the processor, we). It is incorporated into the Terms of Service when you accept them, including during the free trial. No separate signature is required. Contact us at hello@opendent.co.uk.
It applies to personal data we process on your behalf under UK GDPR and the Data Protection Act 2018, as amended (data protection law). Terms such as personal data, processing and personal data breach have their meanings in that law. This DPA takes priority over conflicting service terms about processing personal data. Our separate controller activities are described in our Privacy Policy.
2. Processing details
| Subject matter | Providing a website enquiry widget and a light enquiry inbox/CRM to a UK dental practice. |
|---|---|
| Duration | The trial and subscription, followed by the limited return/deletion and backup periods below. These obligations continue while we hold personal data on your behalf. |
| Nature and purpose | Collecting, receiving, recording, organising, storing, retrieving, displaying, transmitting, reporting on, exporting and deleting enquiries and associated records to help the practice manage and follow up enquiries. Sources include the widget, Facebook Messenger, Instagram DMs, Facebook Lead Ads, webforms and email, as enabled by you. |
| People whose data is processed | Website visitors, prospective and existing patients, people contacting the practice or acting for patients (including parents or carers), and practice staff or contractors recorded in the inbox. Enquiries may incidentally include children’s information. |
| Personal data categories | Name, email, phone, treatment interests, free-text messages and channel identifiers; page URL, referrer, ad click IDs and UTM tags; device and technical information, and approximate city/region from Cloudflare; staff identifiers, roles and activity; notes, tasks, files and report contents. |
| Special category data | Treatment interests, free-text answers, notes or attachments may reveal health information. Unsolicited content may contain other special category information. The service is for enquiries, not clinical records. Do not ask for clinical histories, diagnoses, photographs or other unnecessary sensitive details. |
| Controller rights and duties | You determine lawful purposes and instructions, provide notices, select appropriate lawful bases and any special category conditions, manage access and retention, and handle individuals’ rights and regulatory duties. You may give lawful instructions, request assistance, audit, and require return or deletion as set out here. |
3. Your instructions and responsibilities
Your documented instructions are this DPA, the service settings you choose, your use of supported features and further lawful written instructions from an authorised practice contact. They include processing necessary to provide your selected integrations and the transfers described here. Further instructions must remain within the agreed service unless we agree otherwise in writing.
You must have an Article 6 lawful basis and, for health or other special category data, an applicable Article 9 condition and any required Data Protection Act 2018 safeguards. Starting a chat alone does not establish consent to all later uses. Provide notices and obtain PECR consent where needed for storage, attribution and communications. Tell visitors not to submit clinical details or emergencies.
We will process personal data only on your documented instructions, including for international transfers, unless UK law requires otherwise. If the law requires processing, we will tell you about that requirement before processing unless the law prohibits this on important public interest grounds. We will immediately tell you if we believe an instruction infringes UK GDPR or other applicable UK or EU data protection law and pause that instruction while it is resolved.
We will not sell the data, use it for our own marketing or use it for unrelated purposes.
4. Confidentiality and security
We will ensure that everyone authorised to process your personal data is bound by confidentiality obligations or an appropriate statutory duty of confidentiality. Access is limited to what they need for their work.
We will implement and maintain appropriate technical and organisational measures under Article 32, taking account of the nature of the data, health-data risks, costs, available technology and risks to individuals. Our minimum contractual measures are:
- Encrypted network connections for service access and data transfers, with provider-supported encryption for stored databases, files and backups.
- Authenticated access, practice-level separation, role-based permissions and restricted privileged access. Staff access is reviewed and removed when no longer needed.
- Secure credential and secret handling, software updates and proportionate vulnerability management.
- Appropriate security logging and monitoring, incident response procedures and a way to report security concerns.
- Rotating backups, recovery procedures and periodic checks of restoration and security measures.
- Data minimisation, automatic cleanup of abandoned data, secure deletion and controls over retained backups.
- Confidentiality and data handling instructions for authorised personnel, and review of relevant providers and their contractual protections.
Draft implementation check: the owner must verify these measures against the live system before offering this DPA. They are contractual commitments, not a claim of certification.
5. Personal data breaches
We will notify your nominated practice contact without undue delay and in any event within 48 hours after becoming aware of a personal data breach affecting your data. We will not wait for a complete investigation or a sub-processor’s final report.
We will provide the nature of the breach, categories and approximate numbers of people and records affected where known, likely consequences, action taken or proposed, mitigation advice and a contact for further information. We will send information in stages where necessary, keep you updated and cooperate with containment, investigation and remediation.
You decide whether to notify individuals or the ICO, unless the law separately requires us to do so. Our 48-hour limit does not extend your own notification deadlines, including the UK GDPR’s 72-hour ICO deadline where applicable.
6. Sub-processors
You give general written authorisation to the sub-processors listed below. We will use written contracts imposing equivalent Article 28 data protection obligations, including appropriate security guarantees, and remain responsible to you for their performance of those obligations.
| Provider | Service and data | Location and safeguards |
|---|---|---|
| Cloudflare | Workers, Durable Objects, D1 database and Email Sending/Routing: hosting, storage and delivery of enquiries, messages, files and associated technical data. | Global infrastructure, including the US. UK IDTA or EU standard contractual clauses with the UK Addendum, with a transfer risk assessment and any necessary additional measures. |
Stripe handles our subscription billing and is not authorised under this DPA to receive patient enquiry content. Practice-selected Meta, form and email accounts are governed by your arrangements with those providers; any provider we appoint to process your data on our behalf is subject to this section.
We will email your account contact at least 30 days before adding or replacing a sub-processor, with its identity, function and relevant location/transfer details. You may object on reasonable data protection grounds within that notice period. We will work with you on a reasonable alternative and will not send your data to the disputed new provider while the objection is unresolved. If no solution is available before the change is needed, you may end the affected service before it takes effect and receive a refund of any prepaid unused fees.
7. International transfers
Cloudflare operates globally, including in the US. We will not make a restricted transfer without your documented authorisation and a lawful transfer mechanism. Where appropriate safeguards are needed, we will use the UK IDTA or EU standard contractual clauses with the UK Addendum, complete the required transfer risk assessment and implement any necessary additional measures. EU clauses alone are not sufficient for a restricted UK transfer.
We will provide relevant transfer information and copies of safeguards on request, subject to proportionate redaction of confidential material. Mandatory transfer terms take priority over conflicting provisions here. Before launch, the owner must confirm the actual provider contracting entities, processing locations and executed transfer documents.
8. Helping you meet your duties
Taking account of the processing and the information available to us, we will provide appropriate technical and organisational assistance with access, correction, erasure, restriction, portability, objections and other applicable individual rights. We will promptly forward requests about your data and will not respond substantively without your instructions unless legally required.
We will help you meet Articles 32–36 obligations, including security, breach assessment and notification, data protection impact assessments and prior consultation with the ICO. Tell us promptly what assistance you need. We will agree any reasonable charge for exceptional additional work in advance; fees or an unresolved price discussion will not prevent assistance required by law.
9. Retention, return and deletion
Unfinished chat sessions expire after 24 hours. Abandoned data is cleaned up automatically within 180 days (7 days for test chats) after expiry. Completed enquiry retention follows your lawful instructions; you should review and remove data you no longer need.
At the end of the service, you choose return or deletion of all personal data processed for you. Request an export before or within 30 days after termination by emailing hello@opendent.co.uk; we will return it securely in a commonly readable electronic format, including uploaded files where applicable. If you do not request return in that period, you instruct us to delete it. You may instead instruct deletion sooner.
We will delete live copies and remaining export copies within [Post-termination deletion period] after completing your requested return, receiving your deletion instruction, or the end of the 30-day request period, as applicable. Copies held in backups will be put beyond normal use and overwritten within 30 days. They will not be used for another purpose; if recovery requires restoration, deletion instructions will be reapplied.
If UK law requires continued storage, we will explain that requirement unless prohibited, retain only the necessary data, protect it under this DPA and delete it when the duty ends. We will confirm completion of return or deletion on request. The bracketed periods must be completed and verified before launch.
10. Information, audits and inspections
We will make available all information needed to demonstrate compliance with Article 28 and allow and contribute to audits and inspections by you or an independent auditor you appoint. We will answer reasonable security and compliance questions and provide relevant records, provider assurance information and evidence of controls.
We will agree reasonable notice, scope, confidentiality and timing to protect other customers and service security. Existing reports or remote review may be a practical first step, but do not replace your right to an inspection where needed. Urgent concerns, a suspected breach or a regulator’s requirement will be handled promptly without a routine notice restriction. We will agree any reasonable external costs beforehand; cost arrangements will not obstruct statutory audit rights.
11. Liability, duration and law
The Terms’ liability provisions apply to this DPA only to the extent permitted by law. Nothing in it removes either party’s direct duties under data protection law, limits an individual’s statutory rights or restricts a regulator’s powers. We remain liable to you for our sub-processors’ data protection obligations as required by Article 28.
This DPA continues until all data processed for you has been returned or deleted, subject to lawful retention. It is governed by the law of England and Wales, with disputes subject to the courts of England and Wales, as set out in the Terms.
For background, see the ICO’s guidance on controller–processor contracts.