Data Processing Agreement

Your practice group is the controller; OakStone Digital Ltd is the processor. We act only on your documented instructions and never determine the purposes of processing patient data.

We process the minimum needed to send appointment communications: first name, mobile number, appointment date/time/type and attendance status. We do not receive or store clinical records — notes, x-rays and treatment history stay in your PMS. We do not sell patient data, use it for advertising, or use it to train any AI model, and we configure our AI sub-processors so your data is never used for their model training.

A general written authorisation covers the sub-processors listed in Annex 3 of the DPA (summarised on our Security page). We give at least 30 days' notice of any change and you may object on reasonable data-protection grounds. We remain fully liable for our sub-processors and maintain the current list at a URL notified to you.

Stored data is hosted in the UK. Where a sub-processor is outside the UK, transfers rely on UK adequacy (EEA) or approved mechanisms (UK Addendum / IDTA) supported by a documented transfer-risk assessment, reviewed annually.

Technical and organisational measures are set out in Annex 2: UK-hosted encrypted storage, TLS 1.2+ in transit, AES-256 at rest, row-level client isolation, MFA on all admin accounts, secrets held only in an encrypted store, and pseudonymisation of stored identifiers.

Message content is deleted within 90 days; contact records within 30 days of a patient ceasing to be eligible; opt-outs kept indefinitely as hashed identifiers. On termination, patient data is deleted or irreversibly anonymised, with a certificate on request.

We notify you without undue delay on becoming aware of a personal data breach, with the information you need to meet your own regulatory obligations.

Once every 12 months at no charge you may audit us via a written security questionnaire, with our security documentation and sub-processor due-diligence records provided within 21 days; on-site inspection is available following a demonstrated concern or a breach.

England and Wales.

The complete DPA, DPIA and sub-processor due-diligence records are available at no charge for your due diligence. Email hello@oakstone-digital.com.