Data Processing Agreement

Version: 2026-09-26

This Data Processing Agreement ("DPA") forms part of the PatientPulse Terms of Service published at app.patientpulse.co/terms ("Terms"). You accept it when you accept the Terms as part of signing up. It applies from the first time we process Clinic Personal Data for you, including during a free trial, and continues for as long as we hold any Clinic Personal Data.

If this DPA and the Terms say different things about personal data, this DPA applies.

1. Who this agreement is between

• Us: SKINFIND LTD, trading as PatientPulse, a company registered in England and Wales (company number 16711783), registered office 64 Frith St, London W1D 3JP. Privacy contact: privacy@patientpulse.co.
• You: the clinic or business that accepted the Terms.

2. Meaning of words used here

• Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended or replaced from time to time, and, where it applies to you, the EU GDPR.
• Clinic Personal Data means the personal data described in Annex 1 that we process for you when we provide the Services.
• Services means the PatientPulse Treatment Finder, dashboard, email alerts and the related features described in the Terms.
• Sub-processor means a provider we engage that processes Clinic Personal Data.
• Personal Data Breach, controller, processor, data subject, processing and special category data have the meanings given in the UK GDPR.

3. Roles

3.1 For Clinic Personal Data you are the controller and we are your processor.

3.2 We are a controller, not a processor, for our own records about you as a customer: your account and sign in details, billing records, support correspondence about your account, and data about visits to our own website. Our Privacy Policy covers those. This DPA does not.

3.3 You are responsible for:

• having a lawful basis for the processing and, because enquiries can reveal information about a person's health, a condition for processing special category data;
• telling patients and website visitors, in your own privacy and cookie notices, that you use a service provider to run your treatment finder and handle enquiries, that their information may be stored or accessed outside the UK as set out in section 8, and about the cookie and video content described in Annex 1;
• the instructions you give us and the way you configure the Services;
• collecting only what you need. The Treatment Finder is not a medical record and does not ask for medical history. Please do not add questions or form fields that invite patients to send full medical histories.

4. What we process and why

Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

5. Our commitments as your processor

5.1 Your instructions. We process Clinic Personal Data only on your documented instructions. Your instructions are: the Terms, this DPA, the way you set up and use the Services, and any further reasonable instruction you send in writing to privacy@patientpulse.co. This includes transfers outside the UK (section 8). If the law requires us to process Clinic Personal Data in another way, we will tell you before we do so, unless the law prevents us telling you. If we think an instruction breaks Data Protection Law, we will tell you straight away and may pause that instruction until you confirm or change it.

5.2 Confidentiality. Only people who need access to provide, support or secure the Services can access Clinic Personal Data, and each of them is bound by a duty of confidentiality. At the date of this version that is our authorised company administrator. Our administrator also directs AI assistants, used by PatientPulse on accounts we control, to help support, test, secure and maintain the Services. These assistants can open our administration pages, which can show Clinic Personal Data, including patient enquiries. They act only on our instructions, and their providers are listed as sub-processors on our sub-processors page.

5.3 Security. We take the technical and organisational measures in Annex 2, which are designed for data that can include health information. We review them as the Services change.

5.4 Sub-processors. Section 7 applies.

5.5 Helping you with patient requests. The dashboard lets you view, update and export enquiries yourself. If a patient or other data subject contacts us directly about Clinic Personal Data, we will pass the request to you within 5 working days and will not answer it ourselves, other than to tell the person we have passed it on. When you ask us to correct, restrict or delete Clinic Personal Data that you cannot change yourself in the dashboard, we will do so within 30 days of your written instruction, and sooner where we reasonably can.

5.6 Helping you with your other duties. Taking into account the nature of the processing and the information available to us, we will give you reasonable help, at no extra charge, with security, Personal Data Breach notifications, data protection impact assessments and any prior consultation with the Information Commissioner's Office ("ICO"), mainly by providing information we hold about the Services.

5.7 Information and audits. Section 10 applies.

5.8 Records. We keep a record of the processing we carry out for you, as Article 30(2) of the UK GDPR requires.

6. Personal Data Breaches

6.1 If we become aware of a Personal Data Breach affecting Clinic Personal Data, we will tell you without undue delay and in any event within 48 hours of becoming aware of it, by email to your account owner address.

6.2 We will tell you, as far as we then know: what happened; the categories and approximate number of people and records affected; the likely consequences; what we have done or propose to do about it; and who you can contact at PatientPulse. If we do not know everything at first, we will send what we know and follow up as we learn more.

6.3 We will take reasonable steps to contain the breach and reduce its effects, and we will keep a record of it.

6.4 You decide whether to notify the ICO or the people affected. We will not do so on your behalf unless you ask us to or the law requires it. Telling you about a breach is not an admission of fault.

7. Sub-processors

7.1 You give us general written authorisation to use the sub-processors listed on our sub-processors page, as it stands when you accept this DPA.

7.2 Before we add or replace a sub-processor, we will update that page and email your account owner at least 30 days before the change takes effect. If a replacement is needed urgently to keep the Services secure or running, we may make it sooner and will tell you as soon as we can.

7.3 You may object to a change within that notice period on reasonable data protection grounds by writing to privacy@patientpulse.co. We will discuss your objection in good faith. If we cannot resolve it, you may cancel your subscription before the change takes effect, and we will refund any prepaid fees for the period after your access ends, calculated pro rata.

7.4 We put a written contract in place with each sub-processor that gives Clinic Personal Data the same level of protection as this DPA, as Article 28(4) of the UK GDPR requires. We remain responsible to you for how our sub-processors process Clinic Personal Data.

8. Transfers outside the UK

8.1 Our main servers and some sub-processors are outside the UK. The sub-processors page shows where each one processes data. At the date of this version, our application and database are hosted in the United States.

8.2 You authorise us to transfer Clinic Personal Data to, and have it accessed from, the countries shown on the sub-processors page. For each such transfer we will make sure one of the following is in place, as Chapter V of the UK GDPR requires:

• UK adequacy regulations covering the destination, including the UK Extension to the EU US Data Privacy Framework where the recipient is certified under it; or
• the International Data Transfer Agreement issued by the ICO, or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

8.3 If the EU GDPR applies to your processing, transfers from you to us rely on the European Commission's adequacy decision for the UK. If that decision stops applying, the EU Standard Contractual Clauses (controller to processor module) are incorporated into this DPA for those transfers.

9. When the Services end

9.1 If your subscription is cancelled or paused, we keep Clinic Personal Data unchanged while your account is paused, so that you can resume or take a copy. This matches section 4 of the Terms: we do not delete your account or your enquiry data when we pause. We do not delete Clinic Personal Data on a timer after your subscription ends; we delete it when you tell us to.

9.2 At any time, and in any case once you have decided not to resume, you can tell us in writing to return Clinic Personal Data, to delete it, or both. You can export your enquiries from the dashboard as a CSV file yourself. On request we will also provide a copy of the Clinic Personal Data we hold for you in a common machine readable format.

9.3 We will complete a deletion from the live Services within 30 days of your written instruction. While our backups run normally, deleted data then leaves our rolling encrypted backups within a further 31 days. Copies in emails already sent, in our email provider's delivery records and in our support mailboxes are deleted where we can reach them, or expire under those providers' retention periods. We will confirm in writing when deletion is complete if you ask.

9.4 We may keep a copy only where the law requires us to. We will protect any such copy and will not process it for any other purpose.

10. Information and audits

10.1 We will make available the information reasonably needed to show that we meet Article 28 of the UK GDPR. This includes this DPA, the sub-processors page, the security summary in Annex 2, and answers to a reasonable written security or data protection questionnaire once in any 12 month period.

10.2 If that information is not enough to show compliance, or a Personal Data Breach or a regulator requires it, you or an independent auditor bound by confidentiality may audit our compliance with this DPA. You must give at least 30 days' written notice, keep the audit to normal business hours, and not seek access to other customers' data. Audits are limited to once in any 12 month period unless a Personal Data Breach or a regulator requires otherwise, and each party bears its own costs.

11. Liability

Each party's liability under or in connection with this DPA is subject to the limitation of liability in section 11 of the Terms, except where the law does not allow liability to be limited.

12. Changes to this DPA

We may update this DPA to reflect changes in the law, regulator guidance or the Services, provided the update does not reduce the protection Clinic Personal Data receives. We will email your account owner at least 30 days before a material change takes effect. The version of the Terms you accepted, which names the version of this DPA, is recorded against your account.

13. Law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Details of the processing

Subject matter. Providing the PatientPulse Services to you.

Duration. For the term of your subscription, including any free trial, and afterwards until the Clinic Personal Data is returned or deleted under section 9.

Nature of the processing. Collecting information through the Treatment Finder on your website; storing, organising and displaying it in your dashboard; sending enquiry alerts and other emails you or a patient have asked for; receiving website form messages you choose to forward to your PatientPulse address; interpreting the words a visitor types into AI Search so the Treatment Finder can show matching treatments; preparing and delivering consultation quotes, where you use them; importing and displaying reviews you authorise; limiting abuse of the Services; making backups; and deleting data.

Purpose. To let visitors to your website explore your treatments and send you enquiries; to deliver those enquiries and alerts to you; to help your team follow them up; to send results copies, availability emails and consultation quotes that a patient has asked for or you have prepared; to display reviews you authorise; to give you reports about your own enquiries; and to keep the Services secure, working and backed up. We do not use Clinic Personal Data for our own marketing, we do not sell it, and we do not use it to train artificial intelligence models.

Categories of data subjects.

• Visitors to your website who use the Treatment Finder.
• Patients and prospective patients who send you an enquiry through the Treatment Finder.
• People whose messages reach you through website forms you forward to PatientPulse.
• People who ask for a copy of their Treatment Finder results or an availability email.
• Patients you send a consultation quote to through PatientPulse, where you use that feature.
• Reviewers whose reviews you import, connect or display.
• Your own staff, only as they appear in enquiry and quote records (for example who owns an enquiry, or a note they added).

Types of personal data.

• Contact details a patient chooses to give: first and last name, email address and phone number.
• The enquiry itself: the treatments and concerns selected, treatment area, downtime and timing preferences, prices shown, and any message the patient writes.
• Treatment Finder context attached to an enquiry: the treatments viewed and the closed set of treatment goals the Finder matched.
• Words typed into AI Search. These are sent for interpretation and are not stored by PatientPulse (see special category data below).
• Consent records: which box was ticked, when, and the wording version shown.
• Source information: the page the enquiry came from, the referring link, campaign tags and advertising click identifiers where present.
• A first-party cookie, tf_utm, that the Treatment Finder sets on your website for 30 days when it loads. It records the campaign tags and any advertising click identifier in the link that first brought the visitor, so an enquiry can show where it came from. It is set without a consent step, so your own cookie notice should cover it.
• One-way hashed browser and network identifiers, used only to limit repeated or abusive use of AI Search and similar features.
• Follow-up records your team creates: status, contact attempts, appointment and attendance dates, booked and paid values, reasons for not proceeding, notes and the staff member assigned.
• Email addresses and the treatment details sent when a patient asks for a results copy or an availability email.
• Consultation quotes, where you use them: the patient's name and email address, the treatments, prices, deposit and notes in the quote, the patient's response, and the sign in records of the patient's secure quote link.
• Forwarded website form messages: whatever your own form collects, as sent to your PatientPulse address.
• Review content: reviewer display name, review text, rating, date and source link.
• Before and after treatment images already stored on your account, where you supplied them. Upload of new images is not currently available.

Special category data. Enquiries can reveal information about a person's health, for example a skin condition, hair loss, weight or a treatment they are considering. The same can apply to AI Search wording, messages, consultation quotes, forwarded forms, review text and treatment images. Extra safeguards:

• Clinic Personal Data is visible only to your account, to our authorised company administrator, and to the AI assistants our administrator directs (section 5.2), for support, maintenance and security.
• AI Search wording is sent to OpenAI with storage disabled and is not stored by PatientPulse. OpenAI states that API data is not used to train its models by default and may be kept in abuse monitoring logs for up to 30 days.
• The Treatment Finder sets no advertising or analytics cookies and loads no advertising or analytics scripts on your website, and its fonts are served by PatientPulse. If you add a YouTube or Vimeo video to a treatment, a visitor's browser loads the YouTube thumbnail when that treatment is opened, and loads the player from YouTube or Vimeo only if the visitor chooses to play it.
• Data is encrypted in transit, and backups are encrypted at rest.

Frequency. Continuous, while the Services are in use.

Retention. We do not automatically delete enquiry data; it is kept until you instruct us to delete it or section 9 applies. Results copy records are deleted automatically after 12 months, or after 3 or 6 months if you choose a shorter period. AI Search wording is not stored by us. While our backups run normally, they are kept on a rolling basis of about 30 days.

Annex 2: Security measures

Encryption

• All traffic between browsers and the Services is encrypted with TLS.
• Off site database backups are stored encrypted at rest by the storage provider.

Access control

• Clinic users sign in with single use links sent to their email address. Each team member has their own login, and access within a clinic is limited by role.
• Each clinic's data is kept within its own account, and an enquiry goes only to the clinic whose website it came from.
• A person signing in to our administration console needs a password and an authenticator app code. An AI assistant our administrator directs signs in with a link that works once and expires after five minutes. The link is issued only to a request carrying a secret access key our administrator holds, and the assistant's session ends twelve hours after it was last used.
• Exports of personal data and other high risk administration actions need a sign in within the last ten minutes: an authenticator code, or for an AI assistant a new single use link. Sign ins and administration actions are recorded in an audit log.
• Forms are protected against cross site request forgery, and sign in and public endpoints are rate limited.

Data minimisation

• AI Search wording is not stored by PatientPulse and is sent with provider storage disabled.
• We do not intentionally send a clinic's identity or treatment menu, or a patient's contact details or enquiry message, with an AI Search request.
• No advertising or analytics cookies are set by the Treatment Finder.

Resilience and recovery

• The database is backed up every 6 hours to a separate provider. While backups run normally, one recovery point per day is kept for 30 days.
• Our procedure for restoring from these backups is written down and has been rehearsed.
• Uptime is monitored and errors raise alerts to us.

People and process

• Access to Clinic Personal Data is limited to our authorised company administrator, who is bound by confidentiality, and to the AI assistants our administrator directs (section 5.2), which act only on our instructions.
• Changes to the Services are released through a scripted release process that runs our automated test suite.
• We follow a written Personal Data Breach procedure, including the notice commitment in section 6.
• Sub-processors are bound by written data protection terms (section 7.4).