Data Processing Agreement

Last updated 23 October 2026 · HEIMDELL TECH AI LTD

1. Roles

The Customer is the controller of personal data in Customer Data. We act as processor and will process it only on the Customer's documented instructions. The Terms, the Customer's settings and the Customer's use of the Service are those instructions. If we think an instruction breaks data protection law, we will tell the Customer.

2. Our obligations

• Confidentiality: anyone at HEIMDELL TECH AI LTD who can access Customer Data is bound by confidentiality, and access is limited to what is needed to run, secure and support the Service.
• Security: we keep in place the measures in Annex 2 and review them regularly.
• Sub-processors: the Customer gives general authorisation for the sub-processors in Annex 3. We will give at least 30 days' notice (by email or in the app) before adding or replacing one, and the Customer may object on reasonable data protection grounds. If we can't resolve the objection, the Customer may cancel and receive a pro-rata refund of prepaid fees. We impose data protection terms on each sub-processor equivalent to this DPA and remain responsible for them.
• Assistance: taking into account the nature of the processing, we will help the Customer respond to data subject requests, carry out data protection impact assessments, consult the ICO, and meet its security obligations. The app's export, edit and delete functions are the main way of doing this.
• Breaches: we will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information the Customer needs to meet its own obligations, and we will help contain and investigate it.
• Deletion and return: at the end of the service, Customer Data is available for export for 90 days and then deleted (including from backups within a further 35 days), unless the law requires us to keep it.
• Audits: we will make available the information needed to show we comply with this DPA and allow reasonable audits, on 30 days' notice, no more than once a year (unless the ICO requires or there has been a breach), at the Customer's cost and subject to confidentiality.
• Transfers: we will only transfer Customer Data outside the UK with an appropriate safeguard under UK data protection law (see the Privacy Policy, section 4).

3. Customer obligations

The Customer is responsible for the lawfulness of the personal data it collects and its instructions, including having a lawful basis under Article 6 and a condition under Article 9 for health data (typically Article 9(2)(h), the provision of health care, with the processing carried out by or under the responsibility of a health professional), giving privacy information to patients and staff, and setting user roles appropriately.

Annex 1 — Details of processing

Annex 2 — Security measures

• Encryption in transit (TLS/HTTPS) and at rest (AES-256-GCM for records and files), with keys held separately from data.
• Logical separation of each Customer's data, enforced on the server for every request.
• Role-based access within each Customer: responders see their own patient records; team leaders, commanders and admins see the whole team's.
• Salted password hashing (scrypt), session expiry, lockout after repeated failed log-ins, one-time password reset links that expire after 1 hour.
• Audit log of sign-ins and of viewing, creating and deleting patient records and files.
• Patient records are removed from a phone when its user logs out.
• Regular encrypted backups, hardened server configuration, and timely security updates.
• Platform administrators can see Customer account and billing information but not Customer Data records.

Annex 3 — Approved sub-processors