Data Processing Agreement

1. Parties, background and definitions

This Data Processing Agreement (DPA) forms part of the Agreement between the two parties below and meets the requirements of Article 28 of the UK GDPR and the EU GDPR.

1.1 The Agreement means the Heedly Website Platform Terms of Service and the Order Summary the Clinic confirms when it signs up. If this DPA conflicts with the Agreement on any matter relating to personal data, this DPA prevails.

1.2 Heedly provides the Heedly website platform to the Clinic, including website hosting and editing, a client contact (CRM) tool, email, social media and advertising integrations, AI features, and performance reporting (the Services). Managed marketing services are provided under a separate agreement and are outside this DPA. In doing so Heedly processes personal data on the Clinic's behalf, including client contact details and appointment data, and this DPA sets out the rules for that handling.

1.3 In this DPA:

2. Roles, scope and instructions

2.1 Roles. For Clinic Personal Data, the Clinic is the Controller and Heedly is the Processor. Annex 1 lists the subject matter, duration, nature, purpose, data types and Data Subjects.

2.2 Heedly as controller for its own purposes. Heedly is an independent Controller for the personal data of the Clinic's staff that it holds to run the account, bill the Clinic (including through Heedly's central Stripe account), send signup notifications to its internal tools, and market its own services. That data is covered by the Heedly Privacy Notice, not this DPA.

2.3 Practice management system data. Where the Clinic connects its practice management system (PMS), currently Lupa, Heedly receives individual appointment records, stores aggregated statistics from them, and synchronises the Clinic's service catalogues and prices. The appointment fields Heedly processes are listed in Annex 1. The Clinic must not configure an integration, export or upload that sends other records to Heedly without first agreeing a change to Annex 1 in writing.

2.4 Instructions. Heedly will Process Clinic Personal Data only on the Clinic's documented instructions, which are this DPA, the Agreement and the Clinic's use of the Services (for example, editing its website). Heedly may also Process where UK, EU or Member State law requires it, and will tell the Clinic first unless the law forbids that.

2.5 Unlawful instructions. Heedly will tell the Clinic if it believes an instruction breaches Data Protection Law, and may pause that part of the Processing until the Clinic confirms or changes the instruction.

2.6 Own use. Heedly will not use Clinic Personal Data to train its own AI models, sell it, or combine it with data from other clients, except in aggregated and anonymised form that cannot identify any person or the Clinic. Heedly will use reasonable endeavours to engage AI providers on terms that do not allow them to train their models on Clinic Personal Data.

3. Heedly's obligations as Processor

3.1 Confidentiality. Heedly will make sure everyone authorised to Process Clinic Personal Data is bound by a written or statutory duty of confidentiality, and limit access to those who need it to deliver the Services.

3.2 Security. Heedly will keep technical and organisational measures that are appropriate to the risk, taking into account Article 32 of the UK GDPR and EU GDPR. The minimum measures are in Annex 2. Heedly may update them if the protection stays at least equal.

3.3 Sub-processors. The Clinic gives general authorisation for Heedly to use the Sub-processors in Annex 3. Heedly will:

• give the Clinic at least 30 days' written notice (email is enough) before adding or replacing a Sub-processor
• sign a written contract with each Sub-processor that imposes data protection obligations no less protective than this DPA
• stay fully liable to the Clinic for each Sub-processor's performance

If the Clinic objects on reasonable data protection grounds within that notice period, the parties will work in good faith to find a solution. If none is found, the Clinic may end the affected Services and receive a pro rata refund of any prepaid fees for them.

3.4 Data Subject requests. If Heedly receives a request from a Data Subject about Clinic Personal Data, it will pass it to the Clinic within 5 working days and will not reply except to say it has been passed on. Taking account of the nature of the Processing, Heedly will give reasonable help so the Clinic can respond within legal time limits.

3.5 Assistance. Heedly will give reasonable help with the Clinic's duties on security, breach notification, data protection impact assessments and prior consultation with a Supervisory Authority, taking account of the information Heedly holds. Help beyond routine support may be charged at Heedly's then-current day rate, agreed in advance.

3.6 Personal Data Breach. Heedly will tell the Clinic without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Clinic Personal Data. The notice will give what Heedly knows about the nature of the breach, the data and people affected, likely consequences, and the steps taken or proposed. Heedly will keep the Clinic updated as more becomes known. The Clinic decides whether to notify the ICO, other Supervisory Authorities or Data Subjects.

3.7 Return and deletion. When the Services end, Heedly will provide an export as set out in the Effect of termination section of the Terms of Service. Heedly will delete the Clinic's tenant and its data from the live platform within 60 days after the Services end, and not before the export period has ended. Copies held in database backups are overwritten as the backups expire, within a further 35 days. Heedly may keep data that the law requires it to keep, limited audit records with personal details redacted, and the account details of users who have access to other clinics on the platform. Heedly will confirm deletion in writing on request.

3.8 Audit and information. Heedly will give the Clinic the information needed to show compliance with Article 28 and will allow audits by the Clinic or an auditor it appoints, no more than once a year unless a breach or a Supervisory Authority requires otherwise. The Clinic must give at least 30 days' notice, keep the audit proportionate and in working hours, and protect Heedly's confidential information. Heedly may meet this obligation by sharing current security documentation or Sub-processor assurance reports.

4. Clinic obligations, transfers, liability and term

4.1 Clinic obligations. The Clinic will:

• make sure it has a lawful basis for the Processing it instructs and has given Data Subjects the notices Data Protection Law requires, including a privacy notice and cookie notice on its website
• make sure its instructions comply with Data Protection Law
• keep its own account credentials secure and tell Heedly promptly if it suspects they are compromised
• review content it publishes or uploads to confirm it does not include personal data it has no right to share

4.2 International transfers. Heedly will make a Restricted Transfer only where Data Protection Law allows it. Heedly is established in the UK, and data currently flows between the UK and the EEA under each side's adequacy decisions. For transfers to Sub-processors outside the UK and EEA, the mechanism for each is listed in Annex 4. If an adequacy decision or certification relied on is withdrawn, Heedly will switch to the IDTA or the EU SCCs with the UK Addendum, which are incorporated into this DPA by reference and apply automatically in that case.

4.3 Both laws apply. Where the Clinic is established in the UK, UK Data Protection Law applies to the Processing. Where the Clinic is established in the EEA (for example, Norway), the EU GDPR as applied in that country also applies. Heedly will comply with whichever applies to the Clinic, and the stricter requirement wins where they differ.

4.4 Liability. Each party's liability under or in connection with this DPA is subject to the limits and exclusions in the Agreement. Nothing in this DPA limits liability that cannot lawfully be limited, or affects the rights of Data Subjects under Data Protection Law.

4.5 Term. This DPA starts on the effective date and continues for as long as Heedly Processes Clinic Personal Data. Clauses 3.7, 3.8 and 4.4 continue after the Services end.

4.6 Changes. If Data Protection Law changes, or a Supervisory Authority or court requires different terms, the parties will agree in good faith any amendment needed to stay compliant. Heedly will give written notice of any other change to this DPA at least 30 days before it takes effect.

4.7 Governing law. This DPA is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction, except where the IDTA, the UK Addendum or the EU SCCs require another law or forum.

Annex 1: Details of Processing

Annex 2: Security measures

• Passwords stored hashed and selected credentials stored encrypted; encryption in transit and at rest as provided by the hosting platform
• Role-based access, with multi-factor authentication available to users but not yet mandatory for administrators
• Unique credentials per user; Heedly staff use a password manager
• Separation of each Clinic's data from other clients through tenant scoping in the platform
• Hourly database backups kept for 72 hours and daily database backups kept for 35 days, with automated backup checks
• Prompt installation of security updates on the platform and its dependencies
• Written confidentiality duties for staff and contractors
• An incident response process that supports the 48 hour notice in clause 3.6
• Reasonable endeavours to use AI providers on terms that do not allow training on Clinic content; this is not yet verified for every configurable provider
• Deletion of a Clinic's tenant removes its data from the live platform, and backup copies expire as set out in clause 3.7

Annex 3: Authorised Sub-processors

The Clinic's own suppliers are not Heedly Sub-processors. They include its PMS and booking providers (currently Lupa, PetsApp and Vetstoria), the Google, Meta, TikTok and Twitch accounts it connects, and its Telegram bot. Personal data that Heedly imports from them for the Clinic, such as appointment records, comment authors, messages and mailbox content, is Clinic Personal Data under this DPA once it reaches the platform. Heedly's own billing through its central Stripe account, and the owner details sent to its internal tools at signup, are covered by clause 2.2, not this DPA. Laravel Forge (server management) and Open Exchange Rates (currency rates) do not receive Clinic Personal Data and are not listed.

Annex 4: Restricted Transfers

Where the EU SCCs apply, Module Two (Controller to Processor) is used between the Clinic and Heedly, and Module Three (Processor to Processor) between Heedly and its Sub-processors. Clause 7 (docking) is included, the option in clause 11 is not used, and the governing law and courts are those of Ireland. The Annexes to the EU SCCs are completed by Annexes 1 to 3 of this DPA.

Acceptance

This DPA is incorporated into the Heedly Website Platform Terms of Service. The Clinic accepts it by accepting the version of the Terms of Service that refers to it, and Heedly will record the Terms version and the date and time of acceptance. No separate signature is needed. Heedly signs as Matt Madden Photography Ltd (trading as Heedly), acting through Matt Madden, Director.