Data Processing Agreement

Version v1 · Hexyl Ltd (Processor) and the Clinic (Controller)

Draft — pending legal review. This is placeholder wording so the onboarding agreement link resolves. Replace with the legally-reviewed DPA before launch.

This Data Processing Agreement ("DPA") forms part of the agreement between the clinic ("Controller") and Hexyl Ltd ("Processor") governing the Processor's processing of personal data on the Controller's behalf when providing the Hexyl AI reception service.

1. Roles

The Controller determines the purposes and means of processing patient personal data. The Processor processes that data only on the Controller's documented instructions.

2. Nature and purpose of processing

The Processor processes patient personal data to answer calls and messages, book, cancel and reschedule appointments, send confirmations and reminders, and maintain the clinic's booking records.

3. Categories of data

Name, contact details (phone, email), date of birth, appointment details, and health concerns disclosed by the patient. Health data is special-category data under UK GDPR Article 9 and is processed only to the extent necessary to provide the service.

4. Processor obligations

Process personal data only on the Controller's documented instructions.
Ensure persons authorised to process the data are bound by confidentiality.
Implement appropriate technical and organisational security measures.
Assist the Controller with data-subject requests and breach notification.
Engage sub-processors only under equivalent written obligations, and inform the Controller of intended changes.
Delete or return personal data at the end of the service, save where retention is legally required.

5. Call recording and transcripts

Where enabled, calls may be recorded and transcribed for booking and quality purposes. The Controller is responsible for informing patients, and the Processor stores such data under the security measures in this DPA.

6. International transfers

Personal data is processed within the UK/EEA. Any transfer outside is made only under an approved transfer mechanism.

7. Sub-processors

Current sub-processors (e.g. cloud hosting, telephony, messaging providers) are listed in the Processor's sub-processor register, available on request.