Tallowfield Health Partners - Data Processing Agreement (signed)
Documentexecuted Tallowfield Health Partners: documents · dpa · executed · 2026-06-12
Executed data processing agreement between BB-Demo Limited (Processor) and Tallowfield Health Partners (Controller), dated 12 Jun 2026. Liability is capped at fees paid in the preceding twelve months. It states no price, availability or response-time figures.
What it says
What this says
Current to 11 Oct 26Executed data processing agreement between BB-Demo Limited (Processor) and Tallowfield Health Partners (Controller), dated 12 Jun 2026. Liability is capped at fees paid in the preceding twelve months. It states no price, availability or response-time figures.
What it is: a standard DPA under which BB-Demo processes personal data only on the Controller's documented written instructions, for operating the brain inside the Controller's own Snowflake account.
Commits: the Processor to confidentiality, encryption in transit and at rest, access controls, audit logging and assistance with Data Subject rights. Liability for breach is "limited to direct losses and capped at fees paid in the preceding twelve months".
Unusual: deletion of the Processor's own copies follows "the timeframe specified in the Order Form", so the DPA alone does not fix it. The signature blocks show blank signature lines and no named signatories, only "Authorised Officer" titles.
Not settled: the sub-processor list (available on request), the data region (designated by the Controller), the deletion timeframe, and any price, term or service level. Those sit in the order form, which is not in this document.
As found in this document
Current to 9 Oct 26- Date signed12 Jun 2026Source: object_read:doc_031_005
- Processing instructionsonly on the Controller's documented written instructionsonly on the Controller's documented written instructions · Source: object_read:doc_031_005
- Security measuresEncryption of data in transit and at restEncryption of data in transit and at rest · Source: object_read:doc_031_005
- Return and deletionThe Processor deletes its own copies within the timeframe specified in the Order FormThe Processor deletes its own copies within the timeframe specified in the Order Form · Source: object_read:doc_031_005
- Liabilitylimited to direct losses and capped at fees paid in the preceding twelve monthslimited to direct losses and capped at fees paid in the preceding twelve months · Source: object_read:doc_031_005
The document
Body
Data Processing Agreement
Executed 12 June 2026
This Data Processing Agreement is entered into between BB-Demo Limited, a data business registered in England ("Processor"), and Tallowfield Health Partners, a physician-practice management company in New York ("Controller").
1. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person, including patient and practice-relations data processed by the Controller through the brain.
"Processing" means any operation performed on Personal Data, including collection, storage, organisation, retrieval, use, disclosure and deletion.
"Data Subject" means the natural person to whom Personal Data relates.
2. Scope
The Controller instructs the Processor to process Personal Data only:
- On the Controller's documented written instructions;
- For the purpose of operating the brain, an analytics layer built within the Controller's own Snowflake account;
- For the term of the subscription and such data retention period as the Controller specifies.
3. Confidentiality
Read the whole document (3,031 characters)
The Processor shall:
- Keep all Personal Data confidential;
- Ensure that authorised staff are bound by confidentiality;
- Not disclose Personal Data to any third party except where required by law or on the Controller's prior written instruction.
4. Security Measures
The Processor implements technical and organisational security measures including:
- Encryption of data in transit and at rest;
- Access controls and authentication;
- Audit logging of all access and modifications;
- Regular security reviews and certifications.
5. Data Subject Rights
The Processor shall, on request, assist the Controller in fulfilling Data Subject rights, including access, correction, deletion and portability, to the extent technically feasible within the brain.
6. Sub-processors
The Processor may engage cloud infrastructure providers as sub-processors. Current sub-processor details are available on request.
7. Data Transfers and Location
Personal Data is processed within the Controller's own Snowflake account in the region designated by the Controller.
8. Return and Deletion
Upon termination:
- The Controller retains full access to all Personal Data in its Snowflake account;
- The Processor deletes its own copies within the timeframe specified in the Order Form;
- The Controller is responsible for final data deletion or archival.
9. Liability
The Processor's liability for breach of this DPA is limited to direct losses and capped at fees paid in the preceding twelve months.
10. Audit Rights
The Controller may audit the Processor's compliance. The Processor shall provide:
- Security certifications on request;
- Processing records and access logs;
- Cooperation with any audit.
Signature
BB-Demo Limited
Signed: _____________________
Title: Authorised Officer
Date: 12 June 2026
Tallowfield Health Partners
Signed: _____________________
Title: Authorised Officer
Date: 12 June 2026
Unusual terms
Current to 9 Oct 26- Liability capped at fees paid in preceding twelve months
- Deletion timeframe deferred to the Order Form