Kingdon Diagnostics - Data Processing Agreement (signed)

The terms controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the UK data protection legislation. In this agreement the customer is the controller and BB-Demo is the processor.

Subject matter and duration

The processor processes personal data only to provide the company brain service described in the order form and the master services agreement. Processing continues for as long as the service is provided and ends when the customer's contract ends, subject to the return and deletion provisions below.

Nature and purpose of processing

• Indexing and organising data from the systems the customer chooses to connect.
• Making that data searchable and answerable through pages, chat and search for the customer's authorised users.
• Maintaining, supporting and securing the service, including logging and fault diagnosis.

Types of personal data and data subjects

The categories depend on which systems the customer connects. They may include contact details, referral and appointment references, correspondence, support ticket content and invoice records. Data subjects may include patients, referring clinicians, customer staff and contacts at trusts and insurers.

The customer is responsible for deciding which sources are connected and for keeping special category data out of scope where it is not needed for the service.

Processor obligations

The processor shall:

• process personal data only on the documented instructions of the customer, including as set out in this agreement, unless required to do otherwise by law;
• ensure that everyone authorised to process the data is bound by a duty of confidentiality;
• apply appropriate technical and organisational security measures, including access controls, encryption, separation of environments and logging;
• assist the customer, taking account of the nature of the processing, in responding to requests from data subjects;
• assist the customer with security, breach notification, impact assessments and consultation with the regulator;
• make available the information needed to show compliance and allow reasonable audits on sensible notice.

Where the data lives

The company brain is built and run inside the customer's own Snowflake account. The customer therefore keeps control of where its data is stored and who can reach it, and the processor works within that account under the access the customer grants. Any change to the data location or to a dedicated residency option must be agreed in writing.

Sub-processors

The customer gives general authorisation for the processor to use sub-processors needed to run the service. The processor shall keep a current list available to the customer, tell the customer of intended changes so that it can object, and impose the same data protection obligations on each sub-processor. The processor remains responsible for their performance.

International transfers

The processor shall not transfer personal data outside the United Kingdom except where a lawful transfer mechanism is in place and the customer has been told.

Personal data breaches

The processor shall notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data. The notice shall describe what is known about the nature of the breach, the data concerned and the steps being taken, and the processor shall cooperate with the customer's investigation.

Return and deletion

On the end of the service, the processor shall, at the customer's choice, return or delete the personal data it holds on the customer's behalf and confirm that it has done so, unless the law requires it to keep a copy.

Liability and precedence

Liability under this agreement is subject to the limits in the master services agreement. If this agreement conflicts with the master services agreement on the processing of personal data, this agreement prevails.

Signatures

Signed on 23 Dec 2024 by the authorised representatives of the parties.