Data Processing Agreement

1. Roles & Scope

The Clinic is the independent Data Controller for all patient/client and staff personal data entered into its isolated workspace. Curatio processes personal data solely on the Clinic's documented instructions to provide relationship, scheduling, concierge messaging, billing, and governance operations. Curatio is not an electronic patient record (EPR) and does not store clinical notes (CLN-03).

2. UK Data Residency & Security

All primary application compute and database storage are pinned to the United Kingdom (London — Vercel lhr1 and AWS/Supabase eu-west-2). Sensitive client fields are encrypted at rest using per-tenant derived keys (AES-256-GCM) with blind-index HMAC search and Postgres Row-Level Security (RLS).

3. Processor Obligations (Art. 28(3))

• Confidentiality: all personnel and sub-processors are bound by written confidentiality obligations.
• No operator access to client data without an explicit, time-limited, tenant-approved support grant (TEN-07).
• Breach notification: Curatio will notify the Clinic's named DPO without undue delay and within 24 hours of confirming a personal data breach, supporting the Clinic's 72-hour ICO obligation.
• DSAR & erasure support: built-in one-click DSAR export, cryptographic erasure, and verifiable 30-day offboarding deletion.
• Auditability: immutable hash-chained audit logs available for CQC and ICO inspection.

4. Authorised Sub-processors

Supabase (UK eu-west-2 database & auth), Vercel (UK lhr1 edge & compute), Stripe (platform & Connect billing), Upstash (rate-limiting & distributed locks), and Resend (transactional email notifications). No client PII is sent to third-party LLM providers without explicit per-tenant opt-in and redaction.