Data Processing Agreement

Between the dental practice ("Controller") and the provider of Fluy ("Processor").

1. Subject matter and duration

The Processor provides a WhatsApp patient-messaging assistant, inbox and related services for the duration of the subscription.

2. Nature and purpose of processing

Receiving, storing, analysing and replying to patient messages; creating booking requests; transcription of voice notes; reporting.

3. Categories of data and data subjects

Patients and prospective patients: contact details, message content, appointment preferences, and health information volunteered in messages (special category data). Practice staff: name, email, activity logs.

4. Processor obligations

• Process only on documented instructions of the Controller.
• Ensure persons authorised to process are bound by confidentiality.
• Implement appropriate technical and organisational measures (encryption of secrets, row-level access control, audit logging, UK/EU hosting).
• Engage subprocessors only as listed at /legal/subprocessors, with notice of changes.
• Assist with data subject requests, breach notification (without undue delay) and DPIAs.
• Delete or return personal data at the end of the service.
• Make available information necessary to demonstrate compliance.

5. International transfers

Data is hosted in the UK/EU. Any transfer outside the UK/EEA relies on adequacy regulations, the UK IDTA/Addendum or EU SCCs.

Template — to be reviewed by a qualified lawyer before use. Not legal advice.