Last Updated: November 2025
ANNEX 1 — DATA PROCESSING ANNEX
This Annex is entered into pursuant to Article 28 UK GDPR and applies to Callendoc's processing of Patient Data on behalf of the Customer.
1. ROLES
The Customer is the data controller of Patient Data. Callendoc is the data processor. For the Customer's own account and billing data, Callendoc is an independent controller (see the Privacy Notice).
2. DETAILS OF PROCESSING
| Item | Description |
| Subject matter | Provision of the Callendoc clinic management service |
| Duration | Term of the Agreement plus the 30-day export period and 90-day deletion period |
| Nature and purpose | Hosting, storage, organisation, transmission, display, backup and deletion of data to provide the Service |
| Categories of data subjects | The Customer's patients; the Customer's staff (Authorised Users) |
| Categories of personal data | Patient identity and contact details; appointment records; medical history, diagnoses, treatment and consultation notes (special category health data); invoicing and payment records |
3. PROCESSOR OBLIGATIONS
Callendoc shall: (a) process Patient Data only on the Customer's documented instructions (the Agreement constitutes such instructions), unless required by law, in which case Callendoc will inform the Customer unless prohibited; (b) ensure persons authorised to process the data are bound by confidentiality; (c) implement the technical and organisational measures described in the Callendoc Data Security Policy (callendoc.com/data-security), including AES-256 encryption at rest, TLS 1.2+ in transit, role-based access controls, audit logging, and daily encrypted backups; (d) not use Patient Data for its own purposes, including analytics, marketing or AI model training; (e) assist the Customer, taking into account the nature of processing, in responding to data subject rights requests received by the Customer; (f) assist the Customer with data protection impact assessments and prior consultations; (g) make available information necessary to demonstrate compliance with this Annex.
4. SUB-PROCESSORS
4.1 The Customer gives general authorisation to the sub-processors listed below. Callendoc will give at least 30 days' notice of any intended change, during which the Customer may object on reasonable data protection grounds; if the objection cannot be resolved, the Customer may terminate the affected services.
| Sub-processor | Purpose | Location |
| Amazon Web Services (AWS) | Cloud hosting and backups | UK / EU regions |
| Stripe | Payment processing | UK / EU |
| SendGrid (Twilio Inc.) | Transactional email | EU / [CONFIRM] |
| Twilio | SMS notifications | EU / [CONFIRM] |
4.2 Callendoc remains fully liable for its sub-processors' performance and will impose data protection obligations equivalent to this Annex on each sub-processor.
5. PERSONAL DATA BREACH
Callendoc will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Patient Data, providing sufficient information to enable the Customer to meet its own notification obligations to the ICO and data subjects.
6. INTERNATIONAL TRANSFERS
Patient Data is stored in UK and EEA data centres. Callendoc will not transfer Patient Data outside the UK/EEA without ensuring an appropriate safeguard (UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum to the EU SCCs).
7. RETURN AND DELETION
On expiry or termination, the Customer may export all Patient Data within 30 days. Callendoc will then delete all remaining Patient Data (including backups, on backup-cycle expiry) within 90 days, unless retention is required by law, and will confirm deletion on request.
8. AUDIT
Callendoc will make available information reasonably necessary to demonstrate compliance and, no more than once per 12 months and on at least 30 days' notice, allow an audit by the Customer or its mandated auditor at the Customer's cost, subject to confidentiality and without access to other customers' data.
9. LIABILITY
Liability under this Annex is subject to the limitations in clause 11 of the Agreement, except to the extent prohibited by law.
