Data Processing Agreement

For the personal data you enter into Denpath — including patient records, treatment plans, and clinical notes — you act as data controller and we act as data processor. We process that data only on your documented instructions, given via your use of the Service and the settings you configure within it (for example, deleting a patient record is an instruction to delete it).

Subject matter: provision of the Denpath dental practice management platform. Duration: for as long as you maintain an active account, plus the retention period in Section 9. Purpose: enabling your practice to record clinical findings, generate treatment plans, and share them with patients for review and booking.

Processing operations include collection, storage, retrieval, transmission by email, and erasure. Categories of data subject and data processed:

• Patients: name, contact details, date of birth, and clinical data (findings, treatment options, treatment selections) — special category health data under Article 9 UK GDPR
• Your staff: name, email address, and role, for the purpose of account access and audit records

You are responsible for identifying the lawful basis and, for patient health data, the Article 9 condition that applies to your own processing (typically the provision of health or social care under Article 9(2)(h)) and for giving patients any notice UK GDPR requires.

As processor, we:

• Process personal data only on your documented instructions, including regarding international transfers, unless required otherwise by law
• Ensure everyone with access to the data is subject to a duty of confidentiality
• Implement appropriate technical and organisational security measures (Section 6)
• Do not engage a sub-processor without your general authorisation (Section 7)
• Assist you in responding to data subject rights requests (Section 8)
• Assist you with your security, breach-notification and DPIA obligations, taking into account the information available to us
• Delete or return personal data at the end of the relationship, per Section 9
• Make available the information reasonably necessary to demonstrate compliance with this DPA

As controller, you:

• Warrant that you have a lawful basis, and where applicable a valid Article 9 condition, for the personal data you enter into the Service
• Are responsible for the accuracy of the data you enter and for providing any notices or obtaining any consents your own processing requires
• Control who at your practice has access, via the roles (owner, dentist, viewer) you assign in Staff settings — we authenticate accounts, but access decisions within your practice are yours
• Are responsible for retaining patient records for as long as professional dental record-keeping requirements demand — deleting a patient record in Denpath is immediate and permanent, and is treated as your explicit instruction to erase it

We maintain, at minimum:

• Encryption of data in transit (TLS) and at rest
• Role-based access control, enforced on every request rather than relying on the database layer
• Hashed credentials and cookie-based sessions with configurable expiry
• An append-only audit log of privileged administrative actions
• Data isolation between practices, enforced in every query
• Regular review of dependencies and infrastructure configuration

Security is an ongoing programme rather than a fixed state — we review and improve these measures over time, and material changes that reduce protection will be notified to you.

You give general authorisation for us to engage the following sub-processors, each bound by a data processing agreement no less protective than this one:

• Neon — Postgres database hosting (data storage)
• Vercel — application hosting and content delivery
• Resend — transactional email delivery (verification, invites, treatment plan links)
• Stripe — subscription billing and payment processing (practice billing contact details and payment data only — never patient data)

We will give you at least 30 days' notice, by email or in-app notice, before adding or replacing a sub-processor with access to patient data, and you may object on reasonable data protection grounds within that period.

Patient rights requests (access, rectification, erasure, restriction, portability) are normally directed to you as controller. Where a request reaches us directly, we will forward it to you promptly and not respond substantively ourselves. The Service supports these rights directly: patient records can be corrected or deleted from the practice dashboard at any time, and treatment plan data is visible to the patient via their share link.

While your account is active, patient and practice data is retained per your own instructions — you control creation, correction and deletion of every patient record. On request, or within 30 days of account closure, we will make your data available for export and then delete it, except where we are required to retain it by law (for example, billing records). Deleting a patient record, an exam, or a practice from within the Service is immediate and irreversible — we hold no soft-delete or recovery copy beyond routine database backups, which age out per our backup retention schedule.

We will notify you without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting your data, providing the information available to us at the time and updating it as our investigation progresses. You remain responsible for any notification to the ICO or to affected patients that your own obligations require.

Personal data is stored and processed in the United Kingdom. If we engage a sub-processor that transfers data outside the UK, we will ensure an appropriate transfer mechanism is in place (such as the UK International Data Transfer Addendum) before the transfer occurs.

On reasonable written notice, we will provide the information reasonably necessary to demonstrate compliance with this DPA, including responding to a written questionnaire in lieu of an on-site audit where practical. Any on-site audit will be scheduled to minimise disruption and is at your cost beyond one audit per 12-month period.

Liability under this DPA is subject to the limitations in our Terms of Service. Where this DPA conflicts with the Terms of Service on a data protection matter, this DPA prevails.

Data protection queries, breach reports, or sub-processor objections: hello@denpath.co.uk