Schedule 1 Data protection (Controller to Processor)
DEFINITIONS
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, processing and appropriate technical and organisational measures: as defined in the Data Protection Legislation.
Data Protection Legislation:
a) To the extent the UK GDPR applies, the law of the United Kingdom or of a part of the United Kingdom which relates to the protection of Personal Data.
b) To the extent the EU GDPR applies, the law of the European Union or any member state of the European Union to which the Customer is subject, which relates to the protection of Personal Data.
Domestic Law: the law of the United Kingdom or a part of the United Kingdom.
EU GDPR: the General Data Protection Regulation ((EU) 2016/679).
EU Law: the law of the European Union or any member state of the European Union.
UK GDPR: has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.
- DATA PROTECTION
1.1. To the extent applicable, the Healthcare Provider shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of all such Healthcare Provider Data, other than arising from any error caused by Aide.
1.2. In the event of any loss or damage to the Healthcare Provider Data, the Healthcare Provider's sole and exclusive remedy against Aide shall be for Aide to use reasonable commercial endeavours to restore the lost or damaged Healthcare Provider Data from the latest back-up of such Healthcare Provider Data maintained by Aide. Aide shall not be responsible for any loss, destruction, alteration or disclosure of Healthcare Provider Data caused by any third party (except those third parties sub-contracted by Aide to perform services related to Healthcare Provider Data maintenance and back-up for which it shall remain fully liable under clause 1.8 below).
1.3. Both parties will comply with all applicable requirements of the Data Protection Legislation. This clause 1.3 is in addition to, and does not relieve, remove or replace, a party's obligations or rights under the Data Protection Legislation.
1.4. The parties acknowledge that for the purposes of the Data Protection Legislation, in respect of the Healthcare Provider Personal Data, the Healthcare Provider is the Controller and Aide is the Processor. Appendix A sets out the scope, nature and purpose of processing by Aide, the duration of the processing and the types of Personal Data and categories of Data Subject.
1.5. Without prejudice to the generality of clause 1.3, the Healthcare Provider will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Healthcare Provider Data to Aide for the duration and purposes of this Agreement so that Aide may lawfully use, process and transfer the Healthcare Provider Data in accordance with this Agreement on the Healthcare Provider's behalf and the Healthcare Provider shall defend, indemnify and hold harmless Aide against all claims, requests, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with the Healthcare Provider's breach of its obligations in this clause 1.5, provided that:
1.5.1. the Healthcare Provider is given prompt notice of any such claim;
1.5.2. Aide provides reasonable co-operation to the Healthcare Provider in the defence and settlement of such claim, at the Healthcare Provider's expense; and
1.5.3. the Healthcare Provider is given authority to defend or settle the claim, provided it does so diligently and not to the detriment of Aide.
1.6. Without prejudice to the generality of clause 1.3, Aide shall, in relation to any Healthcare Provider Personal Data processed in connection with the performance by Aide of its obligations under this Agreement:
1.6.1. process that Healthcare Provider Personal Data only on the documented written instructions of the Healthcare Provider unless Aide is required by domestic law (where “domestic law” means the UK Data Protection Legislation and any other law that applies in the UK) to otherwise process that Healthcare Provider Personal Data. Where Aide is relying on domestic law as the basis for processing Healthcare Provider Personal Data, Aide shall promptly notify the Healthcare Provider of this before performing the processing required by the domestic law unless domestic law prohibits Aide from so notifying the Healthcare Provider;
1.6.2. ensure that all personnel who have access to and/or process Healthcare Provider Personal Data are obliged to keep the Healthcare Provider Personal Data confidential;
1.6.3. not transfer any Healthcare Provider Personal Data to a third party outside of the UK and EEA unless the following conditions are fulfilled:
a) the data subject has enforceable rights and effective legal remedies; and
b) use reasonable endeavours to ensure that: (i) the transfer is to a country approved under applicable Data Protection Legislation as providing an adequate level of protection to any Healthcare Provider Personal Data that is transferred; (ii) there are appropriate safeguards (such as the UK ICO approved international data transfer agreement or international data transfer addendum) or binding corporate rules in place in relation to the transfer pursuant to the applicable Data Protection Legislation; (iii) the transferee otherwise complies with Aide’s relevant obligations under the applicable Data Protection Legislation by providing an adequate level of protection to any Healthcare Provider Personal Data that is transferred; or (iv) one of the derogations for specific situations in the applicable Data Protection Legislation applies to the transfer;
1.6.4. assist the Healthcare Provider, at the Healthcare Provider's cost, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
1.6.5. notify the Healthcare Provider without undue delay on becoming aware of a Personal Data Breach;
1.6.6. at the written direction of the Healthcare Provider, delete or return (to the extent technically and reasonably possible) relevant Healthcare Provider Personal Data and copies thereof to the Healthcare Provider on termination of the Agreement unless required by domestic law to store the Healthcare Provider Personal Data; and
1.6.7. maintain complete and accurate records and information to demonstrate its compliance with this clause 1 and promptly inform the Healthcare Provider if, in the opinion of Aide, an instruction infringes the Data Protection Legislation.
1.7. Each party shall ensure that it has in place appropriate technical and organisational measures, to protect against unauthorised or unlawful processing of Healthcare Provider Personal Data and against accidental loss or destruction of, or damage to, Healthcare Provider Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Healthcare Provider Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it).
1.8. The Healthcare Provider hereby consents to the appointment of all third-party processors of Healthcare Provider Personal Data that have been appointed by Aide as of the Commencement Date in order to assist Aide in complying with its obligations as a processor under this Agreement (each, a “Sub-Processor”). Aide confirms that it may only appoint additional Sub-Processors if the Healthcare Provider provides Aide with its consent prior to each such appointment. Where such consent is not provided, either party may terminate this Agreement on 30 days’ written notice to the other. Aide has, or as the case may be, will enter into written agreements with each Sub-Processor that it appoints incorporating terms which are substantially similar to those set out in this clause 1 and which Aide confirms reflect and will continue to reflect the applicable requirements of the Data Protection Legislation. As between Aide and the Healthcare Provider, Aide shall remain fully liable for all acts or omissions of any Sub-Processor appointed by it pursuant to this clause 1.8.
1.9. The Healthcare Provider hereby acknowledges and agrees that Aide may anonymise the Healthcare Provider Data (so that it can no longer be associated with a Data Subject), aggregate it with the data of other customers and end users of Aide and/or use and share such aggregated and/or anonymised data for any purpose, including, but not limited to, research and/or statistical analysis in respect of education and health as well as data analytics to evaluate, administer, protect and improve the Services, and Aide’s rights in this clause 1.9 shall survive termination or expiry of this Agreement, however arising (“Aide Data”). The parties acknowledge that Aide shall only be considered a Controller in respect of any Aide Data in the event any such data is classified as Personal Data and shall process such Personal Data in accordance with the terms of its privacy policy, which can be found at www.aide.health/privacy-policy.
Appendix A - PROCESSING, PERSONAL DATA AND DATA SUBJECTS
Scope and purpose of processing
Aide will process the Personal Data to provide the Services to the Healthcare Provider.
Nature
Storage and transfer of the Personal Data for the purposes of providing the Services.
Duration of the processing
Aide will process the Personal Data for the duration of this Agreement and as necessary thereafter solely as required by the Data Protection Legislation and any applicable laws and regulations.
Types of Personal Data
Names, surnames, job titles, telephone numbers and e-mail address and data relating to the physical health of a Patient, including treatment, care, diagnosis, medical records, charts, medical history, prescriptions, findings, and other medical record’s in a Clinician’s possession to the extent necessary for providing the Patient the relevant Services.
Categories of data subject
The Healthcare Provider’s Authorised Users, officers, members, employees, contractors, subcontractors and suppliers.