Data Processing Agreement

Last updated: 19 October 2026

Version 3.2

Parties

1. SoftCare Technologies Ltd, a company incorporated in Scotland (company number SC895306) whose registered office is at Moffat Business Centre, 96-98 Forrest Street, Clarkston, Airdrie, ML6 7AG, registered with the Information Commissioner's Office under number ZC204698 ("SoftCare"); and

2. the organisation that subscribes to the Service under the Subscription Terms (the "Customer").

Background

(A) SoftCare provides the Customer with a hosted care management software service (the "Service") under the SoftCare Subscription Terms published at softcare.uk/terms, together with any order form or other written agreement for the Service (together, the "Principal Agreement").

(B) In providing the Service, SoftCare processes personal data on behalf of the Customer. This Agreement sets out the terms of that processing as required by Article 28(3) of the UK GDPR, and forms part of the Principal Agreement.

1. Definitions and interpretation

1.1 In this Agreement:

"AI Feature" means a function of the Service that sends Customer Personal Data to a machine learning model in order to generate text, a suggestion or structured data.

"Customer Personal Data" means personal data processed by SoftCare on behalf of the Customer in providing the Service, as described in Schedule 1.

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025), supplemented or replaced from time to time.

"Regulator" means the body that regulates the Customer's care services, including the Care Inspectorate, the Care Quality Commission, Care Inspectorate Wales and the Regulation and Quality Improvement Authority.

"Sub-processor" means a processor engaged by SoftCare to process Customer Personal Data.

"UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018.

1.2 "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "special category data" have the meanings given in the UK GDPR. References to Articles are to Articles of the UK GDPR.

1.3 If this Agreement conflicts with any other part of the Principal Agreement in relation to the processing of Customer Personal Data, this Agreement prevails.

2. Roles and responsibilities

2.1 The Customer is the controller, and SoftCare is the processor, of Customer Personal Data.

2.2 The Customer determines the purposes and means of the processing and is responsible for:

(a) the lawfulness of the personal data it provides to SoftCare or enters into the Service, and of its instructions;

(b) identifying a lawful basis under Article 6 and, for special category data, a condition under Article 9 and, where required, Schedule 1 to the Data Protection Act 2018, and maintaining any appropriate policy document that Schedule requires;

(c) providing data subjects with the information required by Articles 13 and 14; and

(d) carrying out any data protection impact assessment required by Article 35.

2.3 The Customer shall ensure that it has all notices, consents and other legal grounds necessary for SoftCare to process Customer Personal Data in accordance with this Agreement.

2.4 SoftCare is an independent controller of personal data in its own business records, including account and billing contacts, support correspondence, security and access logs, and aggregated statistics that do not identify any individual. That processing is outside the scope of this Agreement and is described in SoftCare's privacy notice.

2.5 Nothing in this Agreement makes the parties joint controllers.

3. Processing on instructions

3.1 SoftCare shall process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers outside the United Kingdom, unless required to do otherwise by UK law. In that case SoftCare shall inform the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.

3.2 The Customer's documented instructions are the Principal Agreement, this Agreement, and the Customer's configuration and use of the features of the Service, including enabling an AI Feature under clause 5. Any further instruction must be given in writing. SoftCare may charge its reasonable costs for an instruction that requires work outside the normal operation of the Service.

3.3 SoftCare shall inform the Customer immediately if, in its opinion, an instruction infringes Data Protection Law, and may suspend the relevant processing until the instruction is confirmed in writing or withdrawn.

3.4 SoftCare shall not:

(a) sell Customer Personal Data;

(b) use Customer Personal Data for its own marketing;

(c) use Customer Personal Data to train, fine-tune or evaluate any machine learning or artificial intelligence model, or permit any Sub-processor to do so; or

(d) disclose Customer Personal Data to any third party except as permitted by this Agreement or required by law.

3.5 SoftCare shall inform the Customer without undue delay if it becomes unable to comply with this Agreement.

4. Personnel

4.1 SoftCare shall ensure that each person it authorises to process Customer Personal Data is subject to a contractual or statutory duty of confidentiality that continues after their engagement ends.

4.2 SoftCare shall limit access to Customer Personal Data to personnel who need it to provide or support the Service or to meet SoftCare's legal obligations, and shall ensure those personnel receive appropriate data protection training.

5. AI Features

5.1 AI Features are disabled by default. Customer Personal Data is sent to an AI Feature only after an administrator of the Customer enables AI Features in the Service, which is an instruction under clause 3.2. The Customer may disable AI Features at any time.

5.2 An AI Feature receives only the Customer Personal Data needed to perform the task requested by a user, and processes it only through a Sub-processor identified for that purpose in Schedule 2.

5.3 Output from an AI Feature is a draft or suggestion for review by the Customer's personnel. The Service does not use AI Features to make any decision that produces legal or similarly significant effects for a data subject. The Customer remains responsible for all care, clinical and employment decisions made using the Service.

5.4 Where the Customer asks SoftCare in writing to migrate records into the Service from another system, SoftCare may use an AI Feature to extract data from the documents supplied only if the Customer has agreed to that method in writing. SoftCare shall delete those source documents within 30 days after the Customer confirms that the migration is complete.

5.5 SoftCare shall engage a Sub-processor for AI Features only on terms that prohibit it from using Customer Personal Data to train or improve its models.

6. Security

6.1 SoftCare shall implement and maintain the technical and organisational measures described in Schedule 3. The parties agree that those measures provide a level of security appropriate to the risk, as required by Article 32.

6.2 SoftCare may update the measures in Schedule 3 provided that the overall level of security is not materially reduced.

6.3 The Customer is responsible for its use of the Service, including the management of its user accounts, the roles and permissions it assigns, whether it requires two-factor authentication for its users, and the security of its users' credentials and devices.

7. Sub-processors

7.1 The Customer gives SoftCare general written authorisation to engage Sub-processors in accordance with this clause 7.

7.2 The Customer authorises the Sub-processors listed in Schedule 2. The current list is published at softcare.uk/subprocessors.

7.3 SoftCare shall give the Customer at least 30 days' notice by email before a new or replacement Sub-processor begins to process Customer Personal Data. The notice shall identify the Sub-processor, the processing it will carry out, the categories of Customer Personal Data concerned and the country of processing.

7.4 The Customer may object to a proposed Sub-processor on reasonable data protection grounds by notice in writing within that 30-day period, and the parties shall discuss the objection in good faith. Where the Sub-processor supports an optional feature of the Service, the Customer may instead stop using that feature, and SoftCare shall not use the Sub-processor to process the Customer's data.

7.5 Where a Sub-processor must be replaced urgently because it can no longer meet its obligations or presents a risk to Customer Personal Data, SoftCare may replace it on shorter notice. SoftCare shall notify the Customer as soon as reasonably practicable, and clause 7.4 shall apply from the date of that notice.

7.6 SoftCare shall impose on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this Agreement.

7.7 SoftCare remains liable to the Customer for the performance of each Sub-processor's obligations, subject to clause 13.

8. Personal data breaches

8.1 SoftCare shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, including a breach at a Sub-processor.

8.2 The notification shall, so far as the information is then available, describe:

(a) the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;

(b) a point of contact at SoftCare;

(c) the likely consequences of the breach; and

(d) the measures taken or proposed to address the breach and mitigate its effects.

8.3 Information not available at the time of notification shall be provided in phases without further undue delay.

8.4 The Customer is responsible for deciding whether a breach must be notified to the Information Commissioner, its Regulator or data subjects, and for making any such notification. SoftCare shall not make any such notification in relation to Customer Personal Data without the Customer's prior written consent, unless required to do so by law.

8.5 SoftCare shall send notifications to the Customer's account owner in the Service, or to any other contact the Customer nominates in writing. The Customer shall send any communication about a breach to [email protected].

8.6 SoftCare shall keep a record of personal data breaches affecting Customer Personal Data and make it available to the Customer on request.

9. Assistance, information and audit

9.1 Taking into account the nature of the processing, SoftCare shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects to exercise their rights under Data Protection Law. The Service enables the Customer to access, export, rectify and erase Customer Personal Data itself. Where a request cannot be met using those functions, SoftCare shall provide reasonable further assistance at its standard rates.

9.2 If SoftCare receives a request from a data subject relating to Customer Personal Data, it shall not respond to the request, other than to direct the data subject to the Customer, and shall forward the request to the Customer without undue delay.

9.3 Taking into account the nature of the processing and the information available to it, SoftCare shall provide reasonable assistance to the Customer in meeting its obligations under Articles 32 to 36, including in relation to data protection impact assessments and prior consultation with the Information Commissioner. SoftCare may charge at its standard rates for assistance beyond providing its standard documentation.

9.4 SoftCare shall make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28.

9.5 SoftCare shall respond to a reasonable written security questionnaire from the Customer once in any 12-month period, and may refer the Customer to its published documentation and certifications.

9.6 If the Customer reasonably considers that the information provided under clauses 9.4 and 9.5 is insufficient to demonstrate compliance with this Agreement, the Customer may carry out an audit, once in any 12-month period, by giving at least 30 days' written notice. The audit shall be conducted during business hours, without unreasonable disruption, by the Customer or an independent auditor who is not a competitor of SoftCare and is bound by obligations of confidentiality. The audit shall not extend to the data of SoftCare's other customers or to Sub-processors' facilities.

9.7 The Customer shall bear the costs of any audit, including SoftCare's time at its standard rates, unless the audit reveals a material breach of this Agreement by SoftCare.

10. International transfers

10.1 SoftCare hosts Customer Personal Data in the United Kingdom.

10.2 SoftCare shall not transfer Customer Personal Data outside the United Kingdom, or permit a Sub-processor to do so, unless:

(a) the Customer has authorised the transfer, which it does by authorising a Sub-processor under clause 7 whose location of processing is stated in Schedule 2; and

(b) the transfer is to a country covered by UK adequacy regulations or is made subject to appropriate safeguards under Article 46, being the International Data Transfer Agreement, the International Data Transfer Addendum to the EU Standard Contractual Clauses, or, for a recipient certified to it, the UK Extension to the EU-US Data Privacy Framework.

10.3 The transfers outside the United Kingdom permitted at the date of this version, and the categories of data concerned, are those stated in Schedule 2.

11. Requests from public authorities

11.1 If SoftCare receives a request from a public authority for disclosure of Customer Personal Data, SoftCare shall, unless prohibited by law: refer the authority to the Customer; notify the Customer promptly; and disclose only the minimum data it is legally required to disclose. SoftCare shall challenge a request where it has reasonable grounds to consider it unlawful and it is reasonable to do so.

12. Retention, return and deletion

12.1 SoftCare shall retain Customer Personal Data in accordance with Schedule 4.

12.2 The Customer may export Customer Personal Data in a structured, commonly used and machine-readable format using the Service at any time before termination. If the Customer's access ends before it has been able to do so, SoftCare shall provide an export on request made within 30 days after termination.

12.3 SoftCare shall delete Customer Personal Data within 90 days after termination, or earlier on the Customer's written instruction, unless UK law requires SoftCare to retain it. Deleted data remains in encrypted backups until those backups expire, which is no later than 90 days after deletion.

12.4 SoftCare shall confirm deletion in writing on request.

12.5 The Customer is responsible for compliance with any statutory retention period that applies to its records, and shall ensure that its deletion instructions are consistent with those periods. SoftCare may decline an instruction that would require the deletion of records within a statutory retention period, and shall give the Customer its reasons.

13. Liability

13.1 Each party's liability arising out of or in connection with this Agreement is subject to the limitations and exclusions of liability in the Principal Agreement.

13.2 Liability under this Agreement counts towards, and is not in addition to, the limits of liability in the Principal Agreement.

13.3 SoftCare is not liable for any loss arising from processing carried out in accordance with the Customer's instructions or from the Customer's configuration or use of the Service.

13.4 Nothing in this Agreement limits or excludes liability that cannot be limited or excluded by law.

14. Term

14.1 This Agreement continues for as long as SoftCare processes Customer Personal Data.

14.2 Clauses 4, 8, 11, 12 and 13 survive termination to the extent necessary to give them effect.

15. Changes to this Agreement

15.1 SoftCare may update this Agreement by giving the Customer at least 30 days' notice by email. The updated Agreement applies from the date stated in the notice.

15.2 An update that materially reduces the protection given to Customer Personal Data shall apply to the Customer only from the start of its next renewal term, unless the update is required by law or the Customer agrees otherwise.

15.3 Updates to Schedule 2 are made under clause 7 and updates to Schedule 3 under clause 6.2.

15.4 SoftCare publishes each version of this Agreement at softcare.uk/dpa.

16. General

16.1 This version of the Agreement replaces, from its effective date, any earlier data processing agreement between the parties relating to the Service.

16.2 This Agreement takes effect when the Customer accepts it in the Service, when the Customer signs an order form or other document that incorporates it, when the parties sign the execution page, or under clause 15. Electronic acceptance or signature has the same effect as a handwritten signature.

16.3 If any provision of this Agreement is held invalid or unenforceable, it shall be severed and the remaining provisions shall continue in force.

16.4 A person who is not a party to this Agreement has no right to enforce any of its terms.

16.5 This Agreement and the Principal Agreement are the entire agreement between the parties relating to the processing of Customer Personal Data.

16.6 This Agreement is governed by the law of Scotland, and the parties submit to the exclusive jurisdiction of the Scottish courts.

Schedule 1: Details of the processing

Subject matter. The provision of the Service to the Customer.

Duration. The term of the Principal Agreement and the periods in clause 12 and Schedule 4.

Nature of the processing. Collection, recording, organisation, structuring, storage, retrieval, consultation, use, display, transmission, restriction, erasure and destruction of personal data by automated means and, where the Customer has enabled them, the generation of drafts and suggestions by AI Features.

Purpose of the processing. To enable the Customer to:

(a) plan, deliver and record regulated care;

(b) maintain care plans, risk assessments, daily records and medication administration records;

(c) manage its workforce, including rotas, attendance, absence, mileage, training and HR records;

(d) communicate with service users' families and nominated contacts;

(e) raise invoices and prepare payroll information; and

(f) demonstrate compliance to its Regulator, commissioners and auditors.

Categories of data subjects.

• Service users
• The Customer's employees, workers, bank staff and job applicants
• Next of kin, family members and other contacts nominated by service users
• Professionals recorded in a service user's records, such as GPs, social workers and district nurses

Categories of personal data: service users. Name; date of birth; NHS or CHI number; address and contact details; room, unit or service; admission, transfer and discharge dates; date of death; funding arrangements, invoicing details and personal money records; photograph; next of kin and nominated contacts; and key safe access codes, which are encrypted at rest and shown only to a staff member checked in to a visit to that service user, with each access recorded in the audit log.

Special category data: service users. Data concerning health, including care plans and support needs; risk assessments; daily care notes and observations; medication orders and administration records; body maps and skin integrity records; food, fluid and nutrition records; continence records; incidents, accidents and injuries; safeguarding concerns and referrals; correspondence with health and social care professionals; and end of life and resuscitation preferences. Records may also include data revealing racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation, or disability, where the Customer records it as part of a service user's assessed needs, cultural or dietary requirements, or protected characteristics.

Categories of personal data: the Customer's staff. Name; contact details; date of birth; job title and employment dates; employment type and contracted hours; pay rates and payroll records; rota, shift, attendance and timesheet records; absence records; business mileage and journey records; location at visit check-in and check-out; training, qualification and competency records; supervision and appraisal records; disciplinary, grievance and other HR records and letters; right to work status; and emergency contact details.

Special category and criminal offence data: the Customer's staff. Data concerning health recorded in relation to sickness absence, occupational health or workplace adjustments; and the existence, reference number and outcome status of disclosure checks (PVG or DBS). The Service is not designed to store the content of a disclosure certificate.

Categories of personal data: family and nominated contacts. Name; relationship to the service user; contact details; and the content of messages, updates and photographs shared through the Service.

Frequency. Continuous for the term of the Principal Agreement.

Schedule 2: Sub-processors

This Schedule lists the Sub-processors at the date of this version. The current list is published at softcare.uk/subprocessors.

Part A: Sub-processors engaged

A1. DigitalOcean (DigitalOcean, LLC)

• Service: Application hosting, managed database and file storage.
• Customer Personal Data: All Customer Personal Data, including special category data.
• Location of processing: United Kingdom (London, lon1)
• Transfer outside the UK: No
• Further detail: Web traffic to the Service passes through DigitalOcean's edge network, operated by Cloudflare, Inc., where the encrypted connection is terminated and forwarded to London. The edge network does not store Customer Personal Data.

A2. Amazon Web Services (Bedrock) (Amazon Web Services EMEA SARL)

• Service: Hosting of AI models used by the optional AI Features and, where the Customer agrees, AI-assisted data migration.
• Customer Personal Data: The Customer Personal Data needed for the task requested by a user, which may include special category data (for example a service user's name, medication or care notes, or staff names and availability).
• Location of processing: United Kingdom (London, eu-west-2), in-region only
• Transfer outside the UK: No
• Further detail: Requests are processed only in the AWS London region. AWS does not store prompts or outputs or use them to train models, and the model developer (Anthropic) has no access to them.

A3. Stripe (Stripe Payments UK, Ltd)

• Service: Subscription billing and payment processing.
• Customer Personal Data: Billing contact name and email address, organisation name and number of seats. Card details are collected directly by Stripe and are not received by SoftCare. No service user data.
• Location of processing: United Kingdom and EEA, with onward transfer to the United States
• Transfer outside the UK: Yes. Safeguard: UK Extension to the EU-US Data Privacy Framework and the UK Addendum to the EU Standard Contractual Clauses

A4. Resend (Plus Five Five, Inc.)

• Service: Delivery of email sent by the Service.
• Customer Personal Data: Recipient name and email address and the content of emails sent by the Service: sign-in and account emails, invitations, operational alerts to staff (for example a missed visit, a reported incident or a rota change), notice that an HR letter is available, and HR summaries. Emails do not contain service users' names, care records or health data.
• Location of processing: United States
• Transfer outside the UK: Yes. Safeguard: UK Addendum to the EU Standard Contractual Clauses

A5. Sentry (Functional Software, Inc.)

• Service: Error monitoring for the web application.
• Customer Personal Data: Technical error reports: stack traces, page addresses with record identifiers removed, browser type, internal user and organisation identifiers, and the IP address from which a report is sent. Form contents and request bodies are not sent.
• Location of processing: European Union (Germany)
• Transfer outside the UK: Yes. Safeguard: UK adequacy regulations (EEA)

A6. PostHog (PostHog, Inc.)

• Service: Product usage analytics for the web application.
• Customer Personal Data: Pages viewed (with record identifiers removed), a pseudonymous browser identifier and IP address. Automatic event capture and session recording are disabled. No care records.
• Location of processing: European Union (Frankfurt)
• Transfer outside the UK: Yes. Safeguard: UK adequacy regulations (EEA)

A7. postcodes.io (Ideal Postcodes Ltd)

• Service: Conversion of postcodes to map coordinates for visit planning and mileage.
• Customer Personal Data: Postcodes of service users' homes and care locations, sent without names or house numbers.
• Location of processing: United Kingdom
• Transfer outside the UK: No

A8. Google Workspace (Google Cloud EMEA Limited)

• Service: SoftCare's business email, including support correspondence.
• Customer Personal Data: The content of emails sent to SoftCare, including any personal data a customer includes in a support request.
• Location of processing: United States and other countries
• Transfer outside the UK: Yes. Safeguard: UK Extension to the EU-US Data Privacy Framework and the UK Addendum to the EU Standard Contractual Clauses

A9. GitHub (GitHub, Inc.)

• Service: Source code hosting and software build services.
• Customer Personal Data: None. Customer Personal Data is not stored in source code or build systems.
• Location of processing: United States
• Transfer outside the UK: Yes. Safeguard: UK Extension to the EU-US Data Privacy Framework (GitHub data protection agreement)

Schedule 3: Technical and organisational measures

SoftCare maintains the following measures. Further detail is published at softcare.uk/trust for information and does not form part of this Agreement.

1. Hosting. Customer Personal Data is hosted in the United Kingdom with an established cloud provider.

2. Separation of customers. Each customer's data is logically separated, with separation enforced in the database.

3. Encryption. Customer Personal Data is encrypted in transit and at rest.

4. Access control. Access to the Service is controlled by user roles and permissions set by the Customer. Two-factor authentication is available to all users. Access to production systems is limited to authorised SoftCare personnel and protected by multi-factor authentication where the service supports it.

5. Logging. Access to and changes to care records are recorded in an audit log available to the Customer.

6. Secure development. Code changes are subject to automated security checks. Customer Personal Data is not used in development or test environments.

7. Backup and recovery. The production database is backed up regularly and restore procedures are tested.

8. Personnel. Personnel with access to Customer Personal Data are bound by confidentiality obligations and receive data protection training.

9. Incident response. SoftCare maintains an incident response procedure.

10. Review. SoftCare reviews these measures regularly.

11. Certification. SoftCare holds Cyber Essentials certification at the date of this version.

Schedule 4: Retention

The Customer sets the retention periods for its records in line with the records management code that applies to it, which in Scotland is the Scottish Government's Records Management Code of Practice for Health and Social Care and in England is the NHS England Records Management Code of Practice. The Service applies the default periods below. The Customer may ask SoftCare to apply a longer period.

Execution page

To be completed only where the Customer requires a signed copy (clause 16.2).

Customer

Signed for and on behalf of the Customer

Signed for and on behalf of SoftCare Technologies Ltd