Parties and precedence
This Data Processing Agreement is entered into between the customer organisation (the Controller) and Plannorium Limited trading as Curenium (the Processor). It forms part of, and is subject to, the agreement under which Curenium is supplied. It is drafted to satisfy Article 28 of the UK GDPR. Where this agreement is provided in more than one language, the English version prevails in the event of any discrepancy.
This is our standard agreement, offered for signature. Where your organisation requires its own DPA, send it to support@plannorium.com and we will review it.
Roles of the parties
The Controller determines the purposes and means of processing patient data. Curenium processes that data only on the Controller's documented instructions, including for international transfers, unless required otherwise by law — in which case we will inform the Controller before processing, unless the law prohibits it. Curenium is an independent controller for a narrow set of data: staff account details, authentication records, billing contacts, and service telemetry. Those are governed by our Privacy Policy rather than by this agreement.
Subject matter, duration and nature of processing
Subject matter: provision of an electronic health record and clinical workflow platform. Duration: for the term of the agreement, plus the retention periods set out in our Retention Schedule. Categories of data subject: patients, their nominated caregivers, and the Controller's staff. Categories of personal data: identifiers and demographics; clinical observations and vital signs; diagnoses and clinical notes; prescriptions and administration records; laboratory orders and results; admission, transfer and discharge records; appointments and referrals; messages between clinicians; uploaded documents and images; and, where enabled, biometric templates for staff verification.
Health data, and biometric data where the feature is enabled, are special-category data under Article 9. Both are processed under this agreement.
Security measures
Curenium implements the following technical and organisational measures under Article 32. These are the measures in force; we describe them concretely rather than in general terms so that they can be assessed.
- Encryption of data in transit (TLS) and at rest (AES-256).
- Role-based access control enforced at the API, not only in the user interface. Every request is re-authorised server-side.
- Per-request revalidation of the user against the database, so that suspension or deactivation takes effect on the account's next action rather than at token expiry.
- Short-lived access tokens (15 minutes) with separate refresh tokens (7 days).
- Tenant isolation: every clinical query is scoped to the organisation, including for patients shared between organisations.
- Audit logging of authentication events, record modifications, and administrative actions, with the actor, time and source address.
- Record access logging: which staff member opened which patient record, when, from what device, and whether they held a care relationship with that patient at the time.
- Deterministic clinical safety checks — including allergy and duplicate-therapy screening at prescribing and dispensing — enforced server-side and independent of any third-party service.
- Segregated environments for development and production, with no production patient data used in development.
Subprocessors
The Controller gives general authorisation for Curenium to engage subprocessors. Our current subprocessors are listed publicly and kept current at curenium.plannorium.com/subprocessors. We will give the Controller at least 30 days' notice before adding or replacing a subprocessor. The Controller may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the Controller may terminate the affected service without penalty. Each subprocessor is bound by written terms no less protective than this agreement, and Curenium remains fully liable to the Controller for their performance.
Assistance to the Controller
Curenium will assist the Controller, taking into account the nature of processing and the information available to us, with:
- Responding to data subject requests — access, rectification, erasure, restriction, portability and objection. The platform provides export and correction functions; where those are insufficient we will assist directly.
- Meeting the Controller's obligations under Articles 32 to 36, including data protection impact assessments and prior consultation with the ICO.
- Demonstrating compliance, including by making available the information necessary for the Controller's own audits.
Where a data subject contacts Curenium directly about data we process for a Controller, we will not respond substantively. We will refer them to the Controller and notify the Controller without undue delay.
Personal data breaches
Curenium will notify the Controller without undue delay, and in any event within 24 hours, of becoming aware of a personal data breach affecting the Controller's data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Where the full picture is not yet available, we will provide information in phases rather than delay the initial notification. Curenium will not notify the ICO or affected data subjects on the Controller's behalf unless instructed in writing — that determination is the Controller's to make.
Return and deletion
On termination, the Controller may request return of its data in a structured, commonly used, machine-readable format. Curenium will provide it within 30 days. After that period, or on the Controller's earlier written instruction, we will delete the data and instruct our subprocessors to do the same, except where retention is required by law — in which case we will inform the Controller what is retained, on what basis, and for how long. Backups are deleted on their own rotation. Data removed from live systems may persist in encrypted backups for up to 35 days; it is not restored to live systems and is not otherwise accessible.
Deletion of a clinical record is restricted to administrators and produces an audit entry. Clinical records are ordinarily retained under statutory schedules rather than deleted on request — see our Retention Schedule.
International transfers
Where personal data is transferred outside the United Kingdom, Curenium relies on UK adequacy regulations or, where none applies, on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. The Controller may require that its data be processed only within a specified jurisdiction. This must be agreed before deployment, as it determines which subprocessors can be used.
Audit rights
Curenium will make available to the Controller all information necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits conducted by the Controller or an auditor it mandates. Audits are on reasonable notice, no more than once in any twelve-month period unless a breach has occurred or a supervisory authority requires otherwise, and conducted so as not to compromise the security or confidentiality of other customers' data.
Signature and contact
To execute this agreement, or to raise questions about any clause, contact support@plannorium.com. We are the processor; you remain the controller of your patients' data. If any provision of this agreement conflicts with your obligations as controller, tell us — we would rather amend the agreement than have you sign something that does not fit your duties.