Data Processing Agreement (DPA)

Between DAN and Dental Practices

(UK GDPR, EU GDPR, UK Medical Device Regulations)

Last Updated: June 8th, 2026

Parties

This Data Processing Agreement (Agreement) is entered into between the parties identified above and governs the processing of personal data by Dental Audio Notes Ltd (DAN, the Processor) on behalf of the dental practice (the Controller) in connection with DAN's clinical software service (the Service).

1. Definitions and Interpretation

1.1 In this Agreement, the following terms have the meanings set out below:

1.2 References to Articles are to Articles of the Applicable Data Protection Law unless otherwise specified. Where both UK GDPR and EU GDPR apply to a processing activity, the more stringent provision shall prevail.

1.3 The Schedule(s) to this Agreement form part of and are incorporated into this Agreement.

2. Scope, Roles and Applicable Law

2.1 This Agreement applies to all processing of Patient Personal Data carried out by DAN on behalf of the Controller in connection with the Services.

2.2 The Controller is the Data Controller for Patient Personal Data. DAN is the Data Processor. DAN shall process Patient Personal Data only on the documented instructions of the Controller, except where required to do so by Applicable Data Protection Law.

2.3 The subject matter, nature, purpose, duration of processing, types of Personal Data, and categories of Data Subjects are set out in Schedule 1 (Processing Details) to this Agreement.

2.4 This Agreement shall be governed by and construed in accordance with English law. The parties submit to the exclusive jurisdiction of the courts of England and Wales, save that:

2.4.1 where the Controller is established in an EU member state and the processing is subject to EU GDPR, the relevant provisions of EU GDPR shall apply to that processing in addition to and, where they are more protective of Data Subjects, in priority to the equivalent UK GDPR provisions; and

2.4.2 nothing in this clause shall limit the right of a Data Subject to bring proceedings before the supervisory authority or courts of the member state in which they are habitually resident.

2.5 DAN confirms that it has no reason to believe that any Applicable Data Protection Law applicable to it prevents it from fulfilling its obligations under this Agreement.

3. DAN's Obligations as Processor

3.1 DAN shall, with respect to Patient Personal Data:

3.1.1 process Patient Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by Applicable Data Protection Law to which DAN is subject, in which case DAN shall inform the Controller of that legal requirement before processing, unless prohibited from doing so on important grounds of public interest;

3.1.2 ensure that persons authorised to process Patient Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

3.1.3 implement and maintain the technical and organisational security measures described in Schedule 3, and such further measures as are required by Article 32 of the Applicable Data Protection Law;

3.1.4 not engage any Sub-Processor without the prior specific or general written authorisation of the Controller, and where such authorisation is given, impose equivalent data protection obligations on any Sub-Processor by way of a written contract, remaining fully liable to the Controller for the performance of the Sub-Processor's obligations;

3.1.5 assist the Controller by appropriate technical and organisational measures, in so far as possible, to fulfil the Controller's obligations to respond to requests for exercising Data Subjects' rights under Chapter III of the Applicable Data Protection Law;

3.1.6 assist the Controller in ensuring compliance with its obligations pursuant to Articles 32 to 36 of the Applicable Data Protection Law, taking into account the nature of processing and information available to DAN;

3.1.7 at the choice of the Controller, delete or return all Patient Personal Data to the Controller after the end of the provision of the Services, and delete existing copies unless Applicable Data Protection Law requires storage of the Personal Data;

3.1.8 make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Agreement and Article 28 of the Applicable Data Protection Law, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, with reasonable prior notice and at the Controller's cost.

4. Controller's Instructions

4.1 The Controller instructs DAN to process Patient Personal Data for the purposes described in Schedule 1, including:

4.1.1 storing encrypted audio recordings of patient consultations;

4.1.2 transcribing audio recordings (using DAN’s internal infrastructure, or where enabled under clause 5.4, an authorised Sub-Processor);

4.1.3 generating AI-assisted clinical documentation;

4.1.4 storing and making available AI-generated clinical records to authorised clinicians of the Controller;

4.1.5 retaining Patient Personal Data for the retention period specified in Schedule 1, and deleting it thereafter;

4.1.6 making Patient Personal Data available to named DAN employees for the purpose of Post Market Surveillance as required by the UK Medical Device Regulations 2002 (as amended) and EU MDR 2017/745.

4.1.7 where the Controller has enabled a DPMS Integration, transmitting AI-generated clinical records, transcription text, and such other clinical data fields as are configured in the integration to the API endpoint of the Controller's designated Dental Practice Management System (DPMS) provider, solely for the purpose of populating the Controller's existing clinical records system.

4.2 The Controller warrants that it has, and will maintain throughout the term of this Agreement, all necessary rights, consents, and legal bases required under Applicable Data Protection Law to instruct DAN to process Patient Personal Data as described in this Agreement.

4.3 The Controller is responsible for ensuring that patients are informed of the recording and processing of their consultation data, including via an appropriate patient-facing privacy notice that discloses DAN's role as Data Processor and the use of any Sub-Processors. DAN provides an example privacy notice template (UM0080) which the Controller may adapt for this purpose.

4.4 DAN shall promptly notify the Controller if, in DAN's opinion, an instruction from the Controller infringes Applicable Data Protection Law.

4.5 Where the Controller wishes to enable a DPMS Integration, the Controller shall:

4.5.1 designate the DPMS provider to whose API endpoint DAN shall transmit data, by completing the integration configuration in the DAN account settings or by authorising a Partner to do so on the Controller's behalf;

4.5.2 confirm that the Controller has an existing contractual relationship with the DPMS provider that governs the DPMS provider's receipt and processing of Patient Data;

4.5.3 ensure that patients are informed, via the Practice's patient privacy notice, that their clinical records may be transmitted to the DPMS provider. DAN's example privacy notice template (UM0080.1) includes suggested wording for this disclosure;

4.5.4 acknowledge that the DPMS provider is an independent Data Controller for Patient Data once received, and that DAN has no responsibility for, and no visibility of, the DPMS provider's processing of that data after receipt.

4.5.5 confirm the hosting location of the DPMS provider's systems and, where that location is outside the United Kingdom or European Economic Area, confirm that an adequate transfer mechanism (such as an adequacy decision, Standard Contractual Clauses, or an International Data Transfer Agreement) is in place under the Controller's agreement with the DPMS provider.

5. Sub-Processing

5.1 The Controller provides general written authorisation for DAN to engage the Sub-Processors listed in Schedule 2 as at the date of this Agreement, subject to the conditions set out in this clause 5.

5.2 DAN shall give the Controller not less than 30 days' prior written notice of any proposed addition to or replacement of a Sub-Processor (a Sub-Processor Change Notice), giving details of the proposed new Sub-Processor including its name, location, and the nature of the processing it will carry out.

5.3 The Controller may object to a proposed Sub-Processor change by notifying DAN in writing within 14 days of receiving a Sub-Processor Change Notice, setting out reasonable grounds for the objection. DAN shall work with the Controller in good faith to resolve the objection. If the parties are unable to resolve the objection within 30 days, either party may terminate this Agreement on written notice without liability for the termination itself, save for accrued obligations.

5.4 A Sub-Processor Fallback may be used for a Controller only where all of the following apply:

5.4.1 DAN has made the Sub-Processor Fallback available to that Controller by written notice under clause 5.2;

5.4.2 the Controller has confirmed in writing that it wishes the Sub-Processor Fallback to be enabled for its account, by ticking the confirmation in the DAN account settings, which records the name of the person confirming, the date and time, the account concerned and the version of this Agreement; and

5.4.3 the Sub-Processor Fallback is used only for transcription where DAN is unable to provide transcription through its own infrastructure, and then only for the Controller that has given that confirmation.

The Controller may withdraw its confirmation at any time in the DAN account settings, and DAN will stop using the Sub-Processor Fallback for that Controller from that point.

5.5 DAN shall impose on each Sub-Processor data protection obligations equivalent to those set out in this Agreement by way of a written contract. DAN shall remain fully liable to the Controller for the performance of any Sub-Processor's obligations under such contract.

5.6 An up-to-date list of Sub-Processors is maintained in the DAN Sub-Processor Register, accessible via the DAN account portal at https://dentalaudionotes.com/app/privacy. The Sub-Processor Register is incorporated into this Agreement by reference and constitutes Schedule 2 to this Agreement.

6. Security of Processing

6.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, DAN shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate:

6.1.1 end-to-end encryption of Patient Personal Data - audio files are encrypted locally on the clinician's device before transmission;

6.1.2 encryption in transit using TLS 1.2 or higher for all data transmitted between the DAN client application and DAN's servers;

6.1.3 encryption at rest for all Patient Personal Data stored on DAN's AWS infrastructure;

6.1.4 access controls ensuring Patient Personal Data is accessible only to authenticated and authorised clinicians of the Controller and to named DAN employees with a documented legitimate purpose;

6.1.5 storage of Patient Personal Data exclusively in AWS regions within the United Kingdom and/or European Union (eu-west-2 London; eu-west-3 Paris), ensuring data sovereignty;

6.1.6 AI record generation using AWS Bedrock, invoked from DAN’s secure AWS environment in the United Kingdom, using an EU cross-region inference profile, under which processing may take place in eu-west-2 (London), eu-west-3 (Paris) or other EU regions; AWS does not use Patient Personal Data to train models;

6.1.7 the ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

6.1.8 a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures, including formal penetration testing at least annually.

6.2 The technical and organisational measures in place as at the date of this Agreement are described in Schedule 3. DAN may update these measures from time to time provided that any updates do not materially reduce the level of security afforded to Patient Personal Data.

7. Personal Data Breach Notification

7.1 DAN shall notify the Controller without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Patient Personal Data, to enable the Controller to comply with its obligations under Article 33 of the Applicable Data Protection Law (which requires notification to the supervisory authority within 72 hours).

7.2 Such notification shall include, to the extent available at the time of notification:

7.2.1 a description of the nature of the Personal Data Breach including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned;

7.2.2 the name and contact details of DAN's DPO or other contact point from which further information can be obtained;

7.2.3 a description of the likely consequences of the Personal Data Breach;

7.2.4 a description of the measures taken or proposed to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

7.3 DAN shall cooperate with the Controller and take such reasonable steps as the Controller directs to assist in the investigation, mitigation, and remediation of each such Personal Data Breach.

7.4 DAN shall maintain a record of all Personal Data Breaches, regardless of whether notification to a supervisory authority is required.

8. Assistance with Data Subject Rights

8.1 DAN shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures in fulfilling the Controller's obligations to respond to requests from Data Subjects exercising their rights under Chapter III of the Applicable Data Protection Law.

8.2 Without limiting clause 8.1, DAN shall:

8.2.1 promptly notify the Controller (and in any event within five business days) if DAN receives a request from a Data Subject purporting to exercise their rights in relation to Patient Personal Data;

8.2.2 not respond to such requests directly except on documented instructions from the Controller or as required by Applicable Data Protection Law;

8.2.3 provide the Controller with such information and assistance as reasonably required to respond to requests within the applicable statutory timeframe.

8.3 Where a Data Subject makes a valid request for erasure and the Controller instructs DAN to delete Patient Personal Data, DAN shall do so within 30 days of receiving the instruction, subject to any legal retention obligations (including local record-keeping retention periods applicable to dental records).

9. International Data Transfers

9.1 DAN shall not transfer Patient Personal Data to a country or territory outside the United Kingdom or European Economic Area (as applicable) unless:

9.1.1 the transfer is to a country or territory that has been designated as providing an adequate level of protection by the relevant authority (the ICO for UK transfers; the European Commission for EU transfers); or

9.1.2 appropriate safeguards are in place in accordance with Article 46 of the Applicable Data Protection Law, namely:

(a) for Patient Personal Data originating in the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018 (the “UK Addendum”); and

(b) for Patient Personal Data originating in the European Economic Area, the Standard Contractual Clauses adopted by the European Commission on 4 June 2021.

9.2 Patient Personal Data is stored exclusively in AWS regions within the United Kingdom (eu-west-2, London) and the European Union (eu-west-3, Paris). AI processing under clause 6.1.6 may take place in other EU regions.

9.3 Where a Sub-Processor Fallback is enabled and Patient Personal Data is transmitted to a Sub-Processor, DAN shall ensure that an adequate transfer mechanism is in place for any transfer outside the UK or EEA, and shall maintain evidence of such mechanisms in its Sub-Processor register.

9.4 DAN shall notify the Controller promptly if any transfer mechanism relied upon under this clause ceases to be valid or is materially affected by a change in law.

10. Retention and Deletion of Patient Personal Data

10.1 DAN shall retain Patient Personal Data for the periods set out in Schedule 1. Retention periods apply separately to original audio recordings, transcriptions and AI-generated clinical records. The default period is 11 years from the date of the relevant consultation, in line with UK NHS dental record-keeping guidance. The Controller may shorten the retention period for any category of Patient Personal Data, down to one month, through the DAN account settings or by written instruction to DAN’s Data Protection Officer. The Controller acknowledges that a shorter period may conflict with its own legal record-keeping obligations and is responsible for choosing the periods that apply to its records.

10.2 On expiry of the applicable retention period, DAN shall automatically and permanently delete the relevant Patient Personal Data, including copies held by Sub-Processors, within 30 days. DAN shall provide written confirmation of deletion to the Controller on request.

10.3 The Controller may request early deletion of Patient Personal Data (or specified records) by setting a custom retention schedule or submitting a written request to DAN's DPO. DAN shall action such requests within 30 days, subject to any conflicting legal retention obligations, and shall confirm completion in writing.

10.4 On termination of this Agreement or the DAN Terms of Service for any reason, DAN shall, at the Controller's election: (a) return all Patient Personal Data to the Controller in a structured, machine-readable format; or (b) securely delete all Patient Personal Data; within 60 days of termination, and certify such return or deletion in writing. DAN may retain Patient Personal Data beyond this period only where required to do so by Applicable Data Protection Law, and shall notify the Controller of any such retention.

11. Post Market Surveillance Access

11.1 The Controller acknowledges and agrees that DAN develops and operates its software in alignment with the standards applicable to Software as a Medical Device (SaMD) under the UK Medical Device Regulations 2002 (as amended) and EU MDR 2017/745, and conducts Post Market Surveillance (PMS) on a voluntary basis in accordance with those standards as part of its commitment to clinical safety and application quality.

11.2 In fulfilment of these obligations, DAN maintains a defined list of named employees who may access Patient Personal Data on a read-only basis for the sole purpose of PMS. The Controller provides its informed consent and instruction for this processing as a condition of using the Services.

11.3 DAN shall:

11.3.1 restrict PMS access to the minimum number of named individuals necessary;

11.3.2 maintain a named-access register of all individuals with PMS access, available to the Controller on request;

11.3.3 ensure that individuals with PMS access are bound by appropriate confidentiality obligations;

11.3.4 maintain audit logs of all PMS access events, including the individual who accessed the data, the date and time of access, and the purpose;

11.3.5 use Patient Personal Data accessed for PMS purposes only for that purpose, and not disclose it to any third party except as required by law.

11.4 DAN shall provide the Controller with details of its current PMS access list on written request.

12. Audit Rights

12.1 DAN shall make available to the Controller, on reasonable written request (with not less than 30 days' notice), all information necessary to demonstrate compliance with this Agreement.

12.2 DAN shall permit and contribute to audits and inspections conducted by the Controller or a third-party auditor appointed by the Controller, subject to:

12.2.1 reasonable prior written notice of not less than 30 days;

12.2.2 the Controller bearing all reasonable costs of the audit;

12.2.3 the auditor being subject to appropriate confidentiality obligations;

12.2.4 audits being conducted during normal business hours and in a manner that does not unreasonably disrupt DAN's operations.

12.3 DAN may satisfy its obligations under clause 12.1 by providing the Controller with relevant third-party audit reports, certifications, or penetration test summaries, provided these are sufficiently recent and cover the scope of the Controller's request.

13. Term and Termination

13.1 This Agreement shall commence on the date of electronic acceptance at signup and shall continue for so long as DAN processes Patient Personal Data on behalf of the Controller under the DAN Terms of Service.

13.2 This Agreement shall automatically terminate upon termination or expiry of the DAN Terms of Service for any reason.

13.3 The obligations under clauses 6 (Security), 7 (Breach Notification), 10 (Retention and Deletion), 11 (Post Market Surveillance) and 12 (Audit Rights) shall survive termination of this Agreement to the extent necessary to give them full effect.

14. Liability

14.1 Each party's liability under this Agreement shall be subject to the limitations and exclusions set out in the DAN Terms of Service, to the maximum extent permitted by Applicable Data Protection Law.

14.2 Nothing in this Agreement shall limit either party's liability for:

14.2.1 death or personal injury caused by its negligence;

14.2.2 fraud or fraudulent misrepresentation;

14.2.3 any liability that cannot be limited or excluded by law, including liability for breach of obligations under Applicable Data Protection Law that cannot be contractually excluded.

14.3 DAN shall indemnify the Controller against any fines, penalties, or awards imposed by a supervisory authority or court on the Controller to the extent directly caused by DAN's breach of this Agreement or Applicable Data Protection Law in its capacity as Processor, save that this indemnity shall not apply where the Controller's own acts or omissions contributed to the breach.

15. General

15.1 Entire Agreement. This Agreement and the Schedules hereto constitute the entire agreement between the parties with respect to the processing of Patient Personal Data and supersede all prior agreements, understandings, and representations relating to the same subject matter.

15.2 Precedence. In the event of any conflict between this Agreement and the DAN Terms of Service with respect to the processing of Patient Personal Data, this Agreement shall prevail.

15.3 Variation. DAN may update this Agreement from time to time to reflect changes in Applicable Data Protection Law or DAN's processing activities. DAN shall provide the Controller with not less than 30 days' written notice of any material changes. Continued use of the Services after the notice period constitutes acceptance of the updated Agreement.

15.4 Severance. If any provision of this Agreement is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

15.5 No Waiver. Failure by either party to enforce any provision of this Agreement shall not constitute a waiver of that party's right to enforce it at a later date.

15.6 Third Party Rights. This Agreement does not confer any rights on any third party, except that Data Subjects may rely on the protections afforded to them by this Agreement to the extent permitted by Applicable Data Protection Law.

Schedule 1 - Processing Details

This Schedule sets out the details of the processing carried out by DAN as Processor on behalf of the Controller, as required by Article 28(3) of the Applicable Data Protection Law.

Schedule 2 - Authorised Sub-Processors

The current list of authorised Sub-Processors, including their name, location, service provided, data processed, safeguards, and agreements in place, is maintained in the DAN Sub-Processor Register, published at https://dentalaudionotes.com/app/privacy and available on request from DAN's Data Protection Officer at dpo@dentalaudionotes.com.

The DAN Sub-Processor Register is incorporated into this Agreement by reference and forms part of Schedule 2. DAN will notify the Controller of any additions to or replacements of Sub-Processors in accordance with clause 5.2 of this Agreement (30 days' prior written notice).

The most recent version of the Sub-Processor Register as at the date of this Agreement lists the following Sub-Processors:

Sub-Processor Fallback

Means a Sub-Processor listed in Schedule 2 that DAN may make available as a last resort, where DAN is unable to provide transcription through its own infrastructure. A Sub-Processor Fallback is used only after the Controller has confirmed in writing that it wishes it to be enabled for its account. No Sub-Processor Fallback is enabled for any Controller at the date of this Agreement.

Schedule 3 - Technical and Organisational Security Measures

The following technical and organisational measures are implemented by DAN in accordance with clause 6 of this Agreement and Article 32 of the Applicable Data Protection Law.

Schedule 4 - Controller Acknowledgements

By accepting this Agreement electronically at signup, the authorised representative of the dental practice confirms and acknowledges the following:

The Controller confirms that:

1. They have read and understood this Data Processing Agreement in full.
2. They have authority to bind the dental practice to this Agreement.
3. The dental practice is the Data Controller for patient personal data processed using DAN.
4. The dental practice has, or will obtain and maintain, all necessary legal bases to instruct DAN to process patient personal data as described in this Agreement.
5. The dental practice is responsible for ensuring patients are informed of the recording and processing of their consultation data via an appropriate patient-facing privacy notice.
6. The dental practice understands that where a Sub-Processor Fallback is enabled under clause 5.4, patient audio will be transmitted to the relevant Sub-Processor(s) listed in Schedule 2, and accepts responsibility for disclosing this to patients.
7. The dental practice understands that named DAN employees may access patient data for Post Market Surveillance purposes as described in clause 11, and consents to this processing.
8. The dental practice will notify DAN promptly of any change in the legal basis for processing patient personal data that may affect DAN's authority to process under this Agreement.

Schedule 5 - DPMS Integration Details

This Schedule records the details of any PMS Integration enabled by the Controller under clause 4.1.7 and clause 4.5.