Accurx Data Processing Agreement

Accurx's Sub-Processor Webpage

http://support.accurx.com/en/articles/5501255-accurx-sub-processors

Accurx's Security Measures Webpage

available on request;

Controller

means a natural or legal person or organisation who determines the purposes for which, and the manner in which, any Personal Data are, or are to be processed;

Processor

in relation to Personal Data, means any person (other than an employee of the Controller) who processes Personal Data on behalf of the Controller;

Data Protection Legislation

means the EU's General Data Protection Regulation (2016/679), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, the UK GDPR and any mandatory guidance or codes of practice issued by the UK's Information Commissioner's Office from time to time;

Data Subject

means an individual to whom Personal Data relates;

GP Medical Record

means the patient’s medical record held by their registered GP. GP medical records include, but are not limited to, information about a patient’s medicine, allergies, vaccinations, previous illnesses and test results, hospital discharge summaries, appointment letters and referral letters;

Personal Data

any information related to an identifiable natural person which can identify that individual, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Special Categories of Personal Data

means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation;

Services

means the provision of certain Software by Accurx to the Healthcare Organisation from time to time, including products currently offered and those offered in the future;

Software

the software service provided by Accurx Ltd; this software consists of a range of products to support communication with and between healthcare organisations and their patients; and

UK GDPR

has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the UK's Data Protection Act 2018

For assistance provided by Accurx in the preparation of any data protection impact assessment under clause 6.12, such assistance may include:

providing a systematic description of the envisaged processing operations and the purpose of the processing;

an assessment of the necessity and proportionality of the processing operations in relation to this Data Processing Agreement;

an assessment of the risks to the rights and freedoms of Data Subjects; and

describing the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data.

Accurx must permit the Healthcare Organisation and its third-party representatives to audit Accurx's compliance with its Data Processing Agreement obligations, on at least 30 days' notice. Accurx will give the Healthcare Organisation and its third-party representatives all necessary assistance to conduct such audits. The assistance may include, but is not limited to:

physical access (to the extent possible) to, remote electronic access to, and copies of the records and any other information held at Accurx's premises or on systems storing the Personal Data;

access to and meetings with any of Accurx's personnel reasonably necessary to provide all explanations and perform the audit effectively; and

inspection of all records and the infrastructure, electronic data or systems, facilities, equipment or application software used to process the Personal Data.

The notice requirements in clause 6.15 will not apply if the Healthcare Organisation reasonably believes that a Personal Data breach occurred or is occurring, or Accurx is in breach of any of its obligations under this Data Processing Agreement or any Data Protection Legislation.

Accurx must within 48 hours and in any event without undue delay notify the Healthcare Organisation if it becomes aware of:

the loss, unintended destruction or damage, corruption, or un-usability of part or all of the Personal Data. Accurx will use its reasonable endeavours to restore such Personal Data at its own expense as soon as possible;

any accidental, unauthorised, or unlawful processing of the Personal Data; or

any Personal Data breach.

Where the Provider becomes aware of any event within clauses 6.19.1 – 6.19.3 above it shall, without undue delay, also use its reasonable endeavours to provide the Healthcare Organisation with the following information:

description of the nature of the event, including the categories of in-scope Personal Data and approximate number of Data Subjects and the Personal Data records concerned;

the likely consequences; and

a description of the measures taken or proposed to be taken to address the incident, including measures to mitigate its possible adverse effects.

Immediately following any accidental, unauthorised or unlawful Personal Data processing or Personal Data breach, the parties will co-ordinate with each other to investigate the matter. Further, Accurx will reasonably co-operate with the Healthcare Organisation in the Healthcare Organisation's handling of the matter, including but not limited to:

assisting with any investigation;

providing the Healthcare Organisation with physical access (to the extent possible) to any facilities and operations affected;

facilitating interviews with Accurx's employees, former employees and others involved in the matter including, but not limited to, its officers and directors;

making available all relevant records, logs, files, data reporting and other materials required to comply with all Data Protection Legislation or as otherwise reasonably required by the Healthcare Organisation; and

taking reasonable and prompt steps to mitigate the effects and to minimise any damage resulting from the Personal Data breach or accidental, unauthorised or unlawful Personal Data processing.

Accurx will not inform any third party of any accidental, unauthorised or unlawful processing of all or part of the Personal Data and/or a Personal Data breach without first obtaining the Healthcare Organisation's written consent, except when required to do so by domestic law.

Accurx agrees that the Healthcare Organisation has the sole right to determine:

whether to provide notice of the accidental, unauthorised or unlawful processing and/or the Personal Data breach to any Data Subjects, the Information Commissioner's Office, other in-scope regulators, law enforcement agencies or others, as required by law or regulation or in the Healthcare Organisation's discretion, including the contents and delivery method of the notice. Save that nothing in this clause shall prevent Accurx from making any notifications required to maintain any insurance cover, regulatory authorisations, or avoid being in contractual breach of any other agreement it has entered into; and

whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.

Accurx must ensure that Accurx personnel processing the data on Accurx's behalf are subject to a duty of confidentiality ensuring in each case that access is strictly limited to those employees who need to access the relevant Personal Data, as strictly necessary to perform the Services in the context of that employee's duties to Accurx, ensuring that all such employees:

are aware of and comply with Accurx's duties under this Data Processing Agreement;

are informed of the confidential nature of the Personal Data and do not publish, disclose, or divulge any of the Personal Data to any third party unless directed in writing to do so by the Healthcare Organisation or as otherwise permitted by this Data Processing Agreement;

are subject to user authentication and log on processes when accessing the Personal Data; and

have undertaken appropriate training in relation to Data Protection Legislation and in the use, care, protection and handling of the Personal Data.

Accurx shall maintain up-to-date compliance with the NHS Data Security and Protection Toolkit (DSPT). Accurx's published report can be found under organisation code 8JT17.

The Healthcare Organisation gives Accurx a general written authorisation for the engagement of third-party sub-processors for the processing of Personal Data, subject to the terms of this Data Processing Agreement, Art. 32 of the UK GDPR, and the rules on transfers to third countries. The sub-processors currently used by Accurx are set out on Accurx's Sub-Processor Webpage.

Accurx shall carry out due diligence on each sub-processor to ensure that it is capable of providing the level of protection for the Personal Data as is required by this Data Processing Agreement. Accurx will include terms in the contract between Accurx and the sub-processor substantially similar to those set out in this Data Processing Agreement, and which are at a minimum compliant with the requirements of the Data Protection Legislation. Upon request, Accurx shall provide a copy of its agreements with sub-processors to the Healthcare Organisation (which may be redacted to remove confidential information not relevant to the requirements of this Data Processing Agreement).

Accurx will not change any sub-processor processing Personal Data under this Data Processing Agreement without first informing the Healthcare Organisation of any intended change concerning the addition or replacement of other processors by updating Accurx's Sub-Processor Webpage, thereby giving the Healthcare Organisation the opportunity to object to such changes. The Healthcare Organisation acknowledges that it is their responsibility to check regularly for any updates to Accurx's Sub-Processors, and that the Healthcare Organisation can subscribe to receive email updates by following the instructions on Accurx's Sub-Processor Webpage. Where an objection cannot be reconciled with the Service concept or technological requirements of Accurx, either party may terminate the applicable features of the Service with immediate effect.

The Healthcare Organisation approves the engagement of the entities listed at Accurx's Sub-Processor Webpage as sub-processors of Accurx for the processing of Personal Data. Accurx shall update the list of sub-processors at Accurx's Sub-Processor Webpage at least 10 days in advance of when a new sub-processor for the processing of Personal Data is engaged.

Where the sub-processor fails to fulfil its obligations under the written agreement with Accurx which contains terms substantially the same as those set out in this Data Processing Agreement, Accurx remains fully liable to the Healthcare Organisation for the sub-processor's performance of its agreement obligations.

The Healthcare Organisation consents to the Provider processing Personal Data outside the UK and/or the EEA provided that:

Accurx is processing the Personal Data in a territory which is subject to adequacy regulations under the Data Protection Legislation that the territory provides adequate protection for the privacy rights of individuals. Accurx must identify on Accurx's Sub-Processor Webpage the territory that is subject to such adequacy regulations; or

Accurx participates in a valid cross-border transfer mechanism under the Data Protection Legislation, so that Accurx (and, where appropriate, the Healthcare Organisation) can ensure that appropriate safeguards are in place to ensure an adequate level of protection with respect to the privacy rights of individuals as required by Article 46 of the UK GDPR. Accurx must identify on Accurx's Sub-Processor Webpage the transfer mechanism that enables the parties to comply with these cross-border data transfer provisions and Accurx must promptly inform the Healthcare Organisation of any change to that status; or

the transfer otherwise complies with the Data Protection Legislation.

Nothing in this Data Processing Agreement limits any liability which cannot legally be limited, including but not limited to liability for:

death or personal injury caused by negligence; and

fraud or fraudulent misrepresentation.

Subject to clause 8.1, Accurx's total liability to the Healthcare Organisation under this Data Processing Agreement shall not exceed £1,000,000 (one million pounds).

If the party entering into this Data Processing Agreement with Accurx is an integrated care board or similar body acting on behalf of one or more Healthcare Organisations ("Contracting Authority"), the Contracting Authority represents that it is duly authorised to enter into this Data Processing Agreement on behalf of the Healthcare Organisations it represents and that such Healthcare Organisations will be bound by this Data Processing Agreement as if they were direct signatories to it.