Data Processing Schedule

1. Subject matter and duration

The subject matter is healthcare-content assurance, monitoring and related professional review requested by the controller. Processing lasts for the contracted service period plus the documented deletion or return period, subject to any lawful security or legal hold.

2. Nature and purpose

Permitted operations may include receiving, storing, organising, reviewing, comparing, minimising, analysing and deleting content necessary to provide the contracted assurance service.

Private patient-record processing is outside the standard service and requires separately agreed scope and data-protection review.

3. Data and data subjects

Possible data subjects include client staff and professional contacts, and individuals appearing in client-controlled public marketing material.

Possible personal data includes business contact details, public content, screenshots, exports, transcripts and incidental identifiers contained within that material.

4. Vericenta obligations

Vericenta Ltd will:

• process personal data only on documented instructions unless UK law requires otherwise;
• ensure authorised personnel are subject to appropriate confidentiality obligations;
• implement appropriate technical and organisational security measures;
• use sub-processors only under equivalent data-protection obligations;
• assist the controller, taking account of the nature of processing, with data-subject rights requests;
• assist with security, breach, DPIA and regulator-consultation obligations where applicable;
• notify the controller without undue delay after becoming aware of a personal-data breach affecting controller data;
• make information reasonably necessary to demonstrate Article 28 compliance available;
• permit proportionate audit or assurance requests subject to confidentiality and security; and
• inform the controller if an instruction appears to infringe applicable data-protection law.

5. Sub-processors

The controller gives general authorisation for the sub-processors used by Vericenta to provide the contracted service under the production arrangements. Material changes are notified where required by the commercial agreement and applicable law.

6. International transfers

Vericenta will not intentionally make a restricted transfer of controller data unless an applicable UK adequacy decision or approved UK safeguard is in place.

7. Return and deletion

At the end of processor services, Vericenta will return or delete controller personal data where applicable unless UK law requires retention. Protected backup copies may persist only for the documented backup rotation and are not used for ordinary processing.

8. Precedence

Where this schedule conflicts with the main contract on mandatory processor obligations, this schedule prevails to the extent required by applicable data-protection law.

Contact

Questions about this schedule can be sent to hello@vericenta.com. See also the Privacy notice and Data protection and GDPR policy.