Home

Legal

Data Processing Agreement

Last updated: May 24, 2026

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (“Controller”) and Pulse Dent Ltd (“Processor”) and applies whenever the Processor processes Personal Data on behalf of the Controller in connection with the Service. It is intended to satisfy Article 28 GDPR.

2. Processor obligations

  • Process Personal Data only on documented instructions from the Controller.
  • Ensure personnel authorized to process Personal Data are bound by confidentiality.
  • Implement appropriate technical and organisational measures (see Annex II).
  • Assist the Controller with data subject requests and DPIAs where reasonably required.
  • Notify the Controller without undue delay of any Personal Data breach (within 72 hours of awareness where feasible).
  • On termination, delete or return all Personal Data, save to the extent retention is required by law.

3. Sub-processors

The Controller authorises the engagement of sub-processors listed in Annex I. The Processor will provide at least 30 days’ notice of any intended addition or replacement and the Controller may object on reasonable data-protection grounds.

4. International transfers

Transfers outside the EEA are covered by the EU Commission Standard Contractual Clauses (2021/914), Module 2 (controller-to-processor), which are incorporated by reference.

Annex I - Description of processing

  • Categories of data subjects: Controller’s personnel, patients, and other authorised users.
  • Categories of Personal Data: identification (name, email), contact, role, clinical records, appointment history, billing data, support correspondence.
  • Special categories: health data (Art. 9 GDPR).
  • Nature of processing: hosting, storage, transmission, backup, support, analytics.
  • Purpose: provision of the Pulse Dent Service to the Controller.
  • Duration: term of the subscription plus 30-day grace period.
  • Approved sub-processors: Supabase, Vercel, Railway, Postmark, OpenAI, Sentry, LemonSqueezy.

Annex II - Technical and organisational measures

  • Encryption in transit (TLS 1.2+) and at rest (AES-256) for customer data.
  • Tenant isolation on shared tables: every query is scoped to one organization.
  • Role-based access control with least-privilege defaults; SSO available on the Custom plan.
  • Audit logs for security-relevant events with 12-month retention.
  • Vulnerability management: dependency scanning, automated patching, annual third-party penetration test.
  • Business continuity: daily encrypted backups; documented incident response plan with 72-hour breach notification.
  • Personnel: background checks where lawful, security awareness training, confidentiality agreements.