> For the complete documentation index, see [llms.txt](https://clerkal.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clerkal.gitbook.io/docs/legal/data-processing-agreement-dpa.md).

# Data Processing Agreement (DPA)

*Last updated: 30/11/2025*

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between **Clerkal Ltd** (“Processor”) and the user or Clinic (“Controller”).

***

## **1. Subject Matter**

Clerkal processes personal data on behalf of the Controller for the purpose of providing clinical template and documentation services.

***

## **2. Roles**

* **Controller**: You (the clinician or Clinic)
* **Processor**: Clerkal Ltd

***

## **3. Nature of Processing**

Processing includes:

* Storage
* Encryption
* Use for AI-assisted generation
* Display within the Clerkal interface
* Backup and security logging

***

## **4. Type of Data**

* Clinician user data (name, email)
* Clinical text content
* Optional patient-related text (not recommended)

Clerkal does **not** require identifiable patient data.

***

## **5. Duration**

For the duration of the user’s or Clinic’s active account and up to 90 days after deletion.

***

## **6. Obligations of the Processor**

Clerkal shall:

1. Process data only on documented instructions from the Controller.
2. Ensure staff are subject to confidentiality obligations.
3. Implement appropriate technical and organisational security measures.
4. Assist the Controller in responding to data subject rights requests.
5. Notify the Controller of data breaches within a reasonable timeframe.
6. Assist with audits related to compliance.
7. Not subcontract processing without appropriate agreements.

***

## **7. Subprocessors**

Clerkal uses subprocessors for:

* Hosting
* Email delivery
* Payment processing

A current list will be provided on request.

All subprocessors receive only the minimum data required and must follow GDPR-compliant agreements.

***

## **8. International Transfers**

Any international transfers will use:

* Standard Contractual Clauses
* Adequacy decisions
* Other lawful safeguards

***

## **9. Deletion or Return of Data**

Upon termination:

* Clerkal will delete personal data within **90 days**, unless legally required to retain it.
* Data exports may be requested prior to deletion.

***

## **10. Liability**

Liability is governed by the overarching Terms of Service.