This Data Processing Agreement ("DPA") forms part of the agreement between the Clinic and Optivet Referrals Ltd ("Processor"), which offers the Optivet AIproduct, for use of the Optivet AI platform, and applies to the processing of personal data the Processor carries out on the Clinic's behalf. It is intended to meet the requirements of Article 28 of the UK GDPR.
1. Roles and scope
- Controller: the subscribing veterinary clinic ("Clinic").
- Processor: Optivet Referrals Ltd (offering the Optivet AI product).
- Sub-processor: MGV TECH LTD (technology provider; develops and hosts parts of the platform on the Processor's behalf).
This DPA covers "Clinic Content": the clinical case data the Clinic submits or generates on the platform, meaning uploaded images, free-text patient-record fields, feedback notes, the analysis results generated from them, and the case-linked portions of audit records. The Clinic determines the purposes and means of processing Clinic Content; the Processor processes it only on the Clinic's behalf and only for the purposes in this DPA.
For user account data, billing data, and platform security records, the Processor acts as an independent controller as described in the Privacy Policy; that processing is outside the scope of this DPA.
2. Subject matter, duration, nature, and purpose of processing
Subject matter. Hosting and processing of canine ophthalmic images and associated case data submitted by the Clinic to the Optivet AI platform.
Duration. Processing continues for the term of the Clinic's subscription and for 90 days following cancellation, termination, or a deletion request, after which Clinic Content is erased in line with Section 4.8 (deletion and return) and the retention schedule in the Privacy Policy, except where applicable law requires longer retention (for example, audit-event skeletons retained for 7 years, from which patient identifiers are removed on a deletion request).
Nature of processing. Collection, storage, quality screening, automated analysis (image quality, normality screening, finding classification, urgency scoring, and similarity retrieval), report generation, audit logging, export, and deletion.
Purpose. To provide the Clinic with Optivet AI's veterinary screening and triage decision-support service. The Processor does not use Clinic Content to train or improve its models; any such use would require the Clinic's separate written agreement and an amendment to this DPA.
3. Categories of data subjects and personal data
Data subjects:
- Individuals who may be identifiable from free-text fields the Clinic chooses to populate (for example, an animal owner's name entered as part of a patient reference).
- Clinic staff, to the extent their identifiers appear within case-linked records (for example, the submitting user on an audit event).
Personal data:
- Free-text patient-record fields: patient identifier, breed, age, sex, eye, and feedback notes associated with an analysis, together with the uploaded images and generated analysis results to which those fields relate.
- Case-linked audit data: event type, associated analysis, clinic, and user identifiers, model version, and processing timestamps.
No special category data is intentionally collected by the platform. The Clinic must not enter special category data about an identifiable person (for example, health information about a named individual) into free-text fields unless it has an appropriate lawful basis and has assessed the risk of doing so.
4. Processor obligations
The Processor shall:
- Process only on documented instructions. Process Clinic Content only on the Clinic's documented instructions, including with respect to transfers outside the UK, unless required to do otherwise by law that applies to the Processor, in which case the Processor will inform the Clinic of that legal requirement before processing, unless the law prohibits this on important public interest grounds. The Terms of Service, this DPA, and the Clinic's use of the platform's functions (submitting, exporting, and deleting data) are the Clinic's documented instructions.
- Flag unlawful instructions. Immediately inform the Clinic if, in the Processor's opinion, an instruction from the Clinic infringes the UK GDPR or other applicable data protection law.
- Confidentiality. Ensure that persons authorised to process Clinic Content are subject to a duty of confidentiality, whether contractual or statutory.
- Security. Implement and maintain appropriate technical and organisational measures. As at the date of this DPA these include: tenant isolation with per-request clinic checks; encryption in transit (TLS, including certificate-verified database connections); private, non-public image storage; bcrypt password hashing; least-privilege database roles; audit logging of every inference with model version and thresholds; 14-day database point-in-time recovery and 14-day storage soft delete with versioning, with restore procedures drilled quarterly; and automated dependency vulnerability audits on every build.
- Sub-processors. Not engage another processor without the Clinic's prior general authorisation, and impose data protection obligations on any sub-processor at least as protective as this DPA. The current list is in Section 6; the Clinic authorises it as of the effective date. The Processor will give reasonable advance notice of any addition or replacement, during which the Clinic may object on reasonable data protection grounds. The Processor remains fully liable to the Clinic for the performance of any sub-processor's obligations.
- Assistance with data-subject requests. Taking into account the nature of the processing, assist the Clinic by appropriate technical and organisational measures, insofar as reasonably possible, in fulfilling the Clinic's obligation to respond to data-subject requests (access, rectification, erasure, restriction, portability, and objection). The platform's built-in export and deletion functions satisfy the most common requests without Processor involvement.
- Assistance with compliance. Assist the Clinic in ensuring compliance with its obligations relating to security of processing, breach notification, data protection impact assessments, and prior consultation with the Information Commissioner's Office, taking into account the information available to the Processor.
- Deletion or return on termination. At the end of the provision of services, at the Clinic's choice, delete or return all Clinic Content and delete existing copies. In practice: the Clinic may export all its data from the application at any time; Clinic Content is erased 90 days after cancellation, termination, or a deletion request (patient identifiers are additionally removed immediately on a deletion request); and deleted content ages out of the 14-day backup window automatically. Audit-event skeletons are retained for 7 years as required for clinical accountability, with patient identifiers removed.
- Breach notification. Notify the Clinic without undue delay after becoming aware of a personal data breach affecting Clinic Content, in time for the Clinic to meet its own notification obligations, and provide the information reasonably necessary for the Clinic to do so.
- Audit rights. Make available to the Clinic all information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Clinic or an auditor mandated by the Clinic, on reasonable notice, no more than once per year unless a breach has occurred, and subject to reasonable confidentiality safeguards.
5. Controller obligations
The Clinic shall:
- ensure it has a lawful basis for all personal data it submits to the platform, including any personal data entered into free-text fields;
- only give the Processor instructions that are lawful; and
- respond to data-subject requests directed to it, with the Processor's assistance as set out in Section 4.6.
6. Sub-processors
- MGV TECH LTD — technology provider: develops and hosts parts of the platform on the Processor's behalf, using the onward providers below — United Kingdom.
- Microsoft Azure — application hosting, database, and image storage — United Kingdom (Azure UK South).
- Stripe — subscription billing and payment processing — United States; UK extension to the EU-US Data Privacy Framework and/or the UK International Data Transfer Addendum.
- Resend — transactional email (account and billing notices) — United States; UK International Data Transfer Addendum [● confirm on contract].
- Sentry (Functional Software, Inc.) — error monitoring (error reports may carry clinic and case identifiers, never images) — [● EU or US data residency selected at account creation]; UK addendum/DPF as applicable.
- GitHub (Microsoft) — deployment automation and scheduled maintenance jobs that connect to the database; data transits job runners and is not stored there — United States; UK extension to the EU-US Data Privacy Framework.
7. International transfers
Primary processing takes place in the Microsoft Azure UK South region. Any transfer of Clinic Content outside the UK, whether to a sub-processor or otherwise, relies on a safeguard recognised under UK GDPR: an adequacy regulation (including the UK extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
8. Liability
Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service, save that nothing limits a party's liability for fines lawfully imposed on the other party to the extent caused by the first party's breach of this DPA.
9. Term
This DPA takes effect on the date the Clinic accepts the Terms of Service (or signs this DPA, if earlier) and continues for as long as the Processor processes Clinic Content on the Clinic's behalf.
Signature blocks
This DPA may be executed by the parties' authorised representatives, including by electronic acceptance of the Terms of Service at signup.