This Data Processing Agreement (“DPA”) forms part of the Hospify Pro terms of service (the “Terms”) between the customer (“Customer”, the controller) and Flexify Ltd (“Flexify”, the processor). It applies whenever Flexify processes personal data on the Customer’s behalf in providing Hospify Pro. Words defined in the Terms have the same meaning here. It is designed to meet Article 28 of the UK GDPR and equivalent requirements of other data protection laws that apply to the Customer.
1. Scope and roles
1.1 The Customer is the controller of Customer Data, including patient, doctor, referrer and staff data. Flexify is the processor and processes Customer Data only to provide the Service.
1.2 Flexify is a separate controller for account, billing, support and security data about the Customer and its Users, as described in the privacy policy.
2. Details of processing
| Subject matter | Provision of Hospify Pro hospital, clinic, laboratory and pharmacy management software as a service. |
|---|---|
| Duration | The Subscription Term plus the 30-day export period and backup rotation described in section 10. |
| Nature and purpose | Hosting, storage, backup, synchronisation, display, transmission (including messaging to patients), support, security monitoring and, where enabled by the Customer, AI-assisted processing. |
| Data subjects | Patients and their relatives or guardians; doctors, referrers and agents; the Customer’s staff and Users. |
| Personal data | Identifiers and contact details; demographics; appointments and visits; billing and payment records; staff attendance, roster and payroll data. |
| Special category data | Health data, including complaints, diagnoses, vitals, prescriptions, test orders and results, imaging, admission and discharge records. |
3. Processing on instructions
3.1 Flexify will process Customer Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s configuration and use of the Service, unless required to do otherwise by law; in that case Flexify will tell the Customer first unless the law forbids it.
3.2 Flexify will tell the Customer if, in its opinion, an instruction breaches data protection law.
3.3 Flexify will not sell Customer Data, use it for advertising, or use it for its own purposes, except anonymised and aggregated data that does not identify any individual or the Customer.
4. Confidentiality
Flexify ensures that everyone authorised to process Customer Data is bound by confidentiality, receives appropriate training, and accesses Customer Data only when needed to provide the Service, resolve support requests or protect security. Access is logged.
5. Security measures
Flexify implements appropriate technical and organisational measures, including:
- a separate database for each Customer, with encryption at rest and TLS encryption in transit;
- role-based access control, two-factor authentication options and session controls;
- audit logging of access and changes, and locking of verified reports and issued invoices;
- daily encrypted off-site backups with an immutable copy, and tested restore procedures;
- network protection, firewalls and DDoS mitigation through security providers;
- least-privilege access for Flexify staff, with credentials protected by two-factor authentication;
- vulnerability management, security updates and monitoring.
Flexify may update these measures provided the overall level of protection is not reduced. The Customer acknowledges that no system is completely secure and that the limits of liability in the Terms apply.
6. Sub-processors
6.1 The Customer gives general authorisation for Flexify to use sub-processors, including providers of cloud hosting, storage and backup (such as Wasabi), network and security (such as Cloudflare), messaging (WhatsApp Business Platform by Meta and SMS gateways), payment processing, email delivery and, if the Customer enables it, AI model providers.
6.2 Flexify will impose data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.
6.3 Flexify keeps a list of sub-processors, available on request. Flexify will give at least 30 days’ notice of a new sub-processor that processes Customer Data. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may cancel the affected Service before the change takes effect, as its sole remedy.
7. Assistance
7.1 Taking into account the nature of the processing, Flexify will help the Customer respond to requests from patients and other data subjects to exercise their rights, mainly through the Service’s search, edit and export features. If Flexify receives a request directly, it will pass it to the Customer and not respond itself, unless legally required.
7.2 Flexify will provide reasonable information to help the Customer with data protection impact assessments and consultations with regulators. Assistance beyond the Service’s standard features may be charged at our standard rates.
8. Personal data breaches
8.1 Flexify will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide the information reasonably available to help the Customer meet its own notification obligations.
8.2 Flexify will take reasonable steps to contain and investigate the breach and reduce its effects. Notification of a breach is not an admission of fault or liability.
9. International transfers
Flexify may process Customer Data in the United Kingdom, Bangladesh and the countries where its sub-processors operate. Where a transfer requires safeguards under applicable law, Flexify will put in place an appropriate mechanism, such as the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses. Specific data-location commitments can be agreed in an Enterprise or on-premise agreement.
10. Return and deletion
10.1 The Customer can export all Customer Data at any time during the Subscription Term and for 30 days after it ends.
10.2 After that period Flexify will delete Customer Data from the live system, and it will be removed from backups as they rotate out (normally within 90 days), unless law requires it to be kept.
10.3 Where the Service runs on the Customer’s own server or Local Server, the Customer is responsible for deleting data held on that equipment.
11. Information and audits
Flexify will make available information reasonably necessary to demonstrate compliance with this DPA, such as security documentation and answers to security questionnaires. If that is not sufficient, the Customer may carry out an audit, at its own cost, no more than once a year, with at least 30 days’ notice, during business hours, in a way that does not disrupt the Service or breach the confidentiality of other customers, and under a confidentiality agreement.
12. Customer obligations
The Customer is responsible for: having a lawful basis and any required consents for processing; giving patients and staff the information required by law; the accuracy of Customer Data; deciding what data to send by WhatsApp, SMS or other channels; managing Users and their permissions; and complying with medical record-keeping, confidentiality and health-sector rules that apply to it.
13. Liability
Each party’s liability under or in connection with this DPA is subject to the exclusions and limits of liability in the Terms, including the exclusions for third-party cyberattacks, internet and power failures and events beyond reasonable control.
14. General
14.1 If this DPA conflicts with the Terms on data protection matters, this DPA prevails.
14.2 Flexify may update this DPA to reflect changes in law or the Service, giving notice of material changes in the same way as for the Terms. A signed copy of this DPA is available on request at [email protected].
Flexify Ltd, registered in England and Wales (company number 16871618), 82A James Carter Road, Mildenhall, Bury St Edmunds IP28 7DE, United Kingdom. Bangladesh office: Flexify Ltd, 752/2 West Shewrapara, Begum Rokeya Sarani, Mirpur, Dhaka-1216. Email [email protected].
