Data Processing Agreement

"Personal data", "special categories of personal data", "processing", "controller", "processor", "sub-processor", "data subject" and "personal data breach" have the meanings given to them in the UK GDPR and the EU GDPR.

"Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679), and any other data protection or privacy law applicable to the processing carried out under this DPA.

"Services" means the Grovvve practice management platform and all related services described in the Terms of Service, as updated from time to time.

"Client Data" means personal data relating to your clients that you or your clients enter into, or generate through, the Services.

You are the controller of Client Data. You determine the purposes and means of its processing, you hold the clinical relationship with the data subject, and you are responsible for having a lawful basis for the processing — including an Article 9 condition for the processing of health data.

We are the processor of Client Data. We process it only to provide the Services to you and only on your documented instructions.

We are the controller of your own practitioner account data — your name, contact details, billing information and usage records. That processing is described in the Privacy Policy, not in this DPA.

Required particulars under Article 28(3):

• Subject matter: provision of the Grovvve practice management platform
• Duration: for as long as your account is active, plus the deletion window in section 10
• Nature and purpose: hosting, storing, organising, transmitting, retrieving and deleting Client Data so that you can schedule appointments, document sessions, communicate securely, collect intake information, and invoice clients
• Types of personal data: names, contact details, dates of birth, appointment records, session notes and their content, intake form responses, messages, feedback responses, invoices and payment status
• Special categories: health data, inherent in session notes, intake responses and the fact of a therapeutic relationship
• Categories of data subject: your clients, and any third parties your clients mention in the material you record

We process Client Data only on your documented instructions, including with regard to transfers to a third country, unless required to do otherwise by law — in which case we will inform you of that legal requirement before processing, unless the law prohibits us from doing so on important grounds of public interest.

Your use of the Services, together with the Terms of Service and this DPA, constitutes your complete documented instructions.

We will not sell Client Data, use it for advertising or marketing, or use it to train artificial intelligence or machine learning models. Our AI sub-processors are contractually prohibited from retaining Client Data beyond the immediate request and from using it for model training.

We will inform you if, in our opinion, an instruction infringes Applicable Data Protection Law.

We ensure that any person authorised to process Client Data is bound by an appropriate statutory or contractual duty of confidentiality, and that access is limited to those personnel who need it to provide or support the Services.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, we implement appropriate technical and organisational measures under Article 32, including:

• Encryption of personal data at rest using AES-256
• Encryption in transit using TLS 1.2 or higher
• Row-level security, so each practitioner account can access only its own data
• Role-based access control and the principle of least privilege for our own personnel
• An optional automatic session timeout, configurable in Privacy & Security settings
• Session audio is not retained on our servers: it is transcribed in memory and discarded. While its transcript is pending, a recording is held only in the practitioner’s own browser, deleted as soon as the transcript is saved to the note, and deleted automatically after 7 days if it was never recovered
• Regular backups, with restoration procedures for availability and resilience

Comprehensive logging of access to personal data is in development and is not yet active. We will update this section when it is live rather than describe it as available in advance.

A SOC 2 Type II audit is underway. We do not hold the certification at the date of this document.

You give general authorisation for our engagement of sub-processors. We impose data protection obligations on each sub-processor that are no less protective than those set out in this DPA, and we remain fully liable to you for their performance.

The sub-processors engaged in providing the Services are:

• Supabase Inc. — Database, authentication and file storage: client records, session notes, session-note images, account data
• Vercel Inc. — Application hosting and delivery
• Anthropic PBC — AI session-note generation: processed under terms prohibiting retention and model training
• Groq, Inc. — AI inference for note generation: same retention and training prohibitions
• Daily.co (Pluot, Inc.) — Telehealth video sessions: media is relayed, not recorded by Grovvve
• Resend, Inc. — Transactional email: appointment reminders, invoices, secure-message notifications
• Stripe, Inc. — Card payments and payouts. No clinical data is transmitted to Stripe
• Paddle.com Market Ltd. — Subscription billing and merchant of record. No clinical data
• Rapyd Financial Network Ltd. — Practitioner payouts in supported regions. No clinical data
• Google LLC — Calendar synchronisation, for practitioners who connect a Google account

We will give you at least 30 days' notice before adding or replacing a sub-processor, during which you may object on reasonable data protection grounds. To receive those notices, or to request the current annex with hosting regions and transfer mechanisms, contact privacy@grovvve.com.

Where providing the Services involves transferring personal data outside the UK or the EEA, that transfer is made under an adequacy decision where one applies, or otherwise under the Standard Contractual Clauses approved by the European Commission together with the UK International Data Transfer Addendum, supplemented by any measures identified as necessary by a transfer risk assessment.

The current list of sub-processors, their hosting regions and the transfer mechanism applicable to each is available on request at privacy@grovvve.com.

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures — insofar as this is possible — in fulfilling your obligation to respond to requests to exercise data subject rights: access, rectification, erasure, restriction, portability and objection.

The Services let you export, correct and delete Client Data directly. Where a request cannot be satisfied through the product, contact us and we will assist.

If a data subject contacts us directly about Client Data, we will not respond substantively; we will refer them to you, as the controller, without undue delay.

We notify you without undue delay after becoming aware of a personal data breach affecting Client Data, so that you can meet your own notification obligations under Articles 33 and 34.

Our notification will describe, to the extent known: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address it and mitigate its effects. Where the information cannot be provided at once, we will provide it in phases without further undue delay.

We also assist you in ensuring compliance with your obligations under Articles 32 to 36, taking into account the nature of processing and the information available to us.

At your choice, we delete or return all Client Data to you at the end of the provision of the Services, and delete existing copies, unless Applicable Data Protection Law requires storage.

You may export your data at any time while your account is active. Following account closure, Client Data is deleted within 30 days, save for records we are required to retain by law and routine backups, which age out on their normal cycle and remain encrypted and access-controlled until they do.

We make available to you all information necessary to demonstrate compliance with the obligations in Article 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In the first instance we will respond to reasonable written information requests. Where an on-site audit is necessary, it will be arranged on reasonable notice, during business hours, no more than once per year unless a regulator requires otherwise or a personal data breach has occurred, and subject to confidentiality.