Roles
Your organisation is the controller. Saphe Tech is the processor. We process personal data only on your documented instructions, and never for our own purposes.
Scope of processing
- Subject matter: hosting and management of allergy, dietary, healthcare plan, medication and training records.
- Duration: for as long as your organisation holds an active account, plus the agreed deletion window.
- Data subjects: children and other individuals in your care, their parents and carers, and your staff.
- Data types: contact details, dietary requirements, allergy and intolerance information, healthcare plan documents, medication details, training records.
Our commitments
- Confidentiality obligations on every person who can access your data.
- Appropriate technical and organisational measures, including encryption, access control and audit logging.
- No new sub-processor without prior notice and your right to object.
- Assistance with data subject requests, DPIAs and regulator engagement.
- Breach notification to you without undue delay and within 24 hours of becoming aware.
- Deletion or return of your data on termination, and confirmation once done.
- Your right to audit our compliance, on reasonable notice.
Your commitments
- Establish a lawful basis and an Article 9 condition before entering health data.
- Provide transparency information to the people in your records.
- Keep access lists current and remove leavers promptly.
- Set and apply retention periods appropriate to your setting.
Getting the full agreement
The full Data Processing Agreement is presented for review and acceptance during organisation onboarding, and a countersigned copy stays available in your organisation settings. Request a copy in advance from privacy@saphetech.com.