Data processing
agreement.

This is our standard data processing agreement for customers, in the version dated 30 July 2026. Details in square brackets are completed for each customer. To set one up for your organisation, email hello@aijo.uk.

1. Parties and background

This Agreement is dated [date] and made between:

• [Client legal name], a [company / charity / partnership] registered in [England and Wales] under number [number], whose registered office is at [address] (the Controller); and
• Halo Integrated Care Solutions Ltd (trading as AIJO), a company registered in England and Wales under number 16859502, whose registered office is at Unit 29 Highcroft Industrial Estate, Enterprise Road, Horndean, Waterlooville PO8 0BT, and registered with the Information Commissioner under reference ZC209020 (the Processor).

Background

• The Controller provides regulated care services and has engaged the Processor to provide the aijo care platform under [the Master Services Agreement / Order Form] dated [date] (the Main Agreement).
• In providing the platform, the Processor will process personal data on behalf of the Controller, including special category data about the people the Controller supports.
• The parties enter into this Agreement to meet the requirements of Article 28 of the UK GDPR and to set out their respective obligations.

2. Definitions and interpretation

2.1 In this Agreement:

• Data Protection Legislation means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any other law relating to personal data that applies to either party, each as amended or replaced from time to time (including by the Data (Use and Access) Act 2025).
• UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.
• Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Special Category Data have the meanings given in the Data Protection Legislation.
• Client Personal Data means Personal Data processed by the Processor on behalf of the Controller under the Main Agreement, as described in Schedule 1.
• Commissioner means the Information Commissioner's Office (ICO).
• Services means the aijo care platform and related support services provided under the Main Agreement.
• Sub-processor means any third party engaged by the Processor that processes Client Personal Data.
• Business Day means a day other than a Saturday, Sunday or public holiday in England.

2.2 If this Agreement conflicts with the Main Agreement on data protection, this Agreement prevails. Nothing in this Agreement reduces either party's obligations under the Data Protection Legislation.

3. Roles and scope

3.1 The Controller is the controller and the Processor is the processor of Client Personal Data. The subject matter, duration, nature, purpose, types of data and categories of data subject are set out in Schedule 1.

3.2 The Processor will process Client Personal Data only on the Controller's documented instructions, including on transfers outside the UK. The Main Agreement, this Agreement and the Controller's use and configuration of the Services are the Controller's complete instructions at the date of this Agreement. Further instructions must be in writing.

3.3 The Processor may process Client Personal Data other than on instructions only where UK law requires it. In that case it will tell the Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

3.4 The Controller is responsible for:

• having a lawful basis under Article 6, and a condition under Article 9, for all processing it instructs (for health and social care, typically Article 9(2)(h) with Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018);
• giving privacy information to people it supports, their representatives and its staff;
• the accuracy of the data it enters, and deciding who in its organisation has access and at what role;
• meeting its own duties under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, including record keeping under Regulation 17.

3.5 The Processor may use aggregated data that does not identify any individual or the Controller to operate, secure and improve the Services. It will not use Client Personal Data for its own purposes, sell it, or use it to train general-purpose AI models.

4. Processor obligations

4.1 The Processor will:

• process Client Personal Data only as set out in clause 3;
• tell the Controller promptly if, in its opinion, an instruction infringes the Data Protection Legislation, and may suspend that instruction until it is confirmed or changed;
• ensure everyone it authorises to process Client Personal Data is bound by a duty of confidentiality, has had data protection and information governance training, and has access only as far as their role needs;
• vet staff with access to production data, including a basic DBS check, and remove their access promptly when they leave or change role;
• keep a record of processing activities carried out for the Controller as required by Article 30(2) UK GDPR;
• not access Client Personal Data in the live service except to provide the Services, to give support the Controller has asked for, to keep the Services secure, or where the law requires it, and log that access;
• not copy Client Personal Data into non-production environments, source code repositories, tickets or test fixtures, and use synthetic data for testing;
• make available to the Controller all information needed to demonstrate compliance with Article 28 UK GDPR.

5. Security

5.1 The Processor will implement and maintain the technical and organisational measures in Schedule 2, which are designed to give a level of security appropriate to the risk, as required by Article 32 UK GDPR. It will take particular account of the sensitivity of health and care data about vulnerable adults and children.

5.2 The Processor will register for the NHS Data Security and Protection Toolkit (DSPT) and publish an assessment at "Standards Met" or higher by [date]. It will then keep that standard each year, and share its published status with the Controller on request.

5.3 The Processor may update the measures in Schedule 2 as technology and threats change, provided the overall level of security is not reduced.

6. Sub-processors

6.1 The Controller gives general written authorisation for the Processor to use the Sub-processors listed in Schedule 3.

6.2 The Processor will give the Controller at least 30 days' written notice before adding or replacing a Sub-processor, stating its name, location and what it will process. The Controller may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If it cannot be resolved, the Controller may terminate the affected Services without penalty and receive a pro-rata refund of prepaid fees.

6.3 The Processor will put in place a written contract with each Sub-processor that imposes data protection obligations no less protective than those in this Agreement.

6.4 The Processor remains fully liable to the Controller for the performance of each Sub-processor's obligations.

7. International transfers

7.1 The Processor will host and store Client Personal Data in data centres in the United Kingdom.

7.2 The Processor will not transfer Client Personal Data outside the UK, or allow a Sub-processor to do so, unless:

• the Sub-processor and its location are listed in Schedule 3 or approved under clause 6.2; and
• the transfer is to a country covered by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified), or is protected by the ICO's International Data Transfer Agreement or International Data Transfer Addendum, supported by a transfer risk assessment.

7.3 Remote support access from outside the UK counts as a transfer and is subject to clause 7.2.

8. Data subject rights

8.1 Taking into account the nature of the processing, the Processor will help the Controller, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights, including access, rectification, erasure, restriction, portability and objection.

8.2 If the Processor receives a request directly, it will pass it to the Controller within 2 Business Days and will not respond except to acknowledge it and redirect the requester, unless the Controller instructs otherwise.

8.3 The Services allow the Controller to search, export and correct the records it holds about an individual. Where a request needs more than those tools provide, the Processor will give reasonable further help within 5 Business Days of the Controller asking, so the Controller can meet the one-month statutory deadline.

9. Personal data breaches

9.1 The Processor will notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a Personal Data Breach affecting Client Personal Data. This gives the Controller time to meet its 72-hour duty to report to the Commissioner and, where relevant, through the DSPT.

9.2 The notice will include, as far as then known:

• the nature of the breach, the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures taken or proposed to contain it and reduce its effects;
• a named contact at the Processor.

Information not available at first may be given in phases without further undue delay.

9.3 The Processor will investigate, contain and remediate the breach, preserve evidence, and cooperate with the Controller's own investigation. It will not notify the Commissioner, the CQC, data subjects or any third party about a breach of Client Personal Data without the Controller's agreement, unless the law requires it.

9.4 Notifying a breach is not an admission of fault or liability.

10. DPIAs and regulators

10.1 The Processor will give reasonable help to the Controller with data protection impact assessments and any prior consultation with the Commissioner, taking into account the nature of the processing and the information available to it. It will keep an up-to-date DPIA support pack for the Services, including a description of data flows and hosting, and supply it on request.

10.2 The Processor will cooperate with the Commissioner, and give reasonable help to the Controller in responding to the Care Quality Commission or other regulators, about Client Personal Data.

11. Audits and information

11.1 The Processor will allow for and contribute to audits, including inspections, by the Controller or an independent auditor it appoints who is bound by confidentiality.

11.2 The Processor may first meet an audit request by providing current certifications, its DSPT status, penetration test summaries and completed security questionnaires. An on-site or remote audit may then be carried out where those do not reasonably answer the Controller's concerns, following a breach, or where a regulator requires it.

11.3 Audits will be on at least 30 days' notice (or shorter where following a breach or regulator request), no more than once a year except in those cases, during business hours, and in a way that does not compromise other customers' data or the security of the Services. Each party bears its own costs unless the audit shows material non-compliance by the Processor.

12. Return and deletion

12.1 Care records must usually be kept for a set period after care ends (see the NHS England Records Management Code of Practice). That retention duty sits with the Controller. The Processor will not delete Client Personal Data early on its own initiative while the Main Agreement is in force.

12.2 On termination or expiry of the Main Agreement, the Controller may within 30 days ask the Processor to export all Client Personal Data in a structured, commonly used, machine-readable format (such as CSV and PDF), together with attached documents. The Processor will provide the export within 30 days of the request.

12.3 After that export, or 60 days after termination if none is requested, the Processor will securely delete Client Personal Data from the live Services, and from backups as they expire, within a further [7] days. It will confirm deletion in writing on request.

12.4 The Processor may keep Client Personal Data only where UK law requires it. It will then keep it secure, confidential and processed only for that purpose, and delete it when the requirement ends.

13. Liability, term and general

13.1 Each party's liability under this Agreement is subject to the limitations and exclusions in the Main Agreement, except that [the Processor's aggregate liability for breach of this Agreement or the Data Protection Legislation is capped at [£ amount / [x] times annual fees]]. Nothing limits liability that cannot be limited by law, or either party's liability to data subjects under Article 82 UK GDPR.

13.2 This Agreement starts on the date above and continues for as long as the Processor processes Client Personal Data. Clauses 9, 12 and 13 survive termination.

13.3 The Processor will maintain cyber and professional indemnity insurance of at least [£ amount] per claim.

13.4 If the Data Protection Legislation changes, the parties will agree in good faith any amendments needed to keep this Agreement compliant. Otherwise, changes must be in writing and signed by both parties.

13.5 This Agreement and any dispute arising from it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule 1: Particulars of processing

Schedule 2: Technical and organisational measures

Schedule 3: Approved sub-processors