Be Care Compliant Data Processing Agreement

Version 1.0, draft, subject to legal review

This Data Processing Agreement ("DPA") is between [Company name], company number [Company number], registered office [Registered address], ICO registration number [ICO registration number], trading as Be Care Compliant ("we", the processor), and the customer named in the Order ("you", the controller).

It forms part of the Be Care Compliant Subscription Agreement (the "Agreement") and applies whenever we process personal data on your behalf. Words defined in the Agreement have the same meaning here.

1. Definitions

Data Protection Law: the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025), and any other law relating to personal data that applies to the processing.

Personal Data: personal data within Customer Data that we process on your behalf under the Agreement.

Personal Data Breach, controller, processor, data subject, processing and special category data have the meanings given in the UK GDPR.

Subprocessor: another processor we engage to process Personal Data.

2. Our roles

2.1 You are the controller of the Personal Data and we are your processor.

2.2 We are a controller in our own right only for the limited information we need to run our relationship with you and to keep the Platform secure: the names and contact details of your Company Admin and billing contact, billing details, the record of your acceptance of the Agreement, and the technical logs of our own systems (such as sign in attempts and server logs), which we use only for security, fault finding and preventing misuse. The audit trail inside your Account, of who viewed and changed your Records, is part of your Customer Data and we process it for you. Our privacy notice at becarecompliant.com/privacy explains how we use the information we control.

2.3 Your obligations. As controller, you are responsible for:

(a) having a lawful basis, and a condition for processing special category and criminal offence data, for everything you put into the Platform;

(b) giving your staff, service users and others the privacy information Data Protection Law requires, including that you use the Platform and its Subprocessors;

(c) making sure your instructions to us are lawful;

(d) carrying out any data protection impact assessment you need, including before using the AI and text message features;

(e) for criminal offence data such as DBS check results, having a condition under Schedule 1 of the Data Protection Act 2018, and an appropriate policy document where the condition you rely on requires one. We recommend you record the certificate number, date and outcome rather than uploading copies of DBS certificates, in line with the DBS Code of Practice; and

(f) if you switch on anonymous themes from inspection reports (clause 11.8 of the Agreement), being satisfied that instructing us to take them is lawful for you.

2.4 Your rights. You may give us instructions under clause 3, receive the help described in this DPA, and audit us under clause 13.

2.5 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects are set out in Annex 1.

3. Your instructions

3.1 We process Personal Data only on your documented instructions. Your instructions are: this DPA and the Agreement; the settings, configuration and actions of your users in the Platform; and any other written instructions from your Company Admin that are consistent with the Agreement. These instructions include the transfers of Personal Data described in clause 7 and Annex 3.

3.2 If the law requires us to process Personal Data other than on your instructions, we will tell you before we do so, unless the law prevents us from telling you.

3.3 We will tell you straight away if we believe an instruction breaks Data Protection Law.

4. Confidentiality

Everyone we authorise to access Personal Data is bound by a duty of confidentiality, whether by contract or by law, and has access only to the extent needed for their role.

5. Security

5.1 We implement and maintain the technical and organisational measures in Annex 2, which are designed to give a level of security appropriate to the risk, taking into account that the Personal Data includes health and social care information about service users and staff.

5.2 We may update those measures over time, but we will not reduce the overall level of protection.

6. Subprocessors

6.1 You give us general authorisation to engage Subprocessors. Our current Subprocessors are listed in Annex 3.

6.2 We will tell your Company Admin at least 30 days before we add or replace a Subprocessor, by email and in the Platform. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may end the Agreement before the change takes effect, and we will refund any fees you have paid in advance for the period after it ends.

6.3 We impose, by written contract, data protection terms on each Subprocessor that give at least the same protection as this DPA, and we remain responsible to you for their performance.

7. Transfers outside the United Kingdom

7.1 Your database, including your Records, Checks, Forms and Evidence, and your files are stored in the United Kingdom, in a London data centre region, and the application that serves them runs in London. Some supporting processing, such as our providers' system logs, backups, AI drafting, email and text message delivery, and support access by our providers' staff, may take place outside the United Kingdom, as shown in Annex 3.

7.2 Some Subprocessors process limited Personal Data outside the United Kingdom, as shown in Annex 3. We make those transfers only where Data Protection Law permits it, relying on UK adequacy regulations (including the UK Extension to the EU US Data Privacy Framework) or on the ICO's International Data Transfer Agreement or International Data Transfer Addendum, as stated for each Subprocessor.

8. Helping you with data subjects' rights

8.1 The Platform gives you tools to answer requests from data subjects yourself, including viewing and correcting Records, exporting everything held about a person or a service user as a subject access export, placing and lifting retention holds, and anonymisation.

8.2 If we receive a request, or a complaint, from one of your data subjects about Personal Data, we will pass it to you without undue delay, and in any event within 5 Working Days, sooner where it is plainly urgent, and will not respond to it ourselves unless you ask us to.

8.3 Where the Platform's tools are not enough, we will give you reasonable further help.

9. Personal Data Breaches

9.1 We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting your Personal Data.

9.2 We will tell your Company Admin by email. Our contact for anything about a breach is hello@becarecompliant.com. We will give you the information you reasonably need to meet your own obligations, including notifying the regulator and the people affected. That includes what happened, the categories and approximate number of data subjects and records affected, the likely consequences, and the steps taken or proposed. Where we do not have all of it at first, we will provide it as it becomes available.

9.3 We will take reasonable steps to contain the breach and reduce its effects, and will not notify anyone else about it (other than our own advisers, insurers and law enforcement where required) without your agreement, unless the law requires it.

10. Helping you with your other obligations

We will give you reasonable help, taking into account the nature of the processing and the information available to us, with data protection impact assessments, prior consultation with the UK data protection supervisory authority (currently the Information Commission), notifying the people affected by a Personal Data Breach, and your obligations on security.

11. When the Agreement ends

11.1 When the Agreement ends, your Account becomes read only for 90 days so you can export your Personal Data.

11.2 At your choice, we return the Personal Data to you (through the read only period and full export, or a full export we produce for you on request) and then delete it, or we delete it sooner if you ask in writing. We delete the Personal Data from the Platform within 30 days after the read only period, and instruct our Subprocessors to delete their copies. Some Subprocessors keep limited copies for longer under their own terms, as shown in Annex 3 (for example, content that Anthropic's safety systems flag); those copies stay protected under their contracts with us. Backup copies are overwritten on their normal cycle, and in any case within a further 30 days; until then they are kept secure and are not restored or used for anything except deletion.

11.3 After that we will not keep Personal Data ourselves unless the law requires us to, in which case we will keep it confidential and process it only for that purpose. Copies a Subprocessor keeps for longer under clause 11.2 are held under that Subprocessor's own terms, which we have reviewed and which bind it to keep them confidential and secure; we will tell you which Subprocessor holds any such copies if you ask.

11.4 We will confirm deletion in writing on request.

12. Retention while the Agreement is running

You decide how long Personal Data is kept. The Platform applies the retention period and starting event you set for each type of record in Settings, Data retention, including automatic anonymisation of records when their retention period ends and the holds you place to stop that happening.

13. Audits

13.1 We will make available to you the information reasonably needed to demonstrate compliance with this DPA and Article 28 of the UK GDPR.

13.2 If that information is not enough, you (or an independent auditor you appoint who is bound by confidentiality) may audit our compliance once in any twelve months, on at least 30 days' notice, between 9am and 5pm on a Working Day, at your own cost, and in a way that does not expose other customers' data. The limit of once a year and the notice period do not apply after a Personal Data Breach, where a regulator requires it, or where you have reasonable grounds to believe we are not complying with this DPA. In those cases we will not unreasonably delay or refuse an audit at shorter notice.

13.3 Our Subprocessors' own certifications and audit reports may be used to demonstrate their compliance.

14. Liability

Each party's liability under this DPA is subject to the limits in clause 14 of the Agreement, including the separate higher limit for data protection claims.

15. Changes in the law

If Data Protection Law changes in a way that affects this DPA, we may update it to keep it compliant, and clause 19 of the Agreement applies.

Annex 1: Details of the processing

Subject matter. Providing the Be Care Compliant compliance platform to you under the Agreement.

Duration. For the length of the Agreement, then the read only and deletion periods in clause 11.

Nature of the processing. Collection through Forms and uploads, storage, organisation, retrieval, display, scheduling of Checks, calculation of compliance status, generation of reports, PDF and CSV exports, sending of emails and text messages, AI drafting where you use it, taking anonymous themes from inspection reports if you switch that on, backups, anonymisation and deletion.

Purpose. To let you record, schedule, evidence and report on the compliance of your staff and the care you provide, for your own regulatory, contractual, employment and quality purposes; and, only if you switch it on, to produce anonymous themes from your inspection reports under clause 11.8 of the Agreement.

Categories of data subjects.

(a) Your staff, including applicants you choose to hold, employees, workers, agency staff and leavers (People).

(b) The people you provide care to (Service Users), and their relatives, representatives and advocates.

(c) Your users of the Platform.

(d) People who contact you through the Platform's public forms, such as complaints and whistleblowing reports.

(e) Other people named in Records, such as professionals involved in someone's care.

Types of Personal Data.

(a) Identity and contact details: names, addresses, phone numbers, email addresses, job roles, next of kin.

(b) Employment and compliance records: supervisions, appraisals, spot checks, competency assessments, training records and certificates, probation reviews, right to work checks, driving documents, holiday, absence and return to work records including the employee's own answers and any fit note they upload, absence meeting records and outcome letters, signatures, and letters.

(c) Care records: care plan reviews, risk assessments, medication audits, consent reviews, quality visits, feedback, financial audits, outcomes, incidents and complaints.

(d) Files you upload, including photographs and scanned documents.

(e) Technical data held in your Account: login times, IP addresses, device and browser details as recorded in your audit trail, and the audit trail of access to and changes in Records.

Special category and criminal offence data.

(a) Health data about service users and staff, including care needs, medication, reasons for absence and fit notes.

(b) Any other special category data you choose to record.

(c) Information about criminal convictions and offences, such as DBS certificate details and outcomes.

Annex 2: Security measures

Where your data lives. Your database and files are stored in the United Kingdom (London), and the application runs in London. Annex 3 shows the supporting processing that takes place elsewhere.

Encryption. Connections to the Platform are encrypted in transit using TLS. Data is encrypted at rest by our hosting providers. Access keys to accounts you connect, such as your Microsoft 365 or Google account, are encrypted with a separate key held only on our servers, are never sent to the browser, and are deleted when you disconnect.

Separation between companies. Each company's data is separated inside the database by row level security rules, not only by the application. They are designed to prevent one company reaching another's data, including where the application makes a mistake. We test this separation whenever we change the rules that enforce it.

Role based access. Each user has one role, such as Company Admin, Responsible Individual, Registered Manager, Branch Manager, Supervisor, Senior, On Call or Viewer, which decides which Branches, Records and features they can reach. Team Members (carer logins) see only their own portal, their own tasks and what has been assigned to them. These limits are enforced in the database as well as on screen.

Accounts and sign in. Accounts are invite only; there is no public sign up. Company Admins and our founder sign in with two factor authentication. A login can be signed in on one computer and one phone at a time, and signing in on another device of the same kind ends the earlier session, to discourage logins being shared.

Files. Files and completed Evidence are held in private storage that is not publicly accessible, and are released only through links that expire after five minutes. Downloads are recorded.

Audit trail. Access to and changes in Records are written to an audit trail that users cannot edit.

Evidence integrity. Submitted Evidence cannot be altered. It records who completed it, when, and which version of the Form was used.

Retention. The retention periods you set are applied automatically each night, including anonymisation of records whose retention period has ended, with holds respected.

Our own access. Only our founder has platform administrator access. Support access to your Account is time limited, clearly shown on screen while in use, and every action taken is recorded in the audit trail against our name. Secret keys are held only on our servers, never in the browser.

Integrations. Payment and message webhooks are verified by signature, and scheduled jobs are protected by secrets and refuse to run without them.

Testing and updates. We regularly monitor security advisories for our providers and the software we depend on, and apply fixes in a timescale that matches the risk. We review our database security checks after every change to the database, and test access controls whenever we change them.

Backups and recovery. There are two kinds of backup. First, our database provider takes regular backups of the database as part of its managed service; it does not guarantee where those backups are held (see Annex 3). Second, we make our own copy of uploaded files and stored Evidence documents each night, to separate private storage with the same provider in its London region in the United Kingdom. We test restoring both the database and files at least once a year and keep a record of each test.

Incidents. We follow a written incident procedure: contain the incident, assess what personal data is affected, tell you under clause 9, record what happened and review what we change as a result.

People. Anyone we allow to access Personal Data is bound by confidentiality and given only the access their role requires.

Annex 3: Subprocessors

Payments. Stripe takes your payments. It receives only your billing contact's details and your payment details, never Customer Data. It processes them for us and, for its own fraud prevention and legal duties, as a controller, so it is not a Subprocessor of Customer Data.

Services you connect. If you connect your own Microsoft 365 or Google account to the Platform, for example to copy documents to your cloud drive or to send invoices from your own mailbox, that provider acts for you under your own agreement with it, not as our Subprocessor. We send it only what the feature needs, on your instruction, and you can disconnect it at any time.