Data processing agreement

1. Parties and scope

This agreement is between the business identified in the accepted order (the controller) and Epione Trading Ltd, company number 17173162, operating B-MO (the processor). It applies to personal data processed on the controller’s behalf and forms part of the service agreement when expressly accepted with a completed processing schedule.

The controller decides the lawful purposes of its customer programme and remains responsible for notices, lawful bases, accuracy and appropriate instructions. B-MO’s own billing and business-contact records are covered separately by the privacy and data policy. This agreement does not transfer the controller’s responsibilities to B-MO or remove either party’s direct legal obligations.

2. Processing schedule

The order must identify the controller and contact, enabled services, subject matter, processing purposes and duration, data categories, people affected, authorised suppliers and countries, security measures, and return/deletion arrangements including backups. It must also record the controller’s instructions and rights. No incomplete schedule is treated as approval to start a new integration.

• Normal purpose: issuing and updating supported wallet cards, administering staff access, recording permitted activity and communicating authorised service or marketing messages.
• People: customers, members, staff and, only for an agreed Recall Pass setup, patients and relevant practice contacts.
• Data: identity and contact information, optional birthday data, card and device identifiers, balances, rewards, visits, preferences, consent and suppression records, staff access information, and agreed appointment details.
• Operations: collection from authorised sources, storage, retrieval, updates, permitted transmission to service providers, export and deletion.
• Duration: the agreed service period and the explicitly agreed return/deletion phase, subject to legal retention duties.

Appointment data may reveal health information even without clinical notes. The controller must assess the specific use, identify any required special-category condition and complete a risk assessment before activation. Clinical records, payment-card security codes and other information outside the agreed schedule must not be supplied.

3. Instructions and confidentiality

B-MO will process personal data only on documented controller instructions, including for transfers, unless applicable law requires otherwise. Where legally permitted, B-MO will inform the controller of that legal requirement before processing. B-MO will promptly flag an instruction it believes infringes applicable data-protection law and seek a lawful resolution.

People authorised to handle the data must be bound by confidentiality and given access only as needed for their role. Customer records must not be sold, shared with another client for that client’s use, or used for B-MO’s own unrelated marketing. AI use, if any, must be identified in the processing schedule; it is not blanket permission to send customer records to an AI provider.

4. Security measures

B-MO will implement appropriate technical and organisational measures for the agreed risk, taking account of the nature of the data and applicable law. The completed security schedule must describe access management, business-data separation, encrypted transport, secret management, updates, logging, backup and restoration arrangements, incident response and deletion controls.

Evidence of these measures must be reviewed for the actual deployment. This agreement does not assert a security certification, guarantee that every configuration has been audited, or establish that backups have been tested.

5. Suppliers and international transfers

The controller’s prior written specific or general authorisation is required for sub-processors. Under general authorisation, B-MO will notify the controller of intended additions or replacements sufficiently in advance to allow a reasonable opportunity to object. The agreed notice period belongs in the processing schedule. If a reasonable objection cannot be resolved, the affected processing will not proceed without an agreed lawful arrangement.

Sub-processors must be bound by written obligations providing equivalent protection for the relevant processing. B-MO remains responsible to the controller for its sub-processors’ performance of those obligations.

The platform’s potential providers include Vercel (hosting), Supabase (database and authentication), Resend (email), Apple and Google (wallet services), Anthropic (optional AI tools), and the controller’s selected booking provider. Stripe handles B-MO subscription payments under its applicable roles and terms. The actual legal entities, roles, data, countries and contracts must be identified for each deployment; this list alone is not sub-processor authorisation.

Transfers must follow documented instructions and applicable legal requirements, using a valid transfer mechanism and any necessary assessment or supplementary safeguards. A European delivery location is not a promise that all storage, support, backups and onward processing stay in the EU.

6. Rights, incidents and assessments

Taking account of the processing, B-MO will assist the controller with requests for access, correction, erasure, restriction, portability and objections. A request received directly will be passed to the controller unless law requires a different response. Assistance must not disclose another business’s records.

B-MO will notify the controller without undue delay after becoming aware of a personal-data breach affecting its data, provide available information about its nature, likely consequences and mitigation, and supply updates as further information becomes known. B-MO will not wait for a complete investigation before notifying.

B-MO will assist with security duties, regulatory and individual breach notifications, data-protection impact assessments and prior consultation, taking account of the nature of processing and information available. Each party remains responsible for notifications the law places on it.

7. Return and deletion

At the controller’s choice, B-MO will return or delete personal data at the end of the processing service and delete existing copies, unless law requires retention. The completed schedule must specify the export format, timetable, active-system deletion, backup expiry and the handling of restored backups. It must also identify any minimal records retained for a lawful purpose, such as honouring marketing suppression or accounting obligations.

Any legally retained information must be protected and used only for that requirement. The controller can request confirmation of completion. A wallet provider’s independent retention and copies on a person’s device must be explained separately rather than described as instantly deleted by B-MO.

8. Evidence, audits and precedence

B-MO will make available information necessary to demonstrate compliance with these processor obligations and allow and contribute to audits, including inspections, by the controller or its mandated auditor. The parties may agree reasonable practical arrangements without preventing legally required scrutiny or urgent investigation.

This agreement takes precedence over conflicting general service terms on processing instructions and data-protection duties. Contact sales@bmopass.com to complete the service schedule and obtain the agreed version. Publication of these terms or a privacy notice does not substitute for accepting the required agreement with a completed processing schedule.