Data Processing Agreement

MedFlow AI Limited · Last updated 6 August 2026

This Data Processing Agreement ("DPA") forms part of the agreement between MedFlow AI Limited, a company registered in England and Wales (company number 17250952) ("MedFlow", "the Processor") and the clinic or business using the MedFlow service ("the Clinic", "the Controller"), and applies whenever MedFlow processes personal data on the Clinic's behalf in providing the Service.

1. Roles and scope

The Clinic is the controller and MedFlow is the processor of Patient Data processed through the Service. "Patient Data" means personal data of the Clinic's patients and enquirers handled by the Service, as described in Annex 1. MedFlow acts as an independent controller only for the Clinic's own account data, which is covered by the Privacy Policy and not this DPA.

2. Processor obligations

MedFlow will:

• process Patient Data only on the Clinic's documented instructions, which are: to operate the Service as configured by the Clinic (responding to enquiries, managing bookings, generating payment links, alerting Clinic staff), unless required to do otherwise by law, in which case MedFlow will inform the Clinic unless prohibited;
• ensure persons authorised to process Patient Data are bound by confidentiality;
• implement appropriate technical and organisational measures as described in Annex 2;
• engage sub-processors only as set out in clause 4;
• assist the Clinic, taking into account the nature of the processing, in responding to data subject rights requests and in meeting its obligations regarding security, breach notification, and data protection impact assessments;
• notify the Clinic of a personal data breach affecting Patient Data without undue delay and in any event within 72 hours of becoming aware;
• at the Clinic's choice, delete or return Patient Data at the end of the Service, and delete remaining copies unless law requires retention;
• make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits by the Clinic or its appointed auditor on reasonable notice, no more than once per year unless required by a supervisory authority.

3. Controller obligations

The Clinic warrants that it has a lawful basis for the processing, that it has provided any notices and obtained any consents required for patients to be served by the Service, and that its instructions comply with applicable law.

4. Sub-processors

The Clinic authorises the sub-processors listed in Annex 3. MedFlow will notify the Clinic of intended changes at least 14 days before a new sub-processor processes Patient Data, giving the Clinic the opportunity to object on reasonable data protection grounds. MedFlow imposes data protection obligations on sub-processors equivalent to those in this DPA and remains liable for their performance.

5. International transfers

Where processing involves a transfer of Patient Data outside the UK, MedFlow ensures an appropriate safeguard is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another mechanism valid under UK GDPR.

6. Liability and term

Liability under this DPA is subject to the limitations of liability in the Terms of Service. This DPA applies for as long as MedFlow processes Patient Data on the Clinic's behalf.

Annex 1 — Processing details

Subject matter	Operation of an AI receptionist service for the Clinic
Duration	The term of the Clinic's subscription
Nature and purpose	Receiving and responding to patient enquiries; providing pricing information; checking availability; creating and managing bookings; generating deposit payment links; escalating conversations to Clinic staff
Categories of data subjects	The Clinic's patients and prospective patients who contact it via connected messaging channels
Categories of personal data	Name, phone number or messaging handle, message content, appointment details (procedure, date, time), payment status. Message content may include health information volunteered by the patient (special category data)

Annex 2 — Security measures

• Encryption of data in transit (TLS)
• Role-based access control; authentication required for all Clinic-facing and administrative access; tenant isolation enforced at the database layer
• Cryptographic signature verification of inbound messaging webhooks
• Payment processing through the Clinic's own payment provider; MedFlow does not store card details
• Hosting on established cloud infrastructure with managed backups and point-in-time recovery
• Logging of administrative access to Clinic data

Annex 3 — Authorised sub-processors

Sub-processor	Purpose	Location
Vercel Inc.	Application hosting	USA/EU
Supabase Inc.	Database and authentication	EU
Anthropic PBC	AI response generation	USA
Meta Platforms, Inc.	WhatsApp and Instagram message delivery	USA/EU
Google LLC	Calendar integration	USA/EU
Stripe, Inc.	Payment link processing (via the Clinic's own Stripe account)	USA/EU

Contact

MedFlow AI Limited, company number 17250952 · support@medflowai.io