Data Processing Agreement

Caredact — operated by PixelArc Ventures LTD

Last updated: 28 September 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Controller", "Customer") and PixelArc Ventures LTD ("Processor", "we", "us"), company number 16305788, registered at 510 Burnley Road East, Rossendale, England, BB4 9LB.

This DPA is entered into pursuant to Article 28 of the UK General Data Protection Regulation ("UK GDPR") and sets out the terms on which we process personal data on your behalf when you use the Caredact platform ("Service").

By using the Service, you accept this DPA. If you are using the Service on behalf of an organisation, you confirm that you have authority to bind that organisation to this DPA.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined in UK GDPR Article 4(1).
• "Processing" means any operation performed on Personal Data, as defined in UK GDPR Article 4(2).
• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
• "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• "Supervisory Authority" means the Information Commissioner's Office (ICO).

2. Scope and purpose of processing

The Processor shall process Personal Data solely for the purpose of providing the Service, which includes:

• Detecting and identifying personal data within documents uploaded by the Controller's users
• Replacing detected personal data with typed placeholders (e.g. [PERSON_1], [NHS_NUMBER_1])
• Storing encrypted mappings between placeholders and original personal data
• Restoring original personal data to completed documents upon export
• Checking anonymised visit notes for defensible recording and reporting the results to the Controller's administrators (Note checks)
• Maintaining audit trails of processing activities

The Processor shall not process Personal Data for any purpose other than as set out in this DPA and the Controller's documented instructions.

3. Types of personal data

The following categories of Personal Data may be processed through the Service:

• Full names
• NHS numbers
• Dates of birth
• Addresses and postcodes
• Phone numbers
• Email addresses
• Medical and care information (conditions, medications, treatments, diagnoses)
• National Insurance numbers
• Unique Reference Numbers (Ofsted URNs, LAC references)
• School and education details
• Names of carers and client references supplied by the Controller alongside visit notes uploaded for Note checks
• Any other personal data contained in documents uploaded by the Controller's users

4. Categories of data subjects

Personal Data processed through the Service may relate to:

• Service users and residents in care settings
• Patients
• Children in care (looked-after children)
• Family members, parents and guardians
• Staff and employees of the Controller
• Other individuals referenced in care documentation

5. Processor obligations

5.1 Processing on instructions

Process Personal Data only on the documented instructions of the Controller, including with regard to transfers of Personal Data outside the United Kingdom, unless required to do so by law. The Processor shall inform the Controller if, in its opinion, an instruction infringes UK GDPR or other data protection provisions.

5.2 Confidentiality

Ensure that all persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.3 Security measures

Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex A of this DPA.

5.4 Sub-processors

Not engage another processor (sub-processor) without prior written authorisation of the Controller. The current list of approved sub-processors is set out in Annex B. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object to such changes. Where a sub-processor is engaged, the Processor shall impose the same data protection obligations as set out in this DPA by way of a contract.

5.5 Data subject rights

Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the Data Subject's rights under Chapter III of UK GDPR, including:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)

5.6 Breach notification

Notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Data Breach. Such notification shall:

• Describe the nature of the Data Breach, including where possible the categories and approximate number of Data Subjects and Personal Data records concerned
• Communicate the name and contact details of the data protection point of contact
• Describe the likely consequences of the Data Breach
• Describe the measures taken or proposed to address the Data Breach, including measures to mitigate its possible adverse effects

5.7 Assistance with compliance

Assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of UK GDPR, taking into account the nature of processing and the information available to the Processor. This includes assistance with:

• Security of processing (Article 32)
• Notification of a Data Breach to the Supervisory Authority (Article 33)
• Communication of a Data Breach to the Data Subject (Article 34)
• Data protection impact assessments (Article 35)
• Prior consultation with the Supervisory Authority (Article 36)

5.8 Deletion and return

At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of the Service, and delete existing copies unless applicable law requires storage of the Personal Data. Specifically:

• PII mappings are permanently deleted when a document is marked as complete, or automatically at the end of the Controller's configured retention period
• Anonymised document text and AI conversations, which contain placeholders in place of the Personal Data detected and reviewed, are retained in the Controller's account until account termination or until the Controller asks for them to be deleted
• The encrypted link between placeholders and original details for Note check uploads is permanently deleted at the end of the Controller's configured retention period; the uploads themselves, comprising anonymised note text, the carer names and client references supplied by the Controller, and the results, are deleted when the Controller deletes the upload, on account termination, or on request
• Upon account termination, all Personal Data associated with the Controller's organisation is deleted
• Audit logs are retained for the period specified in our Privacy Notice for regulatory compliance purposes

5.9 Audit

Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of UK GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes UK GDPR or other data protection provisions.

6. Controller obligations

The Controller shall:

• Ensure it has a lawful basis for processing the Personal Data
• Provide appropriate privacy notices to Data Subjects whose data is processed through the Service
• Ensure that Personal Data provided to the Processor is accurate and necessary for the stated purpose
• Comply with its own obligations under UK GDPR as a data controller
• Not instruct the Processor to process Personal Data in a manner that would violate UK GDPR

7. International transfers

All processing of Personal Data — including AI inference — takes place exclusively within the United Kingdom. AI writing assistance uses Azure OpenAI Service deployed in Microsoft Azure UK South region, authenticated by managed identity (no static API keys), with prompts and completions kept within the UK Data Boundary.

Billing data (email address, organisation name, subscription status) is shared with Stripe, which operates under the EU-US Data Privacy Framework and UK Extension. This transfer is made pursuant to UK GDPR Article 46 adequate safeguards.

8. Term and termination

This DPA shall remain in effect for as long as the Processor processes Personal Data on behalf of the Controller. It shall automatically terminate when the Controller's use of the Service ends.

Upon termination, the Processor shall comply with the deletion obligations set out in Section 5.8.

The obligations of the Processor under this DPA shall survive termination to the extent necessary to complete the deletion of Personal Data and to comply with applicable law.

9. Liability

The liability of each party under this DPA shall be subject to the limitations and exclusions of liability set out in the Terms of Service.

10. Governing law

This DPA shall be governed by and construed in accordance with the laws of England and Wales. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

11. Contact

For questions about this DPA, contact us at:

• Email: hello@caredact.com
• Address: 510 Burnley Road East, Rossendale, England, BB4 9LB
• ICO registration number: ZB962251

Annex A — Technical and organisational security measures

The Processor implements the following measures to protect Personal Data:

Encryption

• In transit: All data transmitted between users and the Service is encrypted using TLS 1.2 or higher
• At rest: All databases and storage are encrypted at the platform level using AES-256
• PII mappings: An additional layer of AES encryption (Fernet) is applied to PII mapping data before storage, using a dedicated encryption key

Authentication and access control

• Password hashing: User passwords are hashed using bcrypt with appropriate work factor
• Two-factor authentication: TOTP-based two-factor authentication is available for all users and can be enforced by organisation administrators
• Recovery codes: Bcrypt-hashed single-use recovery codes for account recovery
• Session management: JWT tokens with Redis-backed invalidation on logout
• Rate limiting: Login attempts are rate-limited to 5 per email address per 15-minute window
• Organisation isolation: All data queries are scoped to the user's organisation; cross-organisation data access is not possible

Infrastructure

• Hosting: All primary infrastructure hosted in Microsoft Azure UK South (uksouth); transactional email infrastructure hosted in AWS Simple Email Service (eu-west-2 / London region). All processing takes place within the United Kingdom.
• Network architecture: Front Door Premium with Web Application Firewall in front; Private Link from Front Door to the storage account (no public network access to origin); Container Apps backend; Postgres Flexible Server and Redis Cache running on the platform's private network with no public endpoints.
• Database: Encrypted at rest with automated backups; no public internet access.

Monitoring and audit

• Audit trail: All user actions (document creation, PII detection, exports, login events, administrative changes) are logged with timestamps and user identification
• Application monitoring: Sentry error tracking (no PII transmitted)
• Infrastructure monitoring: Azure Monitor and Application Insights for CPU, memory, storage, HTTP errors, and latency
• Uptime monitoring: External health checks every 60 seconds

Data minimisation

• Anonymisation before AI processing: Personal data is detected automatically and reviewed by the user, and each detected item is replaced with a typed placeholder before any text is sent to the AI provider
• Deletion on completion: PII mappings are permanently deleted when a document is marked complete or reaches the end of its retention period
• Configurable retention: Organisation administrators can set document retention periods (default 30 days, maximum 90 days)

Annex B — Approved sub-processors

The Controller is deemed to have authorised the sub-processors listed above by accepting this DPA. The Processor shall notify the Controller of any changes to this list by updating this page and, where material, by email notification.