Legal

Data Processing Agreement

Last updated: November 2026  ·  Effective: March 2026

This Data Processing Agreement ("DPA") is between:

• Sanctum Technologies Ltd ("Processor" or "Sanctum"), a company registered in England and Wales (company number 17136722)
• You, the practitioner or practice using the Sanctum platform ("Controller")

It governs how Sanctum processes personal data on your behalf when you use the Service, and sets out the obligations of each party under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Your role and our role

When you use Sanctum to manage patient communications:

• You are the Data Controller - you decide what patient data is collected and why.
• We are the Data Processor - we process patient data only on your documented instructions, as described in this DPA.

You are responsible for ensuring you have a lawful basis to process your patients' data and for informing them appropriately. We are responsible for processing that data securely and in accordance with your instructions.

2. What data we process on your behalf

Category	Examples
Identity data	Patient names
Contact data	Email addresses, phone numbers
Appointment data	Dates, times, appointment types
Communication data	Email and SMS message content
Health data (special category)	Symptoms, diagnoses, treatment notes, consultation records
Survey data	Patient satisfaction ratings and free-text responses

3. How we process your data

We process patient data only:

• To provide the Sanctum platform to you as contracted
• On your documented instructions (as set out in these Terms and the Service configuration you control)
• As required by applicable law (we will notify you where required before processing)

We will never use your patient data to train, fine-tune, or improve any AI model, including the Claude models used within the Service. This is a contractual commitment, not just a policy statement.

4. Security measures

We maintain the following technical and organisational measures to protect patient data:

• Column-level encryption - health notes, consultation records, and credentials encrypted with Fernet (AES-128 with HMAC-SHA256)
• Per-practice encryption keys - managed via AWS KMS, so your data is cryptographically isolated from all other accounts
• Row-level security (RLS) - enforced at database level; each practice's data is inaccessible to other practices at the query layer
• Access inside a practice - inside a practice, a practitioner's full patient records and clinical notes are limited to their own patients and the practice owner. Other team members see only name, contact details, allergies and medications, and a colleague's calendar shows only times
• Encryption in transit - TLS 1.2+ for all data movement
• Encryption at rest - all database storage encrypted
• Audit logging - append-only log of patient record views, document downloads, exports, patient deletions and administrator access to practice accounts
• Short-lived authentication - JWT access tokens expire every 24 hours; refresh tokens rotate every 30 days

5. AI processing and anonymisation

The Service uses Claude (developed by Anthropic, PBC) to classify messages and generate draft responses. Claude is run for us by Amazon Web Services through Amazon Bedrock, in AWS's EU regions only (EU-only inference). Before any content reaches the model, we apply a technical anonymisation layer that removes patient names and contact details from the content.

This processing is covered by the AWS Data Processing Addendum. Content does not leave the EU and is not shared with Anthropic, so no international transfer arises for AI processing.

6. International transfers

Some of our sub-processors are based in the United States. The United States does not have a blanket adequacy decision from the UK - meaning UK law does not automatically recognise US data protection as equivalent.

How we make these transfers lawful: the UK IDTA

For each US-based sub-processor (Twilio, Stripe), we use the UK International Data Transfer Agreement (IDTA) - a standard contract approved by the Information Commissioner's Office (ICO) under Section 119A of the Data Protection Act 2018.

The IDTA requires the US recipient to commit to treating UK personal data to the same standards as UK GDPR, regardless of US law. It is the UK equivalent of the EU's Standard Contractual Clauses. By signing the IDTA with each US sub-processor, we create a legally enforceable obligation on them to protect your patients' data.

In plain terms: even though these are US companies, they are contractually required to handle any data they receive from us as if UK GDPR applied directly to them.

7. Sub-processors

We currently use the following sub-processors to provide the Service:

Sub-processor	Purpose	Location	Transfer mechanism
Supabase	Database hosting	UK (London)	No transfer (UK region)
Fly.io	Runs the application and API	UK (London)	Processed in London; US company, see our sub-processor list
Cloudflare	Web security and traffic routing	Global, nearest the user	US company, see our sub-processor list
Sentry	Error monitoring, patient data stripped	EU (Germany)	UK adequacy for the EEA
Amazon Web Services	Encryption key management (KMS); AI processing (Claude via Amazon Bedrock)	UK / EU	No transfer from the UK region; UK adequacy for the EU region
Twilio Inc.	SMS delivery	United States	UK IDTA
Stripe, Inc.	Payment processing	United States	UK IDTA / SCCs

We will give you at least 30 days' written notice (by email to your registered address) before adding or replacing any sub-processor. You may object to the change within 14 days; if we cannot resolve the objection, you may cancel your subscription without penalty. The current sub-processor list is always available at sanctum.support/sub-processors.

8. Data subject rights

If one of your patients contacts you to exercise their rights under UK GDPR (access, erasure, portability, rectification, restriction), we will support you by:

• Providing a data export of all data held for that patient via the patient profile page
• Processing a hard deletion of all patient data (records, messages, survey responses) via the delete button on the patient profile
• Providing assistance with Subject Access Requests on request - email [email protected]

All patient deletions are logged in our audit trail so you can demonstrate compliance.

9. Data breach notification

If we become aware of a Data Breach that affects your patients' data, we will notify you within 24 hours of becoming aware, to allow you to meet your ICO notification obligation (72 hours from discovery under UK GDPR Art. 33).

Our notification will include: the nature of the breach, categories of data affected, approximate number of individuals affected, measures taken to address it, and our contact details.

10. Data retention and deletion

We retain patient data for the following periods by default:

Data type	Retention period
Patient identity and clinical records	8 years from last contact (UK health records minimum)
Message and conversation history	3 years from last message
Survey responses	3 years

On termination of your subscription, we will provide a complete data export or confirm deletion within 30 days, at your election.

11. Audit rights

You may request information to verify our compliance with this DPA. We will respond to reasonable information requests within 30 days. Where an on-site audit is required (which we expect to be rare), we may charge for reasonable time and costs, and will require 14 days' notice and a confidentiality commitment.

12. Your responsibilities as Controller

By accepting this DPA, you confirm that:

• You have a lawful basis under UK GDPR for processing your patients' health data - typically Article 9(2)(h) (healthcare provision) or explicit patient consent
• Your patients have been informed about how their data is processed, including the use of AI-assisted tools
• Your use of the Service complies with all applicable data protection laws and professional regulations
• You hold your own ICO registration (or are registered under a practice-level registration) as a Data Controller for patient data

13. Governing law

This DPA is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.