The entity that enters into the Agreement with Lens Health Technologies and determines the purposes and means of the processing of Personal Data (the "Controller").
The Controller may designate Lens Health Technologies as a technical contact for operational matters related to processing; however, this does not affect the Controller's role or responsibilities under Data Protection Laws.
Organisation: Lens Health Technologies Ltd
Hereafter referred to as the "Processor"
The Processor shall process Business and Personal Data on behalf of the Controller strictly in accordance with the Controller's documented instructions and in compliance with applicable Data Protection Laws.
For the purposes of applicable Data Protection Laws:
The Processor provides a software-as-a-service platform that enables the Customer to:
Processing activities include the collection, storage, organisation, structuring, retrieval, consultation, and transmission of Business and Personal Data.
Personal Data is processed solely for the purpose of:
The Processor shall not process Personal Data for any purpose other than as instructed by the Customer.
Processing shall continue for the duration of:
Upon termination or expiry of the Agreement, Personal Data shall be deleted or returned in accordance with the Agreement and applicable Data Protection Laws.
The Personal Data processed may relate to any individuals whose data is uploaded, submitted, generated, or otherwise processed by the Customer through the SaaS platform, including but not limited to residents, employees, contractors, family members, healthcare professionals, and other third parties associated with the Customer's operations.
The Processor may process any Personal Data that is uploaded, input, transmitted, or otherwise made available by the Customer through the SaaS platform or connected systems.
This may include, without limitation:
Such Personal Data may include Special Category Data under Article 9 UK GDPR, including health-related information and other sensitive data relating to individuals' physical or mental health, care needs, wellbeing, or treatment.
All Personal Data is processed solely on the documented instructions of the Controller and only to the extent necessary to provide the services.
This Data Processing Amendment ("DPA") governs the processing of Personal Data by Lens Health Technologies (the "Processor") on behalf of the Customer (the "Controller") in connection with the Lens FocusAI system, a healthcare data retrieval and operational support platform that utilises natural language processing (NLP) and structured and unstructured data indexing.
The Processor shall process personal data only in accordance with:
The Processor shall process Personal Data only in accordance with:
The Processor provides a healthcare data retrieval and decision-support platform that enables authorised healthcare professionals to query and access healthcare information across multiple connected data sources.
For the purposes of providing the service, the Processor may carry out the following processing activities strictly on behalf of the Controller:
All processing of Personal Data is carried out solely for the purpose of:
The Processor shall not process Personal Data for any purpose other than those expressly documented in this Agreement or otherwise instructed in writing by the Controller.
The Processor shall:
The Processor shall not be required to follow any instruction from the Controller that, in its reasonable opinion, would result in a breach of applicable Data Protection Laws or other applicable law, and shall promptly inform the Controller where such instruction is identified and may suspend the relevant processing until the instruction is confirmed or amended in writing.
The Processor shall provide reasonable assistance to the Controller in relation to any enquiries, investigations, audits, or requests from supervisory authorities, including the Information Commissioner's Office (ICO), where such matters relate to the processing of Personal Data under this Agreement.
This includes assisting with information requests, providing relevant documentation, and supporting compliance demonstrations.
The Processor shall promptly notify the Controller of any direct request or investigation from a supervisory authority relating to Personal Data, unless legally prohibited from doing so.
The Processor may process Personal Data that is uploaded, transmitted, or otherwise made available to the platform by the Controller from a combination of structured and unstructured data sources.
All Personal Data is treated as sensitive and subject to appropriate technical and organisational security measures, reflecting the potential inclusion of Special Category Data.
The platform may process Special Category Data where such data is included in source systems or uploaded by the Controller, including but not limited to:
The platform may also process limited Personal Data relating to healthcare professionals and other individuals where such data is included in the Controller's source systems, including identifiers, contact details, and role or organisational information.
All Personal Data processed by the Processor, regardless of format or source, is subject to the highest applicable level of security controls and is processed solely in accordance with the Controller's documented instructions and this Agreement.
The Processor shall:
The Customer is responsible for:
The Processor shall not:
unless expressly agreed in writing with the Customer.
The Customer acknowledges and authorises the Processor to engage third-party sub-processors to support the provision of the Service, including for hosting, infrastructure, analytics, and support functions.
The Processor shall ensure that any sub-processor is subject to written data protection obligations that are no less protective than those set out in this Agreement, and shall remain fully responsible for their performance.
The Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by the processing of Personal Data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.
At a minimum, the Processor's security measures shall include:
The Processor shall regularly review and update these measures to ensure ongoing compliance with applicable Data Protection Laws and alignment with industry best practices.
The Controller provides general written authorisation for the Processor to engage Subprocessors for the purpose of providing the Services under this Agreement.
The Processor shall maintain an up-to-date list of Subprocessors used in connection with the processing of Personal Data. This list shall be made available to the Controller upon request.
The Processor shall provide the Controller with prior written notice of any intended addition or replacement of Subprocessors. The Controller shall have the right to object to such changes on reasonable data protection grounds within thirty (30) days of receipt of such notice.
Where the Processor engages any Subprocessor, the Processor shall ensure that:
The Processor shall remain fully liable to the Controller for the performance of any Subprocessor's obligations in relation to the processing of Personal Data under this Agreement.
The Processor shall not transfer Personal Data outside the United Kingdom unless such transfer is carried out in compliance with applicable Data Protection Laws, including the UK GDPR and the Data Protection Act 2018.
Where Personal Data is transferred internationally in the course of providing the Services, the Processor shall ensure that appropriate safeguards are in place, including the use of:
The Processor shall also ensure that appropriate transfer risk assessments (including Transfer Impact Assessments or equivalent assessments) are completed where required by applicable law.
Where feasible and appropriate, the Processor will apply data minimisation techniques prior to any international transfer, including the use of anonymisation or pseudonymisation, such that Personal Data is not directly identifiable when processed outside the United Kingdom. However, such measures shall not be relied upon where full Personal Data is required for the delivery of the Services as instructed by the Controller.
All international transfers shall be subject to appropriate technical and organisational safeguards designed to ensure a level of protection essentially equivalent to that required under UK Data Protection Laws.
Taking into account the nature of the processing, the Processor shall provide reasonable assistance to the Controller in fulfilling its obligations to respond to requests from data subjects exercising their rights under applicable Data Protection Laws, including but not limited to:
Where the Processor receives any request directly from a data subject in relation to Personal Data processed under this Agreement, the Processor shall not respond to such request except to confirm that it relates to the Controller, and shall promptly notify the Controller of the request.
The Processor shall provide such assistance using appropriate technical and organisational measures and in accordance with the Controller's documented instructions. Where necessary, the Processor shall assist the Controller in ensuring compliance with applicable statutory timeframes for responding to such requests.
The Processor shall notify the Controller without undue delay upon becoming aware of any Personal Data Breach affecting Personal Data processed under this Agreement.
Where reasonably possible, the Processor shall provide an initial notification within 24–72 hours of becoming aware of the breach.
Such notification shall include, to the extent information is available at the time:
The Processor shall provide ongoing updates to the Controller as further information becomes available and shall cooperate fully with the Controller in investigating, mitigating, and remediating the breach, including providing reasonable assistance to support any required notifications to supervisory authorities or affected data subjects.
The Processor shall make available to the Controller, upon reasonable request, such information as is necessary to demonstrate compliance with this Agreement and applicable Data Protection Laws.
This may include, where applicable:
The Controller shall have the right to conduct audits of the Processor's compliance with this Agreement, subject to the following conditions:
Where the Processor provides up-to-date audit reports, certifications, and security documentation, the Parties agree that such materials shall satisfy the Controller's audit requirements in most circumstances.
The Controller may, at any time during the term of this Agreement, request the deletion or return of specific Personal Data processed under the Services. The Processor shall comply with such request without undue delay, unless retention is required by applicable law.
Upon termination or expiry of the Services, the Processor shall, at the choice of the Controller:
The Controller shall be responsible for specifying its preferred option within a reasonable timeframe following termination.
Where deletion is requested, the Processor shall securely delete Personal Data from active systems without undue delay and in accordance with applicable Data Protection Laws and industry best practices.
Notwithstanding the above, Personal Data may remain in secure backup systems for a limited period following deletion or termination, provided that:
The Processor shall ensure that backup deletion is completed within a commercially reasonable period in line with its documented retention and disaster recovery policies.
Upon completion of deletion or return (as applicable), the Processor shall provide written confirmation to the Controller that Personal Data has been processed in accordance with this clause.
Taking into account the nature of the processing and the information available to the Processor, the Processor shall provide reasonable assistance to the Controller in carrying out Data Protection Impact Assessments (DPIAs) where required under applicable Data Protection Laws.
Such assistance may include providing relevant information regarding:
Where required, the Processor shall also provide reasonable assistance to the Controller in relation to prior consultations with supervisory authorities or regulators, including the Information Commissioner's Office (ICO), insofar as such assistance relates to the Processor's processing activities under this Agreement.
The Processor shall provide such assistance only to the extent reasonably necessary and in accordance with the Controller's documented instructions.
Each Party is responsible for its own compliance with applicable Data Protection Laws.
The Controller is responsible for ensuring it has a lawful basis for processing Personal Data and for all instructions provided to the Processor.
The Processor is responsible for processing Personal Data only in accordance with this Agreement, the Controller's documented instructions, and applicable Data Protection Laws.
To the maximum extent permitted by law, each Party is liable for its own breaches of Data Protection Laws. The Processor shall not be liable for any loss or claim arising from the Controller's unlawful or incorrect instructions.
This clause is subject to the limitation of liability set out in the Master Services Agreement.
The Controller and Processor shall designate appropriate points of contact for all matters relating to data protection under this Agreement.
Processor Contact:
The Processor shall provide a dedicated data protection contact email for the purposes of privacy and security matters relating to the processing of Personal Data.
Email: amar.sandhu@lenstechnologies.ai
Where applicable, the Processor shall also appoint a Data Protection Officer (DPO) in accordance with Article 37 of the UK GDPR. If a DPO is appointed, their contact details shall be made available to the Controller upon request.
This Data Processing Agreement, and any dispute or claim arising out of or in connection with it, shall be governed by and construed in accordance with the laws of England and Wales.
The courts of England and Wales shall have exclusive jurisdiction over any dispute arising from or in connection with this Agreement.