Data-processing commitments

The practice is normally the controller of contact records and NutriHub is its processor. NutriHub processes that information only to provide, secure and support the service, as documented in the agreement and the practice’s lawful instructions.

• Subject matter: hosted practice-management and contact-portal services.
• Duration: the service term plus agreed export, closure and backup periods.
• People: contacts, potential contacts, practice staff and authorised collaborators.
• Information: identity, contact, appointment, consultation, communication, form, document, progress and plan information entered by the practice or contact.
• Sensitive information: health-related details and other special-category information where entered by an authorised user.

• Ensure authorised personnel are bound by confidentiality duties.
• Maintain proportionate technical and organisational security controls.
• Use subprocessors under written data-protection obligations.
• Assist with rights requests, security incidents and required impact assessments.
• Notify the practice without undue delay after confirming a relevant personal-data breach.
• Delete or return information at the end of service, subject to lawful retention and backup cycles.
• Provide information reasonably necessary to demonstrate compliance.

Where information is processed outside the applicable protected territory, the parties will use a recognised transfer mechanism and supplementary safeguards where required.

The practice remains responsible for lawful collection, transparency, professional retention duties, user access, the accuracy of instructions and deciding whether NutriHub is appropriate for its intended processing.

The final DPA, including party details, liability alignment and any required transfer clauses, must be accepted with the commercial agreement before paid third-party service. Requests can be sent to support@nutrihub.health.