Legal

Data Processing Agreement

Provisional data processing terms between ExoLink users and Exodent Ltd.

Provisional text. This document has not yet been reviewed by a solicitor and must be reviewed and approved before it is relied upon.

01Roles

For patient-related case data sent by a clinic, the clinic is controller and Exodent Ltd acts as processor. Labs engaged to make a case act as sub-processors under written terms.

02Instructions and purpose

We process case data only to allocate, forward, track and invoice cases on the clinic's documented instructions, and as required by law.

03Data minimisation

Clinics should use a patient reference, not a full name. Do not include unnecessary personal data in notes or files.

04Security

Files are stored privately with access limited to the sending clinic, the assigned lab and authorised administrators. Download links are signed and time-limited. Access is role-based and logged.

05Sub-processors

We use infrastructure, email and storage providers, and assigned labs. We will keep an up-to-date list and give notice of changes.

06Breach, assistance and deletion

We will notify the controller without undue delay on becoming aware of a personal data breach, assist with data subject requests, and delete or return data at the end of the service unless law requires retention.