Information governance & data processing

1. Roles and scope

This Data Processing Agreement forms part of the Tidemark Terms of Service between Studystreaks Ltd (the "Processor") and the GP practice, health board, cluster or other healthcare entity that holds the subscription (the "Controller").

The Controller determines the purposes and means of processing staff workload data. The Processor processes that data solely to provide the subscribed service and on the Controller's documented instructions, which include the instructions given through normal use of the application.

2. Subject matter, duration, nature and purpose

Subject matter: recording, storing, aggregating and reporting on the working time and workload of the Controller's clinical team.

Duration: for the term of the subscription, plus the retention window set out in clause 9.

Nature and purpose: workforce capacity measurement, safe working compliance reporting, and operational improvement planning. Tidemark is not a clinical system.

Purpose limitation: All data held by Tidemark is internal to the service. It is used only to operate and improve the app for the clinicians and practices who created it — producing their own diaries, reports and analyses. It is never sold, never shared with advertisers, and never used for any other purpose.

Consent for any other use: Nothing is ever done with a practice's or clinician's data outside the service without their explicit, informed consent — for example contributing to research, appearing in a case study or testimonial, or joining the cross-practice comparison. Consent is a specific choice, never assumed or bundled, and can be withdrawn at any time. No research contribution, case study, testimonial or cross-practice comparison involves the Controller's or a clinician's data unless the relevant party has opted in.

Non-identifiable aggregates: Any aggregated or pooled figure — in-app comparison, research, or any published statistic — is only ever produced at a level where no individual practice or clinician can be identified. Comparison figures need at least 12 practices in a band; research outputs need at least 20 clinicians across at least 5 practices; within a practice, figures are suppressed until at least 3 clinicians contribute.

3. Categories of data subject and personal data

Data subjects: clinicians and clinical team members of the Controller who hold an account — GP partners, salaried GPs, locums, trainees, ANPs, pharmacists, practice nurses and other roles the Controller adds.

Categories of personal data: account information; workload and operational data; self-reported ratings; uploaded paper sheets; free-text notes; notification and device data; voice notes; security and audit records; billing data.

No special category data relating to patients is processed. Self-rated cognitive load and IT friction scores are occupational measures recorded voluntarily by the clinician about their own working day.

4. No patient identifiable data

Tidemark never requests, collects, stores or processes patient identifiable data. Do not enter patient names, dates of birth, CHI or NHS numbers, or identifiable clinical detail into any free-text field, note or friction tag.

The Controller undertakes to instruct its staff accordingly. Free-text fields are optional throughout the application and are excluded from every data export and from all AI processing.

5. Sub-processors

The Controller gives general authorisation for the Processor to engage the sub-processors listed below. The Processor imposes data protection obligations equivalent to this agreement on each of them, and remains fully liable for their performance.

The Processor will give at least 30 days' notice before adding or replacing a sub-processor, during which the Controller may object and, if the objection cannot be resolved, terminate the subscription with a pro-rata refund.

• Supabase (Germany (Frankfurt) and Ireland, within the European Union / EEA.) — Managed Postgres database, authentication and encrypted file storage for uploaded paper sheets.
• Cloudflare (United Kingdom and European Union edge locations. To deliver pages quickly and block attacks, request metadata may pass through other Cloudflare points of presence worldwide.) — Application hosting, edge delivery, TLS termination and DDoS protection.Covered by the UK International Data Transfer Addendum and EU Standard Contractual Clauses.
• Stripe (United Kingdom and Ireland (EEA), certified PCI DSS Level 1.) — Subscription payments and invoicing. Card details are entered directly with Stripe and never reach our servers.Any onward transfer by Stripe is covered by the UK International Data Transfer Addendum and EU Standard Contractual Clauses.
• Lovable AI Gateway (OpenAI / Google models) (European Union and/or the United States.) — Reads uploaded paper sheets into numbers, transcribes voice notes into text (OpenAI gpt-4o-transcribe) and drafts the entry and the written workload analysis (Google Gemini). Voice audio is forwarded for transcription only and is never stored by us; the transcript is discarded once your draft entry is produced. Only operational workload figures are sent; inputs are not used to train models and are not retained by the model provider for training.US processing is covered by EU Standard Contractual Clauses and the UK International Data Transfer Addendum, with a transfer risk assessment on file.
• Apple Push Notification service (United States (Apple)) — delivers reminder notifications only; a content-free ping, never workload data.
• Firebase Cloud Messaging (United States (Google)) — delivers reminder notifications only; a content-free ping, never workload data.
• Mozilla autopush (United States (Mozilla)) — delivers reminder notifications only; a content-free ping, never workload data.

6. Security measures

Encryption in transit: TLS 1.3 (HTTPS), with HSTS enforced.

Encryption at rest: AES-256 at rest, including database backups.

Logical separation and authorisation: Per-row database authorisation (Row Level Security) scoped to the signed-in clinician. Every table enforces per-user policies at the database layer, so a defect in application code cannot expose another practice's data.

Authentication: Email and password or Google sign-in, with hashed credentials handled by the managed auth provider. Uploaded sheet photographs are held in a private bucket readable only by the clinician who uploaded them.

Personnel: access to production data is limited to named administrators on a least-privilege basis and is used only to investigate faults raised by the Controller.

7. Confidentiality and staff

Everyone the Processor authorises to process personal data is bound by a duty of confidentiality and has received data protection training appropriate to their role.

8. Assistance to the Controller

Data subject requests: the application provides self-service access, correction and export, so most requests need no involvement from the Processor. Where assistance is needed, the Processor will respond within 10 working days.

The Processor will assist the Controller with data protection impact assessments and with prior consultation with a supervisory authority, on request, and will make available the information needed to demonstrate compliance with Article 28.

9. Return and deletion

On termination or expiry: full access for 30 days, read-only export access until day 90, and permanent deletion of all practice and personal records — including backups and uploaded sheet images — at day 90.

Deletion is carried out by an automated nightly process and is irreversible. Earlier deletion can be requested in writing at any time.

10. Personal data breach

The Processor will notify the Controller without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting the Controller's data, together with the nature of the breach, the categories and approximate number of records affected, the likely consequences and the measures taken.

11. International transfers

Primary storage is in the European Union (Germany — Frankfurt, and Ireland). Payment processing is in the United Kingdom and Ireland. Administrative access for support and fault investigation is from the United Kingdom only.

The only processing outside the UK and EEA is: (a) the AI processing of uploaded sheet images and operational workload figures, which may take place in the United States; (b) reminder push notifications, which pass through the device maker's push service (Apple, Google or Mozilla) in the United States carrying a content-free ping only; and (c) request metadata transiting Cloudflare's global points of presence for delivery and security.

Every transfer outside the UK or EEA is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, with a transfer risk assessment on file and available to the Controller on request.

12. Audit

The Processor will make available on request the information necessary to demonstrate compliance with this agreement, including sub-processor certifications and security documentation, and will allow for and contribute to audits by the Controller or an auditor it mandates, no more than once a year unless required by a supervisory authority.

13. Governing law

This agreement is governed by the law of Scotland for UK subscriptions, or the law of the Controller's registered jurisdiction where that differs.