Data processing agreement

1. What we process, and why

• Subject matter: providing Ochiplan, software for staff rotas, time off, absence, pay changes and billing between sites.
• Duration: while you use Ochiplan, then until the data is deleted as in section 9.
• Nature and purpose: storing, organising, showing, calculating with and sending notifications about the data, only to provide Ochiplan to you.
• People concerned: your staff, locums, owners, admins and anyone else you add.
• Types of data: names, contact details, roles and sites, working patterns and bookings, holiday and time-off requests, pay changes (no salaries or bank details), sign-in records, and special category data about health: sickness, lateness and return-to-work records.

2. Your instructions

We process the data only on your documented instructions: these terms, this agreement, and what your users do in Ochiplan. If we think an instruction breaks data protection law, we will tell you. If the law requires us to process data otherwise, we will tell you first unless the law forbids it.

3. Confidentiality

Everyone at our company who can access your data is bound to keep it confidential. Our support team can see your practice only when an owner lets them in, for a set time; each visit is written to your change log, and they cannot change anything.

4. Security

We keep appropriate technical and organisational measures, including:

• Encryption in transit (HTTPS) and at rest; backups encrypted before they leave the server.
• Separation between practices enforced in the database, so one practice can never read another’s rows.
• Two-step verification and 12-hour sessions for everyone who can see sickness records.
• Least privilege: each user sees only what their role allows, as listed in Ochiplan.
• A complete change log of who changed what and when.
• Nightly backups kept for 30 days away from the main server, with a restore tested every quarter.
• Security updates applied promptly, and error reports stripped of personal details.

5. Sub-processors

You agree to us using these sub-processors, each under a written contract with data protection terms at least as protective as these: UpCloud (hosting, the United Kingdom), Cloudflare (encrypted backups, EU storage), Resend (email delivery) and Sentry (error reports without personal details). We will tell you at least 30 days before adding or replacing one, so you can object; if we can’t resolve your objection, you can end the agreement. We remain responsible for our sub-processors.

6. Transfers outside the UK

We host your data in the United Kingdom, with encrypted backups in the European Union. We will only transfer it elsewhere with safeguards UK law accepts, such as the UK International Data Transfer Addendum.

7. Helping you

• Requests from individuals: Ochiplan lets owners export or erase one person’s data. If someone contacts us directly, we will pass it to you within 5 working days and help you answer.
• We will help you with data protection impact assessments and with consulting the Information Commissioner, where needed, about Ochiplan.

8. Personal data breaches

We will tell you without undue delay, and within 48 hours, of becoming aware of a breach affecting your data, with what we know: what happened, the data and people likely affected, the likely consequences and what we are doing about it. We will keep you updated and help you meet your own obligations to report it.

9. When the agreement ends

You can export data until the end. We then keep the data for 30 days so you can ask for a copy, delete it, and let backups that hold it expire within a further 30 days, unless the law requires us to keep it.

10. Checks

We will give you the information you reasonably need to show you are meeting your obligations for the data we process, and allow audits by you or an auditor you choose, with reasonable notice, at most once a year unless there has been a breach.

11. Liability and law

The limits in our terms of service apply to this agreement. It is governed by the law of England and Wales.