Data Processing Agreement

Last updated: 5 November 2026

This agreement is between 12014637 CANADA INC., a company established in Canada that operates Praxbook ("we", "us"), and each practitioner who holds a Praxbook account. It covers what we do with your patients' personal data, which is your data, not ours. If you are a patient, read the Privacy Policy instead.

Under UK GDPR, a controller may use a processor only under a written contract meeting Article 28(3). This page is that contract, and the table at the end shows which section answers each part of the Article.

1. Who is who

• You are the controller of your patients' records.
• We are your processor: we hold that data and run the software around it, for you and for no purpose of our own.
• We are a controller of your own account data (your name, email, booking link and billing). The Privacy Policy covers that.

12014637 CANADA INC., incorporated under the Canada Business Corporations Act, corporation number 1201463-7.
Registered office: 624 Lake St, St Catharines, ON L2N 7B8, Canada.
Email: hello@praxbook.co.uk.

Our representative in the UK. We are established in Canada, so we have appointed Lee Curran as our representative under Article 27 of UK GDPR. You, or the Information Commissioner's Office (ICO), can contact them about how we handle personal data by email at uk-representative@praxbook.co.uk.

2. What we process

• Subject matter and purpose: running appointment booking, reminders, consent forms and clinical notes for your practice, and keeping the audit trail of each booking.
• Duration: while you hold an account, then as in section 7.
• Nature: storing, organising, displaying, emailing, backing up and, on your instruction, deleting.
• Data subjects: your patients and anyone who books with you.
• Data: name, email, phone, date of birth (if you ask for it); appointment details and their history; consent form answers with the typed name, any drawn signature, time and IP address; booking notes; and your clinical notes.

Consent forms and notes will ordinarily concern health, so we treat all of it as special category data. We never read it unless you ask us to help with a specific problem, and we never analyse it, train on it or sell it.

3. Your instructions, and confidentiality

We process your patients' data only on your documented instructions: this agreement, the Practitioner Terms, and the settings you choose in your dashboard. If the law requires us to do anything else, we will tell you first unless the law forbids it, and we will tell you if we think an instruction of yours breaks data protection law.

Only the people who run Praxbook can access production systems, and only as far as their work needs. Each is bound by a written duty of confidentiality.

4. Security

• HTTPS everywhere, with no unencrypted route.
• No passwords: sign-in is a one-time email code, stored hashed, expiring, attempt-limited and rate-limited.
• Every practice query is scoped to its owner and tested on every change; another practitioner's record is answered as if it does not exist.
• Backups are encrypted before they leave the server, kept off-site, and restores are rehearsed.
• Changes to appointments are recorded in an audit trail you can see.

No system is perfectly secure; section 6 covers what happens if something goes wrong.

5. Sub-processors, and where the data is

Your patients' records — the database and every backup — are held in the UK. You give us general authorisation to use the sub-processors below. Each is bound by contract to the same obligations as we are, and we remain liable to you for them. Anything processed outside the UK is named here, or does not happen.

Transfers. We are established in Canada, and when we run and support the service from there, your patients' data is accessed from Canada. That transfer relies on the UK's adequacy regulations for Canada, which cover commercial organisations subject to PIPEDA. Transfers to the European Economic Area rely on the UK's adequacy regulations for the EEA. Transfers to the United States go only to providers certified under the UK Extension to the EU–US Data Privacy Framework, which the UK has found adequate.

Changes. We will email you at least 30 days before adding or replacing a sub-processor. If you object and we cannot offer a reasonable alternative, you may end your subscription with no further charge and take your data with you under section 7.

Your calendar provider is not on this list; section 9 explains why.

6. Patient requests, breaches and other help

Your patients' rights (access, correction, deletion, portability, objection) are yours to answer. Your dashboard covers most of it. For anything it does not — a full export of one patient, or erasing a record — email hello@praxbook.co.uk. This is done by hand: we acknowledge within 3 working days and complete within 30 days. If a patient asks us directly, we refer them to you and tell you.

If a personal data breach affects your data, we tell you without undue delay after becoming aware of it, with what we know at the time — what happened, what data and roughly how many records, the likely consequences and what we are doing — and the rest as we learn it. We also give you the help you reasonably need with security, breach notification to the Information Commissioner's Office (ICO), and data protection impact assessments.

7. When you leave

When your subscription ends, tell us at hello@praxbook.co.uk whether to return your records (a machine-readable export of patients, appointments, consent forms and notes, within 30 days) or delete them (from the live database within 30 days, and from encrypted backups as they expire on their normal cycle).

One exception. We keep the appointment record — who booked what, when, and each status change — for the period in the Privacy Policy, for audit and to settle disputes. For that record alone we act as a controller in our own right, so it is not deleted on your instruction. Patients keep their own accounts and appointment history; those are theirs.

8. Information and audits

We will give you the information you need to show that we meet this agreement, in this order:

1. Documents first. On request, we send you a written summary of our security measures, our record of processing and the sub-processor list in section 5, and we answer your reasonable written questions about our processing, security and sub-processors within 30 days.
2. An audit where documents are not enough. If those answers do not reasonably show that we meet this agreement, or after a personal data breach affecting your data, or when a regulator requires it, you or an independent auditor you appoint may audit our processing of your data. An audit is carried out by reviewing documents and evidence remotely, unless that cannot answer the question.
3. Limits. An audit needs 30 days' written notice, and takes place no more than once in any 12 months unless a breach or a regulator gives cause. An auditor must be bound by confidentiality and must not be a competitor of ours. No audit gives access to any other practitioner's data, or to anything that would weaken our security, such as keys, credentials or details of unfixed weaknesses.
4. Costs. Each side bears its own costs for the documents and for one audit in any 12 months. For any further audit, we may charge our reasonable costs, agreed with you in advance, unless the audit is needed because we have broken this agreement.

9. Your calendar feed is your decision

If you subscribe to your read-only calendar feed from Google, Outlook or Apple, whatever the feed contains is copied to that provider on their terms. That makes them your processor, not ours. You choose how much they get:

• Busy: the word "Busy" and your clinic's name and address. No patient data.
• Initials (the default): the patient's initials and "appointment", plus your clinic.
• Full: the patient's name, email, phone, the service and their booking note.

The feed's address works without signing in, so treat it like a password. If it leaks, generate a new one in your dashboard; that breaks every existing subscription, including yours.

10. General

The liability limits in the Practitioner Terms apply here too, except where the law does not allow liability to be limited. Where this agreement and the Terms disagree about your patients' data, this agreement wins. We will email you before any change that materially affects you takes effect. Notices to us under this agreement go to hello@praxbook.co.uk, or by post to our registered office. This agreement is governed by the laws of England and Wales.

Where each part of Article 28(3) lives

Contact

Questions, or any request this agreement entitles you to make: hello@praxbook.co.uk. You may also contact the Information Commissioner's Office (ICO) at https://ico.org.uk.