Data processing agreement

Last updated: 4 November 2026 · Version 1

This Data Processing Agreement (“Agreement”) forms part of the Terms of Service between Creobyte Ltd (trading as Sanstylo) and the organisation registering for or using Sanstylo (“Controller”).

By creating a Sanstylo account, the Controller accepts this Agreement. For university or teaching-clinic partnerships provided without a licence fee, this Agreement still applies: Creobyte processes clinic and placement data as Processor, and the university or clinic remains Controller.

1. Definitions

• “Controller” means the practice, clinic, teaching centre, university department, or other organisation using Sanstylo, who determines the purposes and means of processing Customer Personal Data.
• “Processor” means Creobyte Ltd (trading as Sanstylo), company number 17228907, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
• “Customer Personal Data” means any personal data uploaded to or generated in Sanstylo by the Controller, their staff, students, or patients, including identity and contact details, appointment and wait-list records, clinical notes and observations, forms, letters, invoices and payments, portal messages, and related correspondence.
• “Special Category Data” means Customer Personal Data revealing health information or other special categories under Article 9 UK GDPR (including clinical notes, observations, medical alerts, and related clinical content).
• “UK GDPR” means the UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.

2. Scope and purpose

2.1 The Processor shall process Customer Personal Data only on the documented instructions of the Controller, for the purpose of providing the Sanstylo practice-management service as described in the Terms of Service (including free teaching-clinic or student partnership arrangements where applicable).

2.2 The categories of data subjects include the Controller’s patients (and prospective patients), staff users, students on placement, referrers/contacts, and other individuals whose data the Controller chooses to store in Sanstylo.

2.3 The categories of personal data processed include: names and contact details; dates of birth and demographic fields; addresses; appointment, availability and wait-list information; clinical notes, body-chart annotations, clinical observations and medical alerts; forms, letters and communications; invoices, payments and billing text; portal notes; and security/audit metadata (such as account identifiers and IP addresses associated with audit events).

2.4 Special Category Data is processed only as necessary to provide the clinical and scheduling features the Controller enables. The Controller is responsible for establishing an Article 6 lawful basis and an Article 9 condition for that processing.

2.5 Processing continues for the duration of the service relationship. After termination or account closure, Customer Personal Data shall be deleted or returned in accordance with section 3.7 (standard deletion within 30 days unless UK law requires retention or the Controller requests an export within that period).

3. Processor obligations

The Processor shall:

3.1 Process Customer Personal Data only on the Controller’s documented instructions, unless required to do so by UK law, in which case the Processor shall inform the Controller before processing unless prohibited by law. The Processor shall not use Customer Personal Data for Creobyte’s own product research or marketing without a separate written agreement.

3.2 Ensure that all personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations.

3.3 Implement and maintain appropriate technical and organisational security measures in accordance with Article 32 UK GDPR, including as a minimum:

• AES-256 encryption of applicable personal and clinical fields at rest within the application
• TLS 1.2+ encryption of data in transit
• Role-based access controls and company (tenant) isolation
• Audit logging of relevant staff and portal actions
• Regular security review of significant platform changes

3.4 Not engage any sub-processor without the prior written consent of the Controller. General written consent is given by acceptance of this Agreement for the sub-processors listed in Schedule 1. The Processor shall notify the Controller of intended changes to sub-processors, giving the Controller the opportunity to object.

3.5 Assist the Controller, insofar as possible, in responding to data subject rights requests under UK GDPR (Articles 15–22). Where features exist in Sanstylo, the Controller may correct, export or delete records directly within the product.

3.6 Assist the Controller in ensuring compliance with obligations under Articles 32–36 UK GDPR (security, breach notification, data protection impact assessments, and prior consultation).

3.7 At the Controller’s choice, delete or return all Customer Personal Data at the end of the service relationship, and delete existing copies unless UK law requires storage. Standard account closure results in deletion within 30 days. Teaching-clinic / student partnership accounts and later graduate paid accounts are separate relationships and are not automatically merged.

3.8 Make available to the Controller all information necessary to demonstrate compliance with this Agreement, and allow for and contribute to audits and inspections. Where the Controller wishes to conduct an audit, it shall provide at least 14 days’ written notice. The Processor may satisfy audit rights through provision of relevant certifications, third-party audit reports, or documented security assessments.

4. Data breach notification

4.1 The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

4.2 Such notification shall include, to the extent known at the time: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

4.3 The Controller remains responsible for notifying the ICO within 72 hours where required under Article 33 UK GDPR, and for notifying affected data subjects where required under Article 34.

5. International transfers

5.1 The Processor shall not transfer Customer Personal Data outside the United Kingdom without appropriate safeguards or the prior written consent of the Controller, except as disclosed for authorised sub-processors in Schedule 1.

5.2 Primary application and database hosting for Sanstylo is intended on UK-based infrastructure (AWS eu-west-2, London). Object storage and backups are configured for the same region where used.

5.3 Where sub-processors operate outside the UK (see Schedule 1), appropriate transfer mechanisms are in place as noted therein.

6. Controller obligations

The Controller warrants that:

6.1 It has a lawful basis under UK GDPR (and, where Special Category Data is processed, an Article 9 condition) for processing Customer Personal Data in Sanstylo.

6.2 It has provided appropriate privacy notices to patients, staff and students regarding the use of Sanstylo as a data processor.

6.3 It is registered with the ICO as a data controller, or is otherwise lawfully exempt from such registration (for example, as may apply to certain public authorities).

6.4 It will use the platform in compliance with all applicable laws and regulations, including UK GDPR, the Data Protection Act 2018, and relevant professional / health-record obligations applicable to its practice or teaching clinic.

6.5 It will configure access appropriately (including student and receptionist permissions) and is responsible for its users’ activity under its account.

7. Liability

Each party’s liability under this Agreement is subject to the limitations set out in the Terms of Service. Nothing in this Agreement limits either party’s liability for matters that cannot be excluded by law.

8. Governing law

This Agreement is governed by the laws of Scotland and subject to the exclusive jurisdiction of the Scottish courts.

Schedule 1 — Authorised sub-processors

The Processor will maintain this schedule and notify Controllers of material changes with a minimum of 14 days’ notice, providing the right to object.

Schedule 2 — Technical and organisational security measures

The Processor implements the following measures in accordance with Article 32 UK GDPR:

Encryption

• AES-256 encryption for applicable personal and clinical fields at rest
• TLS 1.2 minimum for data in transit
• Encrypted database backups where provided by the hosting platform

Access controls

• Role-based access controls within the platform (owner, practitioner, receptionist, student)
• Configurable area access and company-scoped tenancy isolation
• Principle of least privilege for internal Creobyte system access

Availability and resilience

• Automated backups with retention aligned to operational policy
• Infrastructure monitoring with alerting
• Incident response procedures documented internally

Testing and assurance

• Automated test coverage for access and privacy-sensitive flows
• Security review on significant platform changes

Personnel

• Staff and contractors with data access bound by confidentiality obligations
• Data protection awareness for personnel handling personal data

Last updated: Nov 4, 2026.