Last updated: 15 October 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Aleph Logic (“we”, “us”, the “Processor”) and the organisation that subscribes to SOP Care (“you”, the “Controller”). It applies whenever we process personal data on your behalf in providing SOP Care, and you accept it when you accept the Terms of Service. It is intended to meet the requirements of Article 28 of the UK General Data Protection Regulation (“UK GDPR”).
1. Definitions
“Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and any other law relating to personal data that applies in the United Kingdom. “Personal Data”, “Processing”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the UK GDPR. “Customer Data” means personal data that you or your users add to SOP Care.
2. Roles and scope
You are the controller and we are the processor of Customer Data. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Schedule 1. You are responsible for having a lawful basis for the processing and for the accuracy of Customer Data.
3. Instructions
We will process Customer Data only on your documented instructions, which are given by these terms, by your use and configuration of SOP Care, and in writing by an account administrator, unless the law requires otherwise. In that case we will tell you before processing unless the law prevents it. We will tell you promptly if we believe an instruction breaches Data Protection Law.
4. Confidentiality
We will ensure that anyone we authorise to process Customer Data is bound by a duty of confidentiality and only accesses it as needed to provide, support or secure SOP Care.
5. Security
We will put in place appropriate technical and organisational measures to protect Customer Data, as required by Article 32 of the UK GDPR. The measures in place at the date of this DPA are described in Schedule 2. We may update them as long as the overall level of protection is not reduced.
6. Subprocessors
You give general authorisation for us to use subprocessors. The current list is published on our Data protection page. We will give account administrators at least 30 days’ notice by email before we add or replace a subprocessor. If you object on reasonable data protection grounds and we cannot resolve the objection, you may cancel your subscription before the change takes effect. We will put written terms in place with each subprocessor that give the same level of protection as this DPA, and we remain responsible for their performance.
7. International transfers
Customer Data is hosted in the United Kingdom, with backups in the European Union. We will not transfer Customer Data outside the UK except to a country covered by UK adequacy regulations or under appropriate safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
8. Helping you meet your obligations
Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures where possible, to respond to requests from data subjects exercising their rights. If we receive a request directly, we will pass it to you and will not respond except on your instructions. We will also give you reasonable help with security, breach notification, data protection impact assessments and consultation with the Information Commissioner’s Office, using the information available to us.
9. Personal data breaches
We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data. We will give you the information you reasonably need to meet your own reporting obligations, take reasonable steps to contain the breach, and keep you updated.
10. Deleting or returning data
You can export Customer Data at any time while you subscribe. After your subscription ends we will keep Customer Data for up to 12 months so you can restart, then delete it, unless you ask us in writing to delete it sooner or the law requires us to keep it. Copies in backups are overwritten in the normal backup cycle.
11. Information and audits
We will make available the information reasonably needed to show that we meet our obligations under Article 28 of the UK GDPR, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. Audits must be on reasonable written notice, no more than once a year unless a Supervisory Authority requires it or there has been a Personal Data Breach, and subject to confidentiality. We may first answer written questions or provide existing reports or certifications.
12. Liability and general terms
Each party’s liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow liability to be limited. If this DPA conflicts with the Terms of Service on the processing of Customer Data, this DPA takes priority. This DPA is governed by the law of England and Wales.
Schedule 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing SOP Care, an online service for managing standard operating procedures, staff read-and-sign records, workplace checks, corrective actions and inspection evidence. |
| Duration | For the term of your subscription, and up to 12 months after it ends, as described in section 10. |
| Nature and purpose | Storing, organising, displaying, sending notifications about, backing up and deleting Customer Data so that you can manage your SOPs and compliance records. |
| Categories of data subjects | Your staff, locums, agency and bank workers, managers and other users you invite. |
| Types of personal data | Name, job role, work email address, phone number (if added), login and activity records, SOP sign-off records, answers to check questions, check entries, photos and signatures added to checks, and corrective action records. |
| Special category data | None intended. SOP Care is not designed to hold patient or resident records or health information, and you agree not to enter it. |
Schedule 2: Security measures
- Hosting in the United Kingdom with a hosting provider that applies its own physical, network and malware protection.
- HTTPS encryption for all connections to the website and app.
- Individual user accounts, role-based access, and automatic expiry for temporary (locum) access.
- An audit trail of changes to SOPs, sign-offs, checks and corrective actions.
- Regular backups, stored in the European Union.
- Access to the production system limited to the people who need it to provide and support SOP Care.
- Prompt application of security updates to the platform and software.
Contact
Aleph Logic, a trading name of Aleph Healthcare Ltd
[Business address to be added]
Data protection contact: support@sop-care.com