Data processing agreement

This agreement forms part of the Terms of Service between the client (controller) and Nodus Studios, a sole trader based in Liskeard, Cornwall, UK (processor), as required by Article 28 UK GDPR.

Scope

• Subject matter: answering chats, emails and texts, capturing leads and booking appointments for the client.
• Data subjects: the client's customers and enquirers.
• Data: names, contact details, message content, appointment details and anything the data subject chooses to write.
• Special category data: messages may include health information (for example, a patient mentioning a symptom or treatment). The client is the controller and relies on its own lawful basis and Article 9 condition; we process it only to provide the service, hand clinical questions to the client's team, and never use it for anything else.
• Patient lists the client uploads (for example, for recall or reactivation messages).
• Duration: for the life of the client's account, plus the deletion periods in our privacy policy.

Our commitments

• Process personal data only on the client's documented instructions, including these terms and their settings in the dashboard.
• Ensure staff with access are bound by confidentiality.
• Keep appropriate security: encryption in transit, encrypted storage of connected-account tokens, per-client data isolation, and access controls.
• Use only the subprocessors listed below, give 30 days' notice of changes, and let the client object.
• Help the client respond to data subject requests and data protection impact assessments.
• Notify the client without undue delay, and within 48 hours, of a personal data breach affecting their data.
• Delete or return the data when the account ends, unless the law requires us to keep it.
• Make available the information needed to show compliance, and allow reasonable audits.
• Not use the data to train AI models.

Subprocessors

• xAI (Grok), Anthropic (Claude) or OpenAI: Generating chatbot, email and SMS replies
• Supabase: Database and authentication
• Vercel: Hosting
• Stripe: Payments and invoicing
• Resend: Owner alert emails
• Google / Microsoft: Connected inboxes and calendars, when a client connects them
• Twilio: Phone numbers, calls and SMS, when enabled
• Cal.com: Calendar bookings, when a client connects it
• Meta Platforms: Instagram and Messenger messages, when a client connects a Page
• Google (Analytics): Website visit statistics, only if a visitor accepts analytics cookies

International transfers

Where data leaves the UK, transfers rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

Questions: tommy@nodusstudios.co.