Data Processing Agreement

• Data Protection Law means the laws on personal data that apply to the processing: the UK GDPR and the Data Protection Act 2018, the EU GDPR where it applies, and other laws such as Canadian privacy laws and US state privacy and health data laws, as each is amended from time to time.
• Client Personal Data means personal data about your clients and the other people described in Annex 1 that we process for you in providing TranqBay.
• Controller, processor, data subject, personal data, personal data breach, processing and special category data have the meanings given in the UK GDPR.
• Sub-processor means another company we engage to process Client Personal Data.

If you are a covered entity under HIPAA, the Business Associate Agreement also applies to protected health information. If the two conflict about protected health information, the Business Associate Agreement comes first.

You are the controller of Client Personal Data and we are your processor. You are responsible for having a lawful basis for the processing, including a condition for processing health information, for giving your clients the information they need about it, and for getting any consent you need. Your instructions to us must comply with Data Protection Law.

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

We process Client Personal Data only on your documented instructions, including about transfers to other countries, unless the law requires us to do something else. If it does, we will tell you before we act, unless the law forbids telling you.

Your instructions are: this DPA, the Terms of Service (including the safety and platform-integrity measures they describe, such as the automated contact check on calls in section 7), the choices you make in your account (for example, turning on AI session notes, publishing your website or connecting a calendar), and any other written instructions we agree with you.

We will tell you straight away if we think an instruction breaks Data Protection Law.

We do not sell Client Personal Data, share it with others for their advertising, combine it with other data except to provide TranqBay to you, or use it to train AI models.

Emails to your clients. When one of your clients creates a TranqBay account, their name and email address are added to TranqBay's client mailing list. They may receive emails from TranqBay, including news and offers about TranqBay, and every such email has a link to unsubscribe.

We make sure that everyone we authorise to process Client Personal Data is bound by a duty of confidentiality, and that they access it only as needed to provide TranqBay, support you, keep TranqBay secure or meet the law.

We take the technical and organisational measures required by Article 32 of the UK GDPR, taking into account the nature of the data, which includes health information. Annex 2 describes them. We may change them over time, but not in a way that lowers the overall protection.

You give us general authorisation to engage the sub-processors on our Sub-processor list.

Before we add or replace a sub-processor, we will update the list and tell you by email at least 30 days before the change, unless an urgent change is needed for security or to keep TranqBay running, in which case we will tell you as soon as we can.

You can object to a change on reasonable data protection grounds by emailing [email protected] within that notice period. We will work with you in good faith to resolve it. If we cannot, you may end the affected part of TranqBay, and we will refund any fees you paid in advance for the period after it ends.

We put a written contract in place with each sub-processor with data protection obligations that give at least the same protection as this DPA. We remain responsible to you for our sub-processors' performance of those obligations.

Taking into account the nature of the processing, we help you, through appropriate technical and organisational measures, to respond to requests from your clients to exercise their rights under Data Protection Law. Much of this you can do yourself in your account. If we receive a request directly, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to or the law requires it.

Taking into account the nature of the processing and the information available to us, we help you meet your obligations on security of processing, notifying personal data breaches to regulators and to the people affected, data protection impact assessments and prior consultation with a regulator, by giving you the information you reasonably need.

We will notify you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting Client Personal Data. Our notice will describe, as far as we know at the time:

• the nature of the breach, including the categories and approximate number of people and records concerned;
• a contact point for more information;
• the likely consequences;
• the measures we have taken or propose to take to deal with the breach and reduce its effects.

Where we do not have all the information at once, we will provide it in stages without undue delay. We will not tell your clients or a regulator about a breach of Client Personal Data without first talking to you, unless the law requires us to.

When the Terms of Service end, or when you close your account, you can choose whether we return Client Personal Data to you or delete it. You can ask for a copy at [email protected] before your account closes or within 30 days after, and we will provide it in a commonly used format within 30 days of your request.

Closing your account does not by itself delete Client Personal Data. When you ask us to delete it, we will do so within 90 days of your request, unless the law requires us to keep it. Copies in backups that expire are deleted as those backups expire. Some backups do not yet expire automatically (see Annex 2); copies in them are kept secure, are not used, and are deleted when those backups are deleted.

We will make available to you the information you reasonably need to show that we meet our obligations under this DPA and Article 28 of the UK GDPR.

We will allow and contribute to audits, including inspections, by you or an independent auditor you choose who is bound by confidentiality, at your cost, on at least 30 days' written notice, no more than once a year unless a regulator requires it or after a personal data breach. Audits take place during business hours, in a way that does not disrupt TranqBay or put other customers' data at risk. We may meet an audit request by sharing summaries of our security controls or answering a written questionnaire, where that gives you the information you need.

Client Personal Data is mainly stored in the European Economic Area (Annex 2). Some sub-processors are in the United States (see the Sub-processor list).

Where Client Personal Data is transferred out of the United Kingdom, we make sure the transfer is lawful under the UK GDPR, by relying on UK adequacy regulations (including those for the European Economic Area and, for certified US companies, the UK Extension to the EU-US Data Privacy Framework), or on other appropriate safeguards, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where needed. Where the EU GDPR applies to the transfer, we use an adequacy decision or the EU Standard Contractual Clauses.

Where your clients' information is covered by a US state law on health or personal data, such as Washington's My Health My Data Act, Nevada's consumer health data law or the Connecticut Data Privacy Act, or by the California Consumer Privacy Act, we act as your processor or service provider. In particular, we:

• process it only for the purposes in Annex 1 and on your instructions;
• do not sell or share it, or keep, use or disclose it outside our direct business relationship with you;
• do not combine it with personal data from other sources, except as those laws allow;
• give it the same level of protection those laws require of you, and tell you if we can no longer meet our obligations;
• allow you to take reasonable steps to stop and fix any use that is not allowed.

Where Canadian privacy law applies, including the Personal Information Protection and Electronic Documents Act (PIPEDA), we protect your clients' information with safeguards comparable to those you must provide, use it only to provide TranqBay to you, and tell you about any breach of security safeguards as set out in section 10 so you can meet your reporting duties.

Each party's liability under this DPA is subject to the limits in the Terms of Service; there is no separate limit for data protection claims. This DPA lasts as long as we process Client Personal Data for you. If this DPA and the Terms of Service conflict about Client Personal Data, this DPA applies.

Subject matter. Providing TranqBay for private practice to you: your practice website, booking, video sessions, notes, messaging, forms, payments from your clients and the tools that support them.

Duration. For as long as you use TranqBay, and afterwards until the information is deleted or returned under section 11.

Nature of the processing. Collecting, storing, organising, displaying, transmitting, encrypting, backing up and deleting information; turning session audio into text and drafting notes with AI when you turn AI session notes on; turning session audio into text and checking it with AI for contact details being shared, when the contact check runs; taking payments and making payouts; sending emails about bookings and payments; counting visits to your practice website with Google Analytics.

Purpose. To provide TranqBay to you under the Terms of Service, to support you, and to keep TranqBay safe and secure. As a safety and platform-integrity measure, an automated check may run on the audio of video sessions, whether or not AI session notes are on, to detect contact details being shared during the call. The text of the call is not kept. If contact details are found, we keep the categories found and may keep a short excerpt, with the details masked and encrypted, for 12 months.

Data subjects. Your clients and prospective clients; parents, guardians and others who book or attend sessions for a client; guests invited to a session; and visitors to your practice website who contact you or book.

Types of personal data.

• Contact and identity details: name, email address, phone number, date of birth and other details you or your clients enter;
• Booking details: sessions, times, cancellations, attendance and booking notes;
• Health and care information (special category data): session notes, reports, forms and intake answers, messages, and, if you turn on AI session notes, session transcripts and AI-drafted notes;
• Files you or your clients upload, such as documents, images and voice notes;
• Payment details: what was paid, refunds and credits, and references from our payment processors (we do not store full card numbers);
• Technical details: IP addresses and device information, needed to run video sessions and keep TranqBay secure.

Special category data. Client Personal Data includes information about health. It is protected by the measures in Annex 2, including the extra encryption described there.

How long.

• Session transcripts: deleted 30 days after the session, and removed from our storage's backup versions within a further 90 days;
• Contact check results: kept for 12 months, then deleted automatically;
• Everything else: kept until you delete it, or until you ask us to delete it under section 11.

Where data is held. TranqBay runs in Scaleway data centres in Paris, France. Files and session transcripts are stored with Amazon Web Services in Frankfurt, Germany, with backup copies in Ireland.

Encryption.

• Data is encrypted in transit and at rest.
• All traffic to TranqBay uses HTTPS (TLS), and browsers are told to use only HTTPS.
• Video sessions are end-to-end encrypted. We do not record the audio or video of sessions. When AI session notes are on or the contact check runs, TranqBay's own transcription service joins the call's encryption to receive the audio for speech-to-text.
• Messages are also encrypted in our database with AES-256, and session transcripts with AES-256-GCM using a separate key for each record.

Access.

• Passwords are stored only as secure hashes, and TranqBay supports two-step sign-in.
• Our staff reach production systems only through individual accounts with single sign-on, with access limited to what their role needs.
• Secrets such as passwords and keys are kept in a secrets manager, not in code.
• Network rules restrict which systems can reach sensitive internal services, such as our secrets manager and event system.

Resilience and monitoring.

• Our main database is backed up every day, and those daily backups are kept for one week. Backups of some other databases, such as our website and support-chat databases, and one earlier one-off backup of our main database do not yet have a set expiry.
• Files are stored with versioning and copied to Ireland; earlier versions of deleted or replaced files are kept for 90 days.
• We monitor TranqBay around the clock and are alerted when something goes wrong.
• Error reports are collected on our own servers, with personal details filtered out, and kept for 7 days. Server logs are kept for 7 days.

AI and speech-to-text.

• AI session notes are off unless you turn them on.
• Speech is turned into text by a speech-to-text processor under a Business Associate Agreement, and notes are drafted by an AI provider under a Business Associate Agreement.
• The automated contact check may run on session audio whether or not AI session notes are on. It uses the same speech-to-text processor and AI provider, does not keep the text of the call, and keeps only the categories found and, where kept, a masked and encrypted excerpt, for 12 months.
• Neither may use your clients' information to train their models.

Deletion. Session transcripts are deleted 30 days after the session, and removed from our storage's backup versions within a further 90 days. Contact check results are deleted automatically 12 months after they are created.

The sub-processors you authorise are those on our Sub-processor list, as updated under section 7.