Uptake by Chairsyde (Automated Patient Engagement). Version 1.0, effective from 29 September 2026.
This Data Processing Agreement (the “DPA”) forms part of, and is incorporated into, the Customer Agreement between:
(1) Chairsyde Video Consulting Limited (company number 12628115), a company registered in England and Wales whose registered office is at 1 Beauchamp Court, 10 Victors Way, Barnet, Hertfordshire, EN5 5TZ (“Chairsyde”, “we”, “us”, “our”); and
(2) the customer identified in the Customer Agreement, together with each Practice Site on whose behalf it contracts (the “Customer”, “you”, “your”).
This DPA is effective from the Effective Date of the Customer Agreement, or from the date the Customer accepts it, whichever is earlier.
A. Chairsyde provides Uptake by Chairsyde, an automated patient engagement service that integrates with the Customer’s practice management system, identifies courses of treatment that have been planned but not booked, and sends automated communications to patients in the Customer’s name (the “Service”), under the terms of the Customer Agreement.
B. In providing the Service, Chairsyde processes Personal Data relating to the Customer’s patients on the Customer’s behalf. That Personal Data includes information about dental treatment, which is Special Category Data.
C. This DPA sets out the terms on which Chairsyde processes that Personal Data as the Customer’s Processor, as required by Article 28(3) of the UK GDPR.
1.1 Capitalised terms not defined in this DPA have the meaning given in the Customer Agreement. In this DPA:
“Aggregated Data” means data derived from the Customer’s use of the Service that has been aggregated and anonymised such that it does not identify, and cannot reasonably be used to identify, the Customer, any Practice Site, any User or any Data Subject;
“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” (and “process”), “Special Category Data” and “Supervisory Authority” have the meanings given in the UK GDPR;
“Customer Agreement” means the agreement between Chairsyde and the Customer for the provision of the Service, of which this DPA forms part;
“Customer Personal Data” means all Personal Data processed by Chairsyde on behalf of the Customer in connection with the Service, as described in Annex 1;
“Data Protection Legislation” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) and all other applicable laws relating to the processing of Personal Data and privacy in force in the United Kingdom from time to time, together with guidance and codes of practice issued by the Information Commissioner;
“Patient Communications” means SMS, email and other electronic messages generated and sent by the Service to Data Subjects in the Customer’s name and on the Customer’s behalf;
“PMS” means the Customer’s practice management system from which the Service obtains Customer Personal Data via an application programming interface, being at the date of this DPA Dentally (Henry Schein One UK Ltd, company number 02940919);
“Practice Site” means each dental practice location identified in the Customer Agreement at which the Service is used;
“Sub-processor” means any third party engaged by Chairsyde to process Customer Personal Data;
“UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018; and
“User” means an individual authorised by the Customer to access and use the Service.
1.2 The Annexes form part of this DPA. In the event of any conflict between this DPA and the Customer Agreement in relation to the processing of Personal Data, this DPA prevails. In the event of any conflict between the body of this DPA and an Annex, the body of this DPA prevails.
2.1 Controller and Processor. In respect of Customer Personal Data, the Customer (and where applicable each Practice Site) is the Controller and Chairsyde is the Processor. Each party shall comply with its obligations under the Data Protection Legislation.
2.2 Groups and multi-site customers. Where the Customer contracts on behalf of more than one Practice Site, the Customer enters into this DPA for itself and as agent for each Practice Site, warrants that it has authority to bind each Practice Site to this DPA, and shall procure each Practice Site’s compliance with it. Chairsyde may treat instructions from the Customer as instructions given on behalf of every Practice Site.
2.3 PMS provider. The Customer’s PMS provider processes Customer Personal Data under a separate agreement between the Customer and that provider. The PMS provider is not a Sub-processor of Chairsyde. Chairsyde is not a party to that agreement and is not responsible for the PMS provider’s processing, availability, or the accuracy of data held in the PMS.
2.4 User account data. Chairsyde is an independent Controller of the account, contact and usage data of Users that it collects to administer the Customer’s account and operate the Service. That processing is governed by Chairsyde’s Privacy Policy and not by this DPA.
3.1 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subject are set out in Annex 1.
3.2 The Customer acknowledges that Customer Personal Data includes Special Category Data (information concerning health) and that the processing described in Annex 1 is necessary for the Service to be provided.
4.1 Lawful basis. The Customer is solely responsible for determining and documenting a lawful basis under Article 6 UK GDPR, and a condition under Article 9 UK GDPR, for the processing of Customer Personal Data through the Service, and for providing Data Subjects with a privacy notice that describes that processing (including that a third party sends communications on the Customer’s behalf).
4.2 PECR and consents. The Customer is solely responsible for ensuring that each Patient Communication it configures or approves is lawful under PECR and for obtaining, recording and maintaining any consents or soft opt-in required. Chairsyde sends Patient Communications only as directed by the Customer and does not determine their purpose or content. Where Chairsyde makes template content available, the Customer remains responsible for approving it before use.
4.3 Instructions. The Customer warrants that its instructions to Chairsyde, including the configuration of the Service, comply with the Data Protection Legislation. The Customer’s instructions comprise the Customer Agreement, this DPA, the settings and templates the Customer configures or approves in the Service, and any further written instructions agreed between the parties.
4.4 Accuracy and opt-outs. The Customer is responsible for the accuracy of Customer Personal Data held in the PMS, including contact details and recorded communication preferences, and shall not override or re-engage a Data Subject who has opted out of Patient Communications.
4.5 Records. The Customer shall maintain records of the consents, notices and lawful bases referred to in this clause 4 and shall provide them to Chairsyde on reasonable request where Chairsyde requires them to respond to a Data Subject, a Supervisory Authority or a complaint.
5.1 Documented instructions. Chairsyde shall process Customer Personal Data only on the Customer’s documented instructions (as described in clause 4.3), including with regard to transfers of Customer Personal Data outside the United Kingdom, unless required to do otherwise by law to which Chairsyde is subject, in which case Chairsyde shall inform the Customer of that legal requirement before processing unless the law prohibits it from doing so. Chairsyde shall inform the Customer promptly if, in its opinion, an instruction infringes the Data Protection Legislation, and may suspend the affected processing until the instruction is confirmed or amended.
5.2 Own purposes. Chairsyde shall not process Customer Personal Data for any purpose other than providing the Service, except that Chairsyde may create and use Aggregated Data for any lawful purpose, including to operate, benchmark, improve and develop its products and services, during and after the term of the Customer Agreement.
5.3 Confidentiality. Chairsyde shall ensure that all personnel authorised to process Customer Personal Data are bound by written or statutory obligations of confidentiality, have received appropriate data protection training, and access Customer Personal Data only to the extent necessary to perform their role.
5.4 Security. Chairsyde shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to Data Subjects, including at least the measures described in Annex 3. Chairsyde may update those measures from time to time provided the overall level of security is not materially reduced.
5.5 Sub-processors. The Customer gives Chairsyde general written authorisation to engage the Sub-processors listed in Annex 2 and, subject to this clause, to appoint additional or replacement Sub-processors. Chairsyde shall:
(a) give the Customer at least 30 days’ written notice (email being sufficient) of any intended addition or replacement of a Sub-processor, during which the Customer may object on reasonable grounds relating to data protection;
(b) if the Customer objects and the parties cannot agree a resolution within 30 days, allow the Customer to terminate the Customer Agreement in respect of the affected Service on written notice without penalty, that being the Customer’s sole remedy;
(c) impose on each Sub-processor, by written contract, data protection obligations that are no less protective of Customer Personal Data than those in this DPA; and
(d) remain fully liable to the Customer for the performance of each Sub-processor’s obligations.
5.6 Data Subject requests. Chairsyde shall, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures in responding to requests from Data Subjects exercising their rights under the Data Protection Legislation (including access, rectification, erasure, restriction, portability and objection). Chairsyde shall notify the Customer within 2 business days if it receives such a request directly and shall not respond to the Data Subject except on the Customer’s instructions or as required by law. Chairsyde shall give effect to opt-outs received through the Service within 24 hours.
5.7 Assistance. Chairsyde shall assist the Customer, taking into account the nature of the processing and the information available to Chairsyde, in meeting the Customer’s obligations under Articles 32 to 36 UK GDPR (security, breach notification and communication, data protection impact assessments and prior consultation). Chairsyde may charge its reasonable costs for assistance that goes beyond what is required by the Data Protection Legislation or that arises from the Customer’s breach of this DPA.
5.8 Personal Data Breach. Chairsyde shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification shall, so far as the information is available to Chairsyde, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Chairsyde may provide the information in phases as it becomes available and shall cooperate reasonably with the Customer in its investigation, mitigation and any notification to a Supervisory Authority or Data Subjects. Chairsyde shall not notify a Supervisory Authority or Data Subjects of a breach on the Customer’s behalf unless instructed to do so or required by law.
5.9 Information and audit. Chairsyde shall make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 UK GDPR and shall allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, provided that:
(a) audits are limited to once in any 12-month period, unless required by a Supervisory Authority or following a Personal Data Breach affecting Customer Personal Data;
(b) the Customer gives at least 30 days’ written notice and the audit is conducted during business hours in a manner that does not unreasonably disrupt Chairsyde’s business;
(c) the auditor is bound by confidentiality obligations and is not a competitor of Chairsyde;
(d) Chairsyde may first satisfy the request by providing responses to a written security questionnaire, copies of relevant third-party certifications or audit reports, and a summary of its security measures; and
(e) each party bears its own costs.
5.10 Deletion and return. On expiry or termination of the Customer Agreement, or earlier on the Customer’s written request in respect of a Practice Site that ceases to use the Service, Chairsyde shall, at the Customer’s election, return or delete all Customer Personal Data within 90 days, and delete existing copies, unless and to the extent that UK law requires storage of that Personal Data. Customer Personal Data held in routine backups shall be deleted in accordance with Chairsyde’s backup cycle and in any event within a further 30 days, and shall not be restored to live systems during that period except as required by law. Chairsyde shall confirm deletion in writing on request. Chairsyde may retain Aggregated Data.
5.11 Records. Chairsyde shall maintain the records of processing required by Article 30(2) UK GDPR in respect of Customer Personal Data.
6.1 Chairsyde shall store and process Customer Personal Data in the United Kingdom and the European Economic Area and shall not transfer Customer Personal Data to, or permit access to it from, any other country unless:
(a) the transfer is to a country, territory or organisation covered by adequacy regulations under section 17A of the Data Protection Act 2018;
(b) the transfer is made under the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner, together with a transfer risk assessment; or
(c) another lawful transfer mechanism under the Data Protection Legislation applies.
6.2 The locations of processing by each Sub-processor are set out in Annex 2. The Customer authorises the transfers described in Annex 2 on the basis set out there.
7.1 Each party’s liability arising out of or in connection with this DPA, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is subject to the exclusions and limitations of liability set out in the Customer Agreement, which apply to this DPA as if set out in full.
7.2 The Customer shall indemnify Chairsyde against all claims, fines, losses, costs and expenses (including reasonable legal costs) arising from any claim by a Data Subject or Supervisory Authority to the extent caused by the Customer’s breach of clause 4 or by Chairsyde acting in accordance with the Customer’s instructions.
7.3 Nothing in this DPA relieves either party of its own direct responsibilities and liabilities under the Data Protection Legislation, including under Article 82 UK GDPR.
8.1 This DPA commences on the date stated on its first page and continues for as long as Chairsyde processes Customer Personal Data, notwithstanding expiry or termination of the Customer Agreement. Clauses 5.3, 5.10, 7 and 9 survive termination.
9.1 Changes in law. The parties shall negotiate in good faith any amendment to this DPA reasonably required as a result of a change in the Data Protection Legislation or guidance from the Information Commissioner. Chairsyde may update Annex 2 and Annex 3 in accordance with clauses 5.4 and 5.5 without a formal variation.
9.2 Variation. Subject to clause 9.1, no variation of this DPA is effective unless in writing and agreed by both parties.
9.3 Severance. If any provision of this DPA is found to be invalid, unenforceable or illegal, the remaining provisions remain in force and the parties shall replace the affected provision with a valid provision that achieves as nearly as possible the same effect.
9.4 Third party rights. Except for a Practice Site on whose behalf the Customer contracts, a person who is not a party to this DPA has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms.
9.5 Governing law and jurisdiction. This DPA and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) are governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
This DPA is accepted by the Customer when it accepts the Customer Agreement, including by ticking the acceptance box in Chairsyde’s online ordering process. The person accepting confirms that they are authorised to do so on behalf of the Customer and each Practice Site. No signature is required. Where a Customer contracts on behalf of a group of practices, Chairsyde may instead ask for a countersigned copy of this DPA.
Chairsyde keeps a record of the date and time of acceptance, the accepting person and the version of this DPA that applied.
Provision of Uptake by Chairsyde (Automated Patient Engagement) to the Customer, including automated Patient Communications sent in the Customer’s name.
The term of the Customer Agreement, plus the deletion period in clause 5.10.
Collection of Customer Personal Data from the Customer’s PMS via API; storage; analysis to identify courses of treatment that have been discussed or planned but not booked; generation and sending of SMS and email Patient Communications in the Customer’s name; provision of booking links; receipt and routing of patient replies to the Customer; recording and enforcement of opt-outs; campaign reporting and analytics; deletion.
To enable the Customer to follow up with its patients about unbooked treatment, appointment confirmations and reminders, treatment status updates and related administrative communications, and to report to the Customer on the outcome of those communications. Chairsyde does not send marketing communications of its own to Data Subjects.
Patients and prospective patients of the Customer and each Practice Site. Where a patient’s record includes a parent, guardian or other contact, that person.
Identity and contact data: name, email address, mobile telephone number, PMS patient identifier.
Appointment and treatment data: treatment plan items and status, treatment dates and values, appointment history and bookings, treating clinician and Practice Site.
Communication data: recorded contact permissions and preferences, opt-out status, Patient Communications sent and received, delivery and engagement metadata, replies.
Yes. Data concerning health (dental treatment planned, discussed or received). No other Special Category Data is intentionally processed. The Customer is responsible for identifying an Article 9 condition (clause 4.1).
For the term of the Customer Agreement, then deleted in accordance with clause 5.10.
United Kingdom and EEA, as set out in Annex 2.
The Customer authorises the following Sub-processors as at the date of this DPA. Chairsyde will keep this list up to date, make the current list available on request, and notify changes in accordance with clause 5.5.
Processing activity: Hosting and storage of the Service and Customer Personal Data
Location: UK and EEA
Transfer mechanism: n/a
Processing activity: Transmission of SMS Patient Communications and receipt of replies
Location: UK
Transfer mechanism: n/a
Processing activity: Transmission of email Patient Communications and receipt of replies
Location: UK
Transfer mechanism: n/a
Note: the Customer’s PMS provider (Dentally / Henry Schein One UK Ltd) is the Customer’s own Processor and is not a Sub-processor of Chairsyde.
Chairsyde maintains the following measures in respect of Customer Personal Data.
Customer Personal Data is encrypted in transit (TLS 1.2 or higher) between the PMS API, the Service, Users and Sub-processors, and encrypted at rest in Chairsyde’s systems using AES-256 or equivalent.
Role-based access on a least-privilege basis; named individual accounts; multi-factor authentication for Chairsyde staff access to production systems and for Users where enabled; access reviewed quarterly and removed promptly on role change or departure.
Access to the PMS is via the PMS provider’s authenticated API using credentials scoped to the Customer; Chairsyde reads only the fields required for the Service and does not write to clinical records.
Access to and actions on Customer Personal Data are logged; logs are protected from tampering and retained for 12 months; alerting on anomalous activity.
Regular patching of systems and dependencies; annual independent penetration test of the Service; remediation of findings according to severity.
Code review before release; separation of development, test and production environments; no Customer Personal Data used in non-production environments except in anonymised form.
Encrypted backups taken daily and stored in the same region; backup restoration tested annually; documented business continuity and disaster recovery plan.
Confidentiality obligations in employment and contractor terms; data protection and security training on joining and annually; background checks appropriate to role.
Documented incident response procedure covering detection, containment, assessment, notification (clause 5.8) and post-incident review.
Only the fields listed in Annex 1 are collected; opt-outs enforced automatically; deletion on exit per clause 5.10 with secure deletion methods.
Cyber Essentials
NHS DSPT
Welcome to Chairsyde AI. By accessing and using our platform, you agree to comply with and be bound by the following Terms and Conditions. Please read these carefully before using our services. If you do not agree to these terms, you should not use Chairsyde AI.
Chairsyde AI provides AI-powered note-taking and patient communication tools for dental professionals. By using the platform, you agree that you will use the services only for their intended purposes in accordance with these terms.
You must ensure that your use of Chairsyde AI complies with all applicable laws and regulations.
Unauthorized use of the platform is strictly prohibited.
To access the platform, you may need to create an account. You are responsible for maintaining the confidentiality of your login details and for all activities that occur under your account.
You agree to provide accurate and up-to-date information when registering.
Chairsyde AI reserves the right to suspend or terminate your account if any unauthorized activity is detected.
Your privacy is important to us. We collect and use personal data in accordance with our Privacy Policy. By using the platform, you consent to the collection, storage, and processing of your data as described in the policy.
All content, features, and functionality on Chairsyde AI, including but not limited to text, graphics, logos, and software, are the property of Chairsyde AI and are protected by intellectual property laws.
You may not modify, reproduce, or distribute any part of the platform without prior written consent.
Chairsyde AI operates on a subscription-based model. Upon signing up for a paid plan, you agree to the subscription fees and billing terms.
Subscription fees are non-refundable unless otherwise stated.
Chairsyde AI reserves the right to change subscription fees with appropriate notice to users.
Chairsyde AI provides its services "as is" without any warranties, expressed or implied. We do not guarantee that the platform will be error-free, secure, or available at all times.
Chairsyde AI will not be held responsible for any loss, damage, or liability resulting from your use of the platform, including but not limited to interruptions, inaccuracies, or unauthorized access to your data.
We reserve the right to terminate or suspend your access to Chairsyde AI at any time, without notice, for conduct that violates these Terms and Conditions or is otherwise harmful to the platform or other users.
Chairsyde AI may update these Terms and Conditions periodically. Any changes will be posted on the platform, and your continued use of the services constitutes acceptance of the revised terms.
These Terms and Conditions are governed by and construed in accordance with the laws of England and Wales. Any disputes relating to these terms shall be subject to the exclusive jurisdiction of the courts of England and Wales.
If you have any questions about these Terms and Conditions, please contact us at support@chairsyde.com.
.webp)
