This Customer Agreement (the "Agreement") is between:
(1) Chairsyde Video Consulting Limited (company number 12628115), a company registered in England and Wales whose registered office is at 1 Beauchamp Court, 10 Victors Way, Barnet, Hertfordshire, EN5 5TZ ("Chairsyde", "we", "us", "our"); and
(2) the dental practice or group identified in the Order (the "Customer", "you", "your"), together with each Practice Site on whose behalf it contracts.
It is made up of these Commercial Terms, the Order, and the Data Processing Agreement at Schedule 1. By accepting the Order (including by ticking the acceptance box in Chairsyde's online ordering process), the Customer agrees to be bound by this Agreement.
1.1 In this Agreement the following words have the following meanings. Capitalised words used in Schedule 1 and not defined here have the meaning given in Schedule 1.
"Activation Threshold" has the meaning given in clause 5.2.
"Annual Fee" means the fee set out in clause 5.1 or, where different, in the Order.
"Business Day" means a day other than a Saturday, Sunday or public holiday in England.
"Contract Year" means each period of 12 months starting on the Effective Date or an anniversary of it.
"DPA" means the Data Processing Agreement at Schedule 1.
"Effective Date" means the date on which the Customer accepts the Order.
"EULA" means the end user licence agreement that each User accepts in the Service.
"Order" means Chairsyde's online order form or payment page (including the Stripe payment page) identifying the Customer, each Practice Site, the Annual Fee and any special terms, as accepted by the Customer.
"Patient Communication" means an SMS, email or other electronic message generated and sent by the Service to a patient in the Customer's name.
"Payment Method" means the debit card, credit card or other payment instrument that the Customer registers with Chairsyde's payment provider when accepting the Order, or any replacement it registers later.
"PMS" means the Customer's practice management system, being at the Effective Date Dentally (Henry Schein One UK Ltd).
"Practice Site" means each dental practice location identified in the Order at which the Service is used.
"Rebooked Treatment Value" has the meaning given in clause 5.2.
"Service" means Uptake by Chairsyde, the automated patient engagement service described in clause 2, including its web application, PMS integration, Patient Communications, booking links and reporting.
"User" means an individual the Customer authorises to access and use the Service.
1.2 Clause and Schedule headings do not affect interpretation. "Including" means "including without limitation". References to a party include its successors and permitted assignees.
1.3 If there is a conflict between these Commercial Terms, the Order and the DPA: the DPA prevails on matters of data protection; the Order prevails over these Commercial Terms on the identity of the Customer and Practice Sites and on any fee or special term it expressly varies; and otherwise these Commercial Terms prevail. The EULA governs each User's individual use of the Service and does not vary this Agreement.
2.1 Chairsyde will provide the Service to the Customer for each Practice Site from the Effective Date for the term of this Agreement, in accordance with this Agreement.
2.2 The Service connects to the Customer's PMS through the PMS provider's API, identifies courses of treatment that have been recorded in the PMS as planned or discussed but not booked, sends Patient Communications to those patients in the Customer's name, routes patient replies to the Customer, records opt-outs, and reports to the Customer on bookings and treatment value attributable to those communications.
2.3 Chairsyde will onboard each Practice Site within 7 Business Days of receiving the PMS access and configuration information described in clause 6.2, and will use reasonable endeavours to make the Service available 24 hours a day except for planned maintenance (notified in advance where practicable) and events outside its reasonable control.
2.4 Chairsyde may improve, modify or replace features of the Service from time to time provided that the core functionality in clause 2.2 is not materially reduced during a Contract Year.
2.5 The Service depends on the PMS provider's API. Chairsyde is not responsible for the availability, performance, data accuracy or terms of the PMS, and may suspend the Service for a Practice Site while the PMS connection is unavailable.
3.1 This Agreement starts on the Effective Date and continues for an initial Contract Year. It then renews automatically for successive Contract Years unless either party gives written notice of non-renewal at least 30 days before the end of the current Contract Year, or it is terminated earlier under clause 12.
3.2 A Practice Site may be added by a further Order. A Practice Site may be removed at the end of a Contract Year on 30 days' written notice; the Annual Fee for that Practice Site is not refundable for the Contract Year in which notice is given.
4.1 The Customer may authorise as many Users at each Practice Site as it reasonably needs. The Customer is responsible for its Users, for keeping login details confidential, and for all activity under its accounts.
4.2 Each User must accept the EULA before using the Service. The EULA licenses the User's individual use; it does not create any obligation on Chairsyde to the User beyond that, and nothing a User accepts in the Service varies this Agreement or the Customer's liability for fees.
5.1 Annual Fee. The Customer shall pay Chairsyde an Annual Fee of £6,000 (inclusive of VAT at the prevailing rate) for each Practice Site for each Contract Year, or such other amount as is stated in the Order.
5.2 Activation Threshold. The Annual Fee for the first Contract Year for a Practice Site is not payable until the Rebooked Treatment Value for that Practice Site first reaches £12,000 (the "Activation Threshold"). "Rebooked Treatment Value" means the aggregate value, as recorded in the PMS, of courses of treatment that:
(a) were recorded in the PMS as planned or discussed but not booked at the time the Service sent a Patient Communication to the relevant patient about that treatment; and
(b) were booked in the PMS within 30 days after that Patient Communication was sent,
less the recorded value of any such booking that is cancelled in the PMS within 14 days of being made. Value is taken from the treatment plan item values recorded in the PMS at the time of booking, whether or not the treatment is subsequently attended, completed or paid for.
5.3 Measurement. Chairsyde's reporting from the PMS integration is the record of Rebooked Treatment Value. Chairsyde will make that reporting available to the Customer in the Service and will notify the Customer by email when the Activation Threshold is reached for a Practice Site (the "Threshold Notice"). Chairsyde may also send progress updates at interim milestones by email or messaging service, but only the Threshold Notice has contractual effect.
5.4 Disputes. If the Customer believes the Rebooked Treatment Value stated in a Threshold Notice is wrong, it must notify Chairsyde in writing within 7 days of the Threshold Notice, identifying the bookings it disputes and providing supporting PMS records. The parties will resolve any dispute in good faith within a further 14 days. Absent a dispute notified in time, the figure in the Threshold Notice is final. A dispute about one or more bookings does not suspend the charge if the undisputed bookings alone reach the Activation Threshold.
5.5 Payment authorisation and charging. By registering a Payment Method when accepting the Order, the Customer authorises Chairsyde and its payment provider to store that Payment Method and to charge it with the Annual Fee and any other sums due under this Agreement without further authorisation, provided that Chairsyde gives the Customer at least 5 Business Days' email notice before the first charge for a Practice Site. The Customer shall keep a valid Payment Method registered at all times and shall notify Chairsyde promptly if it changes. Chairsyde will issue a VAT invoice for each charge.
5.6 Avoidance of the Activation Threshold. The Activation Threshold is a deferral of the Annual Fee, not a condition of it. If, before the Activation Threshold is reached for a Practice Site, the Customer (a) terminates this Agreement in respect of that Practice Site other than under clause 12.2, (b) disconnects, restricts or revokes the Service's access to the PMS, (c) pauses or disables Patient Communications for more than 7 consecutive days, or (d) records bookings generated by Patient Communications outside the PMS or in a way that prevents them being counted, then the Annual Fee for that Practice Site becomes immediately payable if the Rebooked Treatment Value at that date is £12,000 or more.
5.7 Later Contract Years. The Annual Fee for each Contract Year after the first is payable in advance on the first day of that Contract Year and is not subject to the Activation Threshold.
5.8 Long-stop. If the Activation Threshold has not been reached for a Practice Site within 12 months of the Effective Date or of the start of the relevant Contract Year, either party may terminate this Agreement in respect of that Practice Site on 14 days' written notice.
5.9 Failed payments. If a charge to the Payment Method fails, Chairsyde may retry it and will notify the Customer. If the sum remains unpaid 7 days after that notice, Chairsyde may suspend the Service for the affected Practice Site until payment is received and may charge interest on the overdue sum at 4% a year above the Bank of England base rate from the due date until payment.
5.10 Fee changes. Chairsyde may change the Annual Fee for a subsequent Contract Year by giving at least 60 days' written notice before the end of the current Contract Year. If the Customer does not accept the change it may give notice of non-renewal under clause 3.1.
5.11 No refunds. Except as expressly stated in this Agreement, the Annual Fee is non-refundable once it has become payable.
5.12 Taxes. All sums are inclusive of VAT at the rate stated. If the VAT rate changes, the Annual Fee will be adjusted so that the net amount received by Chairsyde is unchanged.
6.1 The Customer shall use the Service only for following up its own patients about their dental treatment and related administrative communications, and in accordance with this Agreement and applicable law.
6.2 The Customer shall provide Chairsyde with the PMS access, credentials, message approvals and practice information reasonably required to onboard and operate the Service, and shall keep them accurate and current.
6.3 The Customer is responsible for the lawfulness of each Patient Communication it configures or approves, including compliance with the Privacy and Electronic Communications (EC Directive) Regulations 2003, as set out in clause 4 of the DPA. Chairsyde sends Patient Communications only on the Customer's instructions.
6.4 The Customer shall not: resell or sublicense the Service; use it to send communications unrelated to its patients' dental care; attempt to copy, reverse engineer or derive the source code of the Service; introduce malicious code; or use the Service in a way that damages Chairsyde's reputation or the deliverability of Patient Communications.
6.5 The Customer shall not take any step described in clause 5.6 with the purpose or effect of avoiding the Activation Threshold.
7.1 Chairsyde and its licensors own all intellectual property rights in the Service, its software, templates, reporting and documentation, and in any improvements. Nothing in this Agreement transfers those rights. Chairsyde grants the Customer a non-exclusive, non-transferable right to use the Service for its internal business purposes during the term.
7.2 The Customer owns its patient data. Chairsyde processes it as the Customer's Processor under the DPA and may create and use Aggregated Data as described in clause 5.2 of the DPA.
7.3 The Customer grants Chairsyde a licence during the term to use its name, logo and practice details for the purpose of sending Patient Communications in the Customer's name. Chairsyde may identify the Customer as a customer in its marketing materials unless the Customer objects in writing.
7.4 Any feedback the Customer gives about the Service may be used by Chairsyde without restriction or payment.
8.1 Each party shall keep confidential the other party's confidential information (including, for Chairsyde, the Customer's patient and business data and, for the Customer, the Service's pricing, performance data, methods and documentation) and shall use it only to perform this Agreement.
8.2 Clause 8.1 does not apply to information that is or becomes public other than through breach of this Agreement, that the receiving party already held lawfully, that is independently developed, or that must be disclosed by law or a regulator. Each party may disclose confidential information to its employees, contractors and professional advisers who need to know it and are bound by equivalent obligations.
8.3 This clause survives termination for 5 years.
9.1 Each party warrants that it has authority to enter into this Agreement. The Customer warrants that the person accepting the Order is authorised to bind the Customer and each Practice Site.
9.2 Chairsyde warrants that it will provide the Service with reasonable skill and care and substantially in accordance with clause 2.2. The Customer's sole remedy for breach of this warranty is for Chairsyde to correct the non-conformity or, if it cannot do so within a reasonable time, to refund a pro-rata part of the Annual Fee paid for the affected period.
9.3 Except as stated in this Agreement, all warranties, conditions and terms implied by law are excluded to the fullest extent permitted. Chairsyde does not warrant that any particular number of patients will respond, book or attend, or that any level of revenue will be achieved; the Activation Threshold in clause 5 is a fee mechanism and not a guarantee.
10.1 Nothing in this Agreement limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot be limited by law.
10.2 Subject to clause 10.1, neither party is liable to the other for any indirect or consequential loss, loss of profit, revenue, business, goodwill or anticipated savings, or for loss or corruption of data except as provided in the DPA.
10.3 Subject to clauses 10.1 and 10.2, each party's total aggregate liability arising out of or in connection with this Agreement (including the DPA) in any Contract Year, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the greater of £10,000 and 100% of the Annual Fees paid or payable by the Customer in that Contract Year.
10.4 The Customer's indemnity in clause 7.2 of the DPA is not subject to the cap in clause 10.3.
11.1 Chairsyde may suspend the Service, in whole or for a Practice Site, on notice where: a sum is overdue under clause 5.9; the Customer is in material breach of clause 6; Chairsyde reasonably believes a Patient Communication instruction is unlawful (clause 5.1 of the DPA); the PMS connection is unavailable; or suspension is necessary to protect the security or integrity of the Service. Chairsyde will restore the Service promptly once the reason for suspension has been resolved.
12.1 Either party may terminate this Agreement, or this Agreement in respect of a Practice Site, by notice of non-renewal under clause 3.1 or under clause 5.8.
12.2 Either party may terminate this Agreement immediately on written notice if the other party: commits a material breach that is not remedied within 30 days of written notice requiring it; or becomes insolvent, enters administration or liquidation, or ceases to trade.
12.3 Chairsyde may terminate this Agreement on written notice if the PMS provider withdraws or materially restricts the API access on which the Service depends and Chairsyde cannot reasonably provide the Service by other means. In that case Chairsyde will refund a pro-rata part of any Annual Fee paid in advance for the remainder of the Contract Year.
12.4 On termination: the Customer's right to use the Service ends; Chairsyde will stop sending Patient Communications; any sums that have become payable (including under clause 5.6) remain payable; and patient data will be returned or deleted under clause 5.10 of the DPA. Clauses 5 (to the extent sums remain payable), 7, 8, 10, 12.4 and 13 survive termination.
13.1 Notices. Notices must be in writing and sent by email to the address each party gives in the Order (for Chairsyde, support@chairsyde.com). A notice is treated as received on the next Business Day after sending, unless an automated delivery failure is received.
13.2 Changes to these terms. Chairsyde may update these Commercial Terms for a subsequent Contract Year by giving at least 60 days' written notice before the end of the current Contract Year. Changes to the DPA are governed by clause 9 of the DPA.
13.3 Assignment. The Customer may not assign or transfer this Agreement without Chairsyde's written consent (not to be unreasonably withheld, including on a sale of the practice). Chairsyde may assign this Agreement to a group company or a purchaser of its business on notice.
13.4 Entire agreement. This Agreement is the entire agreement between the parties about the Service and supersedes any prior proposal, pilot agreement or representation, except that nothing in this clause limits liability for fraud.
13.5 Force majeure. Neither party is liable for delay or failure caused by events outside its reasonable control, provided it notifies the other and uses reasonable endeavours to mitigate.
13.6 Severance, waiver and third parties. If any provision is invalid or unenforceable the remainder continues in force. No failure or delay in exercising a right is a waiver of it. Except for a Practice Site on whose behalf the Customer contracts, no third party may enforce this Agreement under the Contracts (Rights of Third Parties) Act 1999.
13.7 Governing law and jurisdiction. This Agreement and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) are governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
This Agreement, including the DPA at Schedule 1, is accepted by the Customer when it accepts the Order, including by ticking the acceptance box in Chairsyde's online ordering or payment process and registering a Payment Method. The person accepting confirms that they are authorised to do so on behalf of the Customer and each Practice Site, and that they have read clause 5 (Fees and Payment). No signature is required. Where a Customer contracts on behalf of a group of practices, Chairsyde may instead ask for a countersigned copy of this Agreement.
Chairsyde keeps a record of the date and time of acceptance, the accepting person, the Payment Method registered and the version of this Agreement that applied.
This Data Processing Agreement (the "DPA") forms part of, and is incorporated into, the Customer Agreement between:
(1) Chairsyde Video Consulting Limited (company number 12628115), a company registered in England and Wales whose registered office is at 1 Beauchamp Court, 10 Victors Way, Barnet, Hertfordshire, EN5 5TZ ("Chairsyde", "we", "us", "our"); and
(2) the customer identified in the Customer Agreement, together with each Practice Site on whose behalf it contracts (the "Customer", "you", "your").
This DPA is effective from the Effective Date of the Customer Agreement, or from the date the Customer accepts it, whichever is earlier.
A. Chairsyde provides Uptake by Chairsyde, an automated patient engagement service that integrates with the Customer's practice management system, identifies courses of treatment that have been planned but not booked, and sends automated communications to patients in the Customer's name (the "Service"), under the terms of the Customer Agreement.
B. In providing the Service, Chairsyde processes Personal Data relating to the Customer's patients on the Customer's behalf. That Personal Data includes information about dental treatment, which is Special Category Data.
C. This DPA sets out the terms on which Chairsyde processes that Personal Data as the Customer's Processor, as required by Article 28(3) of the UK GDPR.
1.1 Capitalised terms not defined in this DPA have the meaning given in the Customer Agreement. In this DPA:
"Aggregated Data" means data derived from the Customer's use of the Service that has been aggregated and anonymised such that it does not identify, and cannot reasonably be used to identify, the Customer, any Practice Site, any User or any Data Subject;
"Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" (and "process"), "Special Category Data" and "Supervisory Authority" have the meanings given in the UK GDPR;
"Customer Agreement" means the agreement between Chairsyde and the Customer for the provision of the Service, of which this DPA forms part;
"Customer Personal Data" means all Personal Data processed by Chairsyde on behalf of the Customer in connection with the Service, as described in Annex 1;
"Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") and all other applicable laws relating to the processing of Personal Data and privacy in force in the United Kingdom from time to time, together with guidance and codes of practice issued by the Information Commissioner;
"Patient Communications" means SMS, email and other electronic messages generated and sent by the Service to Data Subjects in the Customer's name and on the Customer's behalf;
"PMS" means the Customer's practice management system from which the Service obtains Customer Personal Data via an application programming interface, being at the date of this DPA Dentally (Henry Schein One UK Ltd, company number 02940919);
"Practice Site" means each dental practice location identified in the Customer Agreement at which the Service is used;
"Sub-processor" means any third party engaged by Chairsyde to process Customer Personal Data;
"UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018; and
"User" means an individual authorised by the Customer to access and use the Service.
1.2 The Annexes form part of this DPA. In the event of any conflict between this DPA and the Customer Agreement in relation to the processing of Personal Data, this DPA prevails. In the event of any conflict between the body of this DPA and an Annex, the body of this DPA prevails.
2.1 Controller and Processor. In respect of Customer Personal Data, the Customer (and where applicable each Practice Site) is the Controller and Chairsyde is the Processor. Each party shall comply with its obligations under the Data Protection Legislation.
2.2 Groups and multi-site customers. Where the Customer contracts on behalf of more than one Practice Site, the Customer enters into this DPA for itself and as agent for each Practice Site, warrants that it has authority to bind each Practice Site to this DPA, and shall procure each Practice Site's compliance with it. Chairsyde may treat instructions from the Customer as instructions given on behalf of every Practice Site.
2.3 PMS provider. The Customer's PMS provider processes Customer Personal Data under a separate agreement between the Customer and that provider. The PMS provider is not a Sub-processor of Chairsyde. Chairsyde is not a party to that agreement and is not responsible for the PMS provider's processing, availability, or the accuracy of data held in the PMS.
2.4 User account data. Chairsyde is an independent Controller of the account, contact and usage data of Users that it collects to administer the Customer's account and operate the Service. That processing is governed by Chairsyde's Privacy Policy and not by this DPA.
3.1 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subject are set out in Annex 1.
3.2 The Customer acknowledges that Customer Personal Data includes Special Category Data (information concerning health) and that the processing described in Annex 1 is necessary for the Service to be provided.
4.1 Lawful basis. The Customer is solely responsible for determining and documenting a lawful basis under Article 6 UK GDPR, and a condition under Article 9 UK GDPR, for the processing of Customer Personal Data through the Service, and for providing Data Subjects with a privacy notice that describes that processing (including that a third party sends communications on the Customer's behalf).
4.2 PECR and consents. The Customer is solely responsible for ensuring that each Patient Communication it configures or approves is lawful under PECR and for obtaining, recording and maintaining any consents or soft opt-in required. Chairsyde sends Patient Communications only as directed by the Customer and does not determine their purpose or content. Where Chairsyde makes template content available, the Customer remains responsible for approving it before use.
4.3 Instructions. The Customer warrants that its instructions to Chairsyde, including the configuration of the Service, comply with the Data Protection Legislation. The Customer's instructions comprise the Customer Agreement, this DPA, the settings and templates the Customer configures or approves in the Service, and any further written instructions agreed between the parties.
4.4 Accuracy and opt-outs. The Customer is responsible for the accuracy of Customer Personal Data held in the PMS, including contact details and recorded communication preferences, and shall not override or re-engage a Data Subject who has opted out of Patient Communications.
4.5 Records. The Customer shall maintain records of the consents, notices and lawful bases referred to in this clause 4 and shall provide them to Chairsyde on reasonable request where Chairsyde requires them to respond to a Data Subject, a Supervisory Authority or a complaint.
5.1 Documented instructions. Chairsyde shall process Customer Personal Data only on the Customer's documented instructions (as described in clause 4.3), including with regard to transfers of Customer Personal Data outside the United Kingdom, unless required to do otherwise by law to which Chairsyde is subject, in which case Chairsyde shall inform the Customer of that legal requirement before processing unless the law prohibits it from doing so. Chairsyde shall inform the Customer promptly if, in its opinion, an instruction infringes the Data Protection Legislation, and may suspend the affected processing until the instruction is confirmed or amended.
5.2 Own purposes. Chairsyde shall not process Customer Personal Data for any purpose other than providing the Service, except that Chairsyde may create and use Aggregated Data for any lawful purpose, including to operate, benchmark, improve and develop its products and services, during and after the term of the Customer Agreement.
5.3 Confidentiality. Chairsyde shall ensure that all personnel authorised to process Customer Personal Data are bound by written or statutory obligations of confidentiality, have received appropriate data protection training, and access Customer Personal Data only to the extent necessary to perform their role.
5.4 Security. Chairsyde shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to Data Subjects, including at least the measures described in Annex 3. Chairsyde may update those measures from time to time provided the overall level of security is not materially reduced.
5.5 Sub-processors. The Customer gives Chairsyde general written authorisation to engage the Sub-processors listed in Annex 2 and, subject to this clause, to appoint additional or replacement Sub-processors. Chairsyde shall:
(a) give the Customer at least 30 days' written notice (email being sufficient) of any intended addition or replacement of a Sub-processor, during which the Customer may object on reasonable grounds relating to data protection;
(b) if the Customer objects and the parties cannot agree a resolution within 30 days, allow the Customer to terminate the Customer Agreement in respect of the affected Service on written notice without penalty, that being the Customer's sole remedy;
(c) impose on each Sub-processor, by written contract, data protection obligations that are no less protective of Customer Personal Data than those in this DPA; and
(d) remain fully liable to the Customer for the performance of each Sub-processor's obligations.
5.6 Data Subject requests. Chairsyde shall, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures in responding to requests from Data Subjects exercising their rights under the Data Protection Legislation (including access, rectification, erasure, restriction, portability and objection). Chairsyde shall notify the Customer within 2 business days if it receives such a request directly and shall not respond to the Data Subject except on the Customer's instructions or as required by law. Chairsyde shall give effect to opt-outs received through the Service within 24 hours.
5.7 Assistance. Chairsyde shall assist the Customer, taking into account the nature of the processing and the information available to Chairsyde, in meeting the Customer's obligations under Articles 32 to 36 UK GDPR (security, breach notification and communication, data protection impact assessments and prior consultation). Chairsyde may charge its reasonable costs for assistance that goes beyond what is required by the Data Protection Legislation or that arises from the Customer's breach of this DPA.
5.8 Personal Data Breach. Chairsyde shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification shall, so far as the information is available to Chairsyde, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Chairsyde may provide the information in phases as it becomes available and shall cooperate reasonably with the Customer in its investigation, mitigation and any notification to a Supervisory Authority or Data Subjects. Chairsyde shall not notify a Supervisory Authority or Data Subjects of a breach on the Customer's behalf unless instructed to do so or required by law.
5.9 Information and audit. Chairsyde shall make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 UK GDPR and shall allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, provided that:
(a) audits are limited to once in any 12-month period, unless required by a Supervisory Authority or following a Personal Data Breach affecting Customer Personal Data;
(b) the Customer gives at least 30 days' written notice and the audit is conducted during business hours in a manner that does not unreasonably disrupt Chairsyde's business;
(c) the auditor is bound by confidentiality obligations and is not a competitor of Chairsyde;
(d) Chairsyde may first satisfy the request by providing responses to a written security questionnaire, copies of relevant third-party certifications or audit reports, and a summary of its security measures; and
(e) each party bears its own costs.
5.10 Deletion and return. On expiry or termination of the Customer Agreement, or earlier on the Customer's written request in respect of a Practice Site that ceases to use the Service, Chairsyde shall, at the Customer's election, return or delete all Customer Personal Data within 90 days, and delete existing copies, unless and to the extent that UK law requires storage of that Personal Data. Customer Personal Data held in routine backups shall be deleted in accordance with Chairsyde's backup cycle and in any event within a further 30 days, and shall not be restored to live systems during that period except as required by law. Chairsyde shall confirm deletion in writing on request. Chairsyde may retain Aggregated Data.
5.11 Records. Chairsyde shall maintain the records of processing required by Article 30(2) UK GDPR in respect of Customer Personal Data.
6.1 Chairsyde shall store and process Customer Personal Data in the United Kingdom and the European Economic Area and shall not transfer Customer Personal Data to, or permit access to it from, any other country unless:
(a) the transfer is to a country, territory or organisation covered by adequacy regulations under section 17A of the Data Protection Act 2018;
(b) the transfer is made under the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner, together with a transfer risk assessment; or
(c) another lawful transfer mechanism under the Data Protection Legislation applies.
6.2 The locations of processing by each Sub-processor are set out in Annex 2. The Customer authorises the transfers described in Annex 2 on the basis set out there.
7.1 Each party's liability arising out of or in connection with this DPA, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is subject to the exclusions and limitations of liability set out in the Customer Agreement, which apply to this DPA as if set out in full.
7.2 The Customer shall indemnify Chairsyde against all claims, fines, losses, costs and expenses (including reasonable legal costs) arising from any claim by a Data Subject or Supervisory Authority to the extent caused by the Customer's breach of clause 4 or by Chairsyde acting in accordance with the Customer's instructions.
7.3 Nothing in this DPA relieves either party of its own direct responsibilities and liabilities under the Data Protection Legislation, including under Article 82 UK GDPR.
8.1 This DPA commences on the date stated on its first page and continues for as long as Chairsyde processes Customer Personal Data, notwithstanding expiry or termination of the Customer Agreement. Clauses 5.3, 5.10, 7 and 9 survive termination.
9.1 Changes in law. The parties shall negotiate in good faith any amendment to this DPA reasonably required as a result of a change in the Data Protection Legislation or guidance from the Information Commissioner. Chairsyde may update Annex 2 and Annex 3 in accordance with clauses 5.4 and 5.5 without a formal variation.
9.2 Variation. Subject to clause 9.1, no variation of this DPA is effective unless in writing and agreed by both parties.
9.3 Severance. If any provision of this DPA is found to be invalid, unenforceable or illegal, the remaining provisions remain in force and the parties shall replace the affected provision with a valid provision that achieves as nearly as possible the same effect.
9.4 Third party rights. Except for a Practice Site on whose behalf the Customer contracts, a person who is not a party to this DPA has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms.
9.5 Governing law and jurisdiction. This DPA and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) are governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
This DPA is accepted by the Customer when it accepts the Customer Agreement, including by ticking the acceptance box in Chairsyde's online ordering process. The person accepting confirms that they are authorised to do so on behalf of the Customer and each Practice Site. No signature is required. Where a Customer contracts on behalf of a group of practices, Chairsyde may instead ask for a countersigned copy of this DPA.
Chairsyde keeps a record of the date and time of acceptance, the accepting person and the version of this DPA that applied.
Provision of Uptake by Chairsyde (Automated Patient Engagement) to the Customer, including automated Patient Communications sent in the Customer's name.
The term of the Customer Agreement, plus the deletion period in clause 5.10.
Collection of Customer Personal Data from the Customer's PMS via API; storage; analysis to identify courses of treatment that have been discussed or planned but not booked; generation and sending of SMS and email Patient Communications in the Customer's name; provision of booking links; receipt and routing of patient replies to the Customer; recording and enforcement of opt-outs; campaign reporting and analytics; deletion.
To enable the Customer to follow up with its patients about unbooked treatment, appointment confirmations and reminders, treatment status updates and related administrative communications, and to report to the Customer on the outcome of those communications. Chairsyde does not send marketing communications of its own to Data Subjects.
Patients and prospective patients of the Customer and each Practice Site. Where a patient's record includes a parent, guardian or other contact, that person.
Identity and contact data: name, email address, mobile telephone number, PMS patient identifier.
Appointment and treatment data: treatment plan items and status, treatment dates and values, appointment history and bookings, treating clinician and Practice Site.
Communication data: recorded contact permissions and preferences, opt-out status, Patient Communications sent and received, delivery and engagement metadata, replies.
Yes. Data concerning health (dental treatment planned, discussed or received). No other Special Category Data is intentionally processed. The Customer is responsible for identifying an Article 9 condition (clause 4.1).
For the term of the Customer Agreement, then deleted in accordance with clause 5.10.
United Kingdom and EEA, as set out in Annex 2.
The Customer authorises the following Sub-processors as at the date of this DPA. Chairsyde will keep this list up to date, make the current list available on request, and notify changes in accordance with clause 5.5.
Processing activity: Hosting and storage of the Service and Customer Personal Data
Location: UK and EEA
Transfer mechanism: n/a
Processing activity: Transmission of SMS Patient Communications and receipt of replies
Location: UK
Transfer mechanism: n/a
Processing activity: Transmission of email Patient Communications and receipt of replies
Location: UK
Transfer mechanism: n/a
Note: the Customer's PMS provider (Dentally / Henry Schein One UK Ltd) is the Customer's own Processor and is not a Sub-processor of Chairsyde. Chairsyde's payment provider processes the Customer's billing and Payment Method data as described in clause 2.4 and the Privacy Policy; it does not process Customer Personal Data.
Chairsyde maintains the following measures in respect of Customer Personal Data.
Customer Personal Data is encrypted in transit (TLS 1.2 or higher) between the PMS API, the Service, Users and Sub-processors, and encrypted at rest in Chairsyde's systems using AES-256 or equivalent.
Role-based access on a least-privilege basis; named individual accounts; multi-factor authentication for Chairsyde staff access to production systems and for Users where enabled; access reviewed quarterly and removed promptly on role change or departure.
Access to the PMS is via the PMS provider's authenticated API using credentials scoped to the Customer; Chairsyde reads only the fields required for the Service and does not write to clinical records.
Access to and actions on Customer Personal Data are logged; logs are protected from tampering and retained for 12 months; alerting on anomalous activity.
Regular patching of systems and dependencies; annual independent penetration test of the Service; remediation of findings according to severity.
Code review before release; separation of development, test and production environments; no Customer Personal Data used in non-production environments except in anonymised form.
Encrypted backups taken daily and stored in the same region; backup restoration tested annually; documented business continuity and disaster recovery plan.
Confidentiality obligations in employment and contractor terms; data protection and security training on joining and annually; background checks appropriate to role.
Documented incident response procedure covering detection, containment, assessment, notification (clause 5.8) and post-incident review.
Only the fields listed in Annex 1 are collected; opt-outs enforced automatically; deletion on exit per clause 5.10 with secure deletion methods.
Cyber Essentials; NHS DSPT.
.webp)
