Data Processing Agreement

Last updated: 15 July 2026

1. Definitions

In this DPA:

• "Controller" means you — the professional or studio that determines the purposes and means of processing client data.
• "Processor" means Ricorda, which processes personal data on behalf of the Controller.
• "Data Subject" means a client whose personal data is processed via the platform.
• "Personal Data" has the meaning given in the UK GDPR and the Data Protection Act 2018.
• "Sub-processor" means a third party engaged by Ricorda to assist in processing personal data.

2. Scope and Purposes of Processing

Ricorda processes the following categories of personal data on behalf of the Controller solely for the purpose of providing the Ricorda record-keeping and scheduling service:

Data Category	Examples	Classification
Client identity data	Name, date of birth, email address, phone number, Ricorda passport ID	Personal data
Session records	Session type, date, status, session photos, and any optional free-text notes the Controller chooses to add	Personal data
Health and aftercare information	Allergies, conditions, medication, medical history, aftercare details and related session notes	Special-category personal data where it concerns health
Agreement records	Forms and agreements signed by the client, including the signature method and the date signed	Personal data
Account audit logs	Timestamps and records of account and record activity	Personal data

Data concerning health is special-category personal data. Before directing Ricorda to process it, the Controller must identify and document both an Article 6 lawful basis and an applicable Article 9 condition, together with any additional requirements under the Data Protection Act 2018. The Controller must limit structured and free-text records to information necessary for the stated purpose. Ricorda processes that information only on the Controller's documented instructions and for no other purpose.

3. Duration of Processing

Processing continues while the Controller's account remains open. Subscription cancellation or expiry may restrict Studio features but does not itself constitute an instruction to delete the account. The Controller can export data from account settings before deletion. On a confirmed account-deletion instruction:

• Ricorda first attempts to cancel any active Studio subscription; if cancellation cannot be confirmed, deletion is stopped so it can be retried safely
• Once confirmed, account-associated personal data is deleted and cannot subsequently be exported
• Independent payment, tax or legal records may be retained by Ricorda or its payment provider only where applicable law requires it

4. Controller Obligations

The Controller shall:

• Ensure a lawful basis exists under UK GDPR (such as consent, legitimate interests, or the performance of a contract) for all personal data it directs the Processor to handle
• Ensure clients are provided with a privacy notice informing them that Ricorda is used to store their records
• Respond to data subject access requests, rectification requests, and erasure requests within the statutory timeframe (one calendar month)
• Notify the Processor without undue delay upon becoming aware of any data breach involving personal data processed through the platform
• Maintain records of processing activities as required by UK GDPR Article 30

5. Processor Obligations

Ricorda (the Processor) shall:

• Process personal data only on documented instructions from the Controller, or as required by applicable law
• Ensure that all personnel authorised to process personal data are bound by appropriate confidentiality obligations
• Implement and maintain appropriate technical and organisational security measures (see Section 7)
• Assist the Controller in fulfilling its obligations under UK GDPR Articles 32–36, including data subject rights, security, breach notification, data protection impact assessments, and prior consultation
• Notify the Controller within 72 hours of becoming aware of a personal data breach affecting the Controller's data
• Delete or return all personal data to the Controller upon termination of the subscription (see Section 3)
• Provide all information reasonably necessary to demonstrate compliance with this DPA and UK GDPR Article 28

6. Sub-processors

By accepting these terms, the Controller authorises Ricorda to use the following sub-processors. Ricorda will impose data protection obligations on each sub-processor equivalent to those in this DPA.

Sub-processor	Role	Data processed	Location
Google Cloud / Firebase	Cloud infrastructure, database (Firestore), file storage, authentication, push notifications and crash reporting	All client data and session records	EU (europe-west1 / eur3 region)
Stripe	Payment processing and subscription management	Professional billing details only — no client records are shared with Stripe	EU / UK (Stripe UK Ltd)
Resend	Transactional email delivery	Email address and name only, for notification and account management emails	EU

Ricorda will notify Controllers of any intended addition or replacement of sub-processors by updating this DPA and providing notice by email. If a Controller objects to a new sub-processor, they may terminate their subscription within 30 days of the notice.

7. Security Measures

Ricorda implements the following technical and organisational security measures:

• Encryption in transit: All data is transmitted over TLS 1.2 or higher
• Encryption at rest: All data stored in Google Cloud / Firebase is encrypted using AES-256
• Application-layer encryption of sensitive clinical fields: Sensitive clinical fields (such as allergies, conditions, and medications) are additionally encrypted at the application layer using a hardware-backed key management system (Google Cloud KMS) held separately from the database. These fields are stored only as ciphertext and are decrypted solely by the authenticated backend for the data subject and the professionals they have approved — they are not readable from the database itself
• Access controls: Firestore security rules ensure each professional can only access their own clients' data
• API protection: Firebase App Check prevents unauthorised API access from unofficial clients
• Authentication: Email OTP and Google Sign-In; session tokens expire automatically
• Staff access: Access to production data by Ricorda personnel is limited to what is strictly necessary for support and maintenance purposes
• Audit logging: All session record writes are logged with timestamp and actor

While Ricorda implements appropriate technical and organisational measures designed to protect personal data, no method of transmission or storage is completely secure, and Ricorda cannot guarantee absolute security. Ricorda's obligation is to maintain a level of security appropriate to the risk, as required by UK GDPR Article 32, and not to guarantee that a breach will never occur.

8. International Data Transfers

Client data is stored primarily within the EU (Google Cloud europe-west1 / eur3 region). Where sub-processors transfer data outside the UK or EEA, such transfers are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the relevant supervisory authority or a UK adequacy decision.

9. Data Subject Rights

Ricorda will assist the Controller in responding to data subject requests within a reasonable timeframe, allowing the Controller to meet its statutory deadlines (one calendar month under UK GDPR).

Clients may also exercise certain rights directly via the Ricorda ID app:

• Access: Clients can view their full session history and records in the app
• Erasure: Clients can delete their account and associated data via Profile → Delete Account
• Correction: Clients can update their personal information and records in the app

Where a client submits a request directly to Ricorda relating to data controlled by a professional, Ricorda will forward the request to the relevant Controller within 5 working days.

10. Data Breach Notification

In the event of a personal data breach, Ricorda will:

• Notify affected Controllers within 72 hours of becoming aware of the breach
• Provide information on the nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken or proposed to address the breach
• Cooperate fully with the Controller and, where required, with the Information Commissioner's Office (ICO)

11. Audit Rights

The Controller may audit Ricorda's compliance with this DPA on reasonable written notice (at least 14 days), no more than once per year, and at the Controller's own expense. Audits must be conducted during normal business hours and in a manner that minimises disruption to Ricorda's operations.

12. Liability

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Professional Terms of Use, which apply to this DPA as if set out in full here. In particular, the Processor's total aggregate liability to the Controller under this DPA shall not exceed the cap set out in those terms (the greater of the subscription fees paid in the twelve (12) months preceding the claim, or £100).

The Processor is liable only for damage caused by processing where it has not complied with obligations under the UK GDPR specifically directed to processors, or where it has acted outside or contrary to the Controller's lawful documented instructions. The Controller remains responsible for ensuring a lawful basis for processing, for the lawfulness of its instructions, and for the content and nature of the data it directs the Processor to process.

Nothing in this DPA limits or excludes either party's liability to a data subject under Article 82 of the UK GDPR, or any other liability that cannot lawfully be limited or excluded.

13. Indemnity

The Controller shall indemnify and hold the Processor harmless against all claims, losses, liabilities, fines, penalties, and costs (including reasonable legal fees) — including any compensation paid to a data subject under Article 82 of the UK GDPR and any administrative fine imposed by a supervisory authority — to the extent arising from:

• the Controller's lack of a valid lawful basis for processing, or its failure to obtain or evidence any required consent;
• special-category or otherwise sensitive personal data entered into the platform otherwise than in accordance with this DPA and the Processor's instructions;
• the Controller's breach of this DPA, the Professional Terms of Use, or applicable data protection law;
• the Controller's instructions, where following them caused the Processor to infringe data protection law.

The Processor shall indemnify the Controller against claims, losses, and liabilities to the extent directly arising from the Processor's own breach of its processor obligations under this DPA, subject to the limitation of liability above.

14. Governing Law

This DPA is governed by the laws of England and Wales. Disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

15. Contact

Data protection enquiries and subject access requests:

• Email: hello@ricorda.co.uk
• Website: ricorda.co.uk/support