Data Processing Agreement (DPA)

(last updated April 1, 2025)

This Data Processing Agreement (“DPA”) is entered into by and between:

(1) Medicinechest Ltd T/A BeWell (“Processor”, “BeWell”), a company incorporated in England and Wales; and
(2) The subscribing entity as defined in the applicable Order Form (“Controller”, “Pharmacy”).

This DPA is effective as of the Effective Date of the BeWell Master Services Agreement (the “Agreement”) and is incorporated therein by reference.

1. Purpose and Scope

1.1 This DPA governs the processing of Personal Data in the course of providing the BeWell Platform Services.

1.2 BeWell shall process Personal Data only on behalf of the Pharmacy and in accordance with applicable Data Protection Legislation, including the UK GDPR, the Data Protection Act 2018, and related NHS obligations (e.g., NHS DSPT).

2. Definitions

Terms not defined in this DPA shall have the meanings set out in the Agreement or applicable law.

• Personal Data: Any information relating to an identified or identifiable natural person.
• Special Category Data: Data revealing health, biometric data, or other sensitive categories as defined in Article 9 UK GDPR.
• Controller, Processor, Data Subject, Processing, Supervisory Authority: As defined under UK GDPR.
• Sub-processor: A third party engaged by the Processor to process Personal Data.

3. Roles of the Parties

3.1 The Pharmacy is the Data Controller of Shared Personal Data.

3.2 BeWell is the Data Processor except where BeWell independently determines processing purposes, in which case it acts as an Independent Controller.

4. Nature of Processing

• Subject Matter: Provision of digital healthcare software including appointment management, patient engagement, website services, patient health records, and communication tools.
• Duration: Throughout the Subscription Term and 30 days post-termination.
• Data Subjects: Patients, Authorised Users (e.g. pharmacy staff).
• Categories of Data:
  • Patient names and contact details
  • Dates of birth
  • Health-related data (prescriptions, conditions, consultations)
  • Staff logins and user activity logs

5. Processor Obligations

BeWell shall:

5.1 Process Personal Data as necessary to deliver, operate, maintain, and support the Platform Services in accordance with the Agreement, including for the purposes of hosting, transmitting, storing, displaying, and otherwise using such data to enable the functionality and features of the Platform as intended and used by the Pharmacy. BeWell shall not process Personal Data for other purposes unless required to do so by applicable law or with the Pharmacy’s written instructions.

5.2 Ensure that its own personnel and contractors who are authorised to process Personal Data on its behalf are subject to appropriate confidentiality obligations. BeWell is not responsible for the actions or omissions of Authorised Users or patients who access or interact with the Platform Services under the Pharmacy’s control, and the Pharmacy remains solely responsible for ensuring that its Authorised Users and patients handle Personal Data in accordance with applicable Data Protection Legislation and professional obligations.

5.3 Implement appropriate technical and organisational measures (e.g. encryption, access control, audit logs).

5.4 Provide reasonable assistance with:

• Responding to data subject rights requests;
• Conducting DPIAs;
• Notifying and managing personal data breaches.

5.5 Maintain and provide audit records upon written request no more than once per year.

6. Sub-processing

6.1 BeWell may engage Sub-processors provided:

• A written agreement is in place meeting Article 28 UK GDPR standards;
• The Pharmacy is notified of new Sub-processors and given the opportunity to object.

6.2 A list of Sub-processors is available upon request. BeWell remains fully liable for their acts and omissions.

7. International Transfers

7.1 BeWell shall not transfer Personal Data outside the UK or EEA unless:

• The transfer is to a country with an adequacy decision; or
• BeWell implements appropriate safeguards, such as the ICO’s IDTA or Standard Contractual Clauses.

7.2 Copies of transfer mechanisms will be made available on request.

8. Special Category Data

8.1 Where Special Category Data is processed, BeWell shall:

• Apply enhanced security measures (e.g., encryption at rest and in transit);
• Restrict access strictly to authorised personnel;
• Maintain logs of access and data handling activities.

8.2 All BeWell staff with access to such data shall receive privacy and security training.

9. NHS DSPT and Industry Compliance

9.1 BeWell shall maintain compliance with the NHS Data Security and Protection Toolkit (DSPT) and implement the National Data Guardian's 10 data security standards.

9.2 BeWell shall also follow guidance issued by the ICO, GPhC, and relevant UK health data regulators.

10. Data Breach Notification

10.1 BeWell shall notify the Pharmacy without undue delay (and no later than 48 Business Hours) of any Patient Data Breach.

10.2 The notification shall include:

• A description of the breach;
• Categories and numbers of affected individuals;
• Likely consequences;
• Mitigation actions taken or proposed.

11. Return or Deletion of Data

11.1 Upon termination of the Agreement, BeWell shall:

• Return all Patient Data to the Pharmacy upon request;
• Delete all Pharmacy Data (including backups) within 30 days, unless legally required to retain it.

11.2 Confirmation of deletion may be provided in writing upon request.

12. Independent Controllers (Shared Data)

12.1 Where Shared Personal Data is processed independently by each party:

• Each acts as an Independent Controller;
• Each agrees to process Shared Data only for lawful, agreed purposes;
• Each is responsible for its own legal compliance and data subject interactions.