Master Governance Pack • Section 4

Data Processing Agreement (DPA)

Statutory UK GDPR Article 28 Compliance Specification for Subscribing Care Agencies

Contractual DPA Framework UK GDPR Article 28 Compliant
Data Processor: FUSION-SYNTH TECHNOLOGIES LTD ('CareAssist')
Company Number: SC806877 (Registered in Scotland)
Registered Office: 17 Mill Street, Alloa, Clackmannanshire, FK10 1DT, UK
Data Controller: The Subscribing Care Agency
Effective Date: Date of Service Order / Digital Onboarding
DPO Contact: info@fusionsynthtech.co.uk

This Data Processing Agreement governs all processing of personal data and special category health/care records carried out by FUSION-SYNTH TECHNOLOGIES LTD ('Processor') on behalf of the subscribed care agency ('Controller'). It satisfies the mandatory requirements of Article 28(3) of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

4.1 Processing Subject Matter & Documented Instructions

The Processor shall process personal data solely on documented instructions from the Controller, including with respect to international transfers, unless required to do so by applicable UK statutory law. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law.

4.2 Security & Confidentiality (Article 28(3)(b)-(c))

  • All personnel, contractors, and engineers authorized to process personal data have committed themselves to confidentiality through legally binding non-disclosure agreements and have completed mandatory information governance and data protection training.
  • The Processor continuously implements technical and organizational measures compliant with Article 32 UK GDPR, including TLS 1.3 encryption in transit, AES-256 block-level encryption at rest, multi-factor authentication, tenant separation, and automated vulnerability scanning.

4.3 Subprocessors (Article 28(3)(d))

The Controller grants general written authorization to the appointment of the infrastructure and operational subprocessors detailed in our Approved Subprocessor Register (Section 17.1).

The Processor shall provide at least 30 calendar days' advance written notice before appointing or replacing any subprocessor. All appointed subprocessors are bound by contractual agreements imposing data protection obligations no less onerous than those set out in this DPA.

4.4 24-Hour Breach Notification (Article 28(3)(f))

Guaranteed 24-Hour Incident Window

The Processor shall notify the Controller without undue delay, and in any event within 24 hours of becoming aware, of any confirmed or reasonably suspected Personal Data Breach affecting Controller data.

The notification shall describe the nature of the incident, the categories and approximate number of affected data subjects and records, the contact details of the DPO, the likely consequences, and the immediate mitigation measures implemented.

4.5 Deletion or Return of Data (Article 28(3)(g))

Upon termination of the service agreement, the Processor shall, at the choice of the Controller, return all customer personal data in an industry-standard structured format (JSON/CSV) or securely delete all existing copies within 60 calendar days, subject to verified database backup cycle expirations.

4.6 Official Processing Schedule

Subject Matter: Digital domiciliary care management, visit scheduling, eMAR charts, carer roster dispatch, compliance auditing.
Duration of Processing: The duration of the Customer subscription agreement plus statutory retention wind-down periods.
Categories of Data Subjects: Subscribed agency staff, field carers, care coordinators, service users (clients), family contacts, emergency contacts, authorized advocates.
Categories of Personal Data: Names, contact numbers, email addresses, home addresses, visit timestamps, GPS coordinates at clock-in/out.
Special Categories of Data (Article 9): Service user diagnosed medical conditions, dietary requirements, mobility assessments, DNACPR statuses, and electronic Medication Administration Records (eMAR).