Data processing agreement
The Article 28 terms between you, as controller of your customers’ personal data, and us, as your processor. It applies automatically to every Booked customer — there is nothing to request and nothing to sign.
The short version
A plain-English summary so you know what is in here. It is a guide, not the agreement — the numbered sections below are what actually applies.
- You are in charge of your customers’ data. We only act on your instructions, and using the software is the instruction.
- Your data is in your database, on your hosting. We hold no copy of your bookings, customers or documents. That is architectural, not a promise.
- Our sub-processors are listed below, with 30 days’ notice before any change and a right for you to object.
- We tell you about a breach without undue delay and in any event within 24 hours of becoming aware of one, so your own 72-hour clock is not spent waiting on us.
- Special-category data is covered explicitly, because clinics were the reason Booked exists and pretending otherwise would help nobody.
1 Who this is between, and when it applies #
This agreement is between you (the “Controller”) and Clayton Ball Limited, trading as Booked, company number 17478614 (the “Processor”, “we”, “us”). It forms part of the terms of service and takes effect when you first use Booked.
It satisfies Article 28(3) of the UK GDPR. If your own procurement process needs it signed on paper, or needs it appended to a framework agreement, write to privacy@trybooked.co and we will do that — but the protections apply from your first day whether or not anyone signs anything.
“UK GDPR”, “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the UK GDPR and the Data Protection Act 2018. “Data Protection Law” means those, together with the Privacy and Electronic Communications Regulations 2003, each as amended.
Where this agreement and the terms of service conflict on anything concerning personal data, this agreement prevails.
2 Who is the controller, and who is the processor #
You are the controller. You decide what questions to ask, what records to keep, how long to keep them, who at your business may see them and what lawful basis you rely on. Those decisions are yours and this agreement does not change them.
We are your processor for everything Booked does with that data on your behalf.
One structural fact shapes the whole of this document. Booked is a WordPress plugin: your appointments, customers, answers and documents are stored in your own database, on your own hosting. We do not hold them, we do not have a copy, and there is no central store containing every business’s records. Our processing is therefore narrower than a typical SaaS processor’s, and this agreement says which parts it covers.
Where we are a controller in our own right
Two narrow areas, named rather than buried:
- Your own account data — the people at your business who hold a login, your billing details, your support conversations. We are the controller of that and the privacy policy governs it.
- Booked Payments fraud, dispute and anti-money-laundering records. Payment law imposes duties on us and on our payment partner directly. For those specific duties we act as an independent controller over a limited set of transaction data — amount, time, outcome, the IP a booking was placed from, and the identity information the law requires. We do not use it for anything else.
3 Annex I — what we process, and why #
Subject matter and duration
Providing the Booked service to you, for as long as you are a customer, plus the short periods in section 11 for deletion.
Nature and purpose
Storing and organising appointments and customer records within your own database; sending appointment emails and text messages on your behalf; encrypting and serving documents your customers upload; writing appointments to a calendar you connect; taking payments where you use Booked Payments; and producing AI drafts where you use an AI feature.
Categories of data subject
- Your customers, patients or clients, and anyone they book on behalf of.
- Your own staff, where their name or working hours appear in the diary.
Types of personal data
| Category | Examples | Where it lives |
|---|---|---|
| Identity and contact | Name, email, phone, date of birth, address | Your database |
| Appointment records | Service, date, time, employee, status, attendance, notes | Your database |
| Answers to your questions | Anything your intake or screening forms ask, with full version history | Your database |
| Documents | Files a customer uploads, or you upload against a customer | Your server, encrypted, outside the web root |
| Payment records | Amount, currency, time, outcome, last four digits and card brand | Your database, and our payment partner |
| Consent records | What was agreed, when, from where, and any withdrawal | Your database |
| Technical | The IP address a booking was placed from, and the two-letter country code derived locally from it | Your database |
Special-category data
Yes — Booked is designed to handle it, and saying otherwise would be dishonest. A clinic asking about symptoms, medication, allergies, pregnancy or a test result is processing data concerning health under Article 9. Section 9 of this agreement deals with it specifically.
Frequency
Continuous, for as long as the service is in use.
4 Processing only on your instructions #
We process personal data only on your documented instructions, including on transfers out of the UK. This agreement, the terms of service, the settings you choose and your ordinary use of the software are your documented instructions, and no separate paperwork is needed for anything the product does by design.
We will not process the data for our own purposes. We will not sell it. We will not use it to train any AI model, ours or anyone else’s, and our AI sub-processor is contractually barred from training on it.
Where the law requires us to process something beyond your instructions, we will tell you before we do — unless the law that requires it also prohibits us from telling you, on important grounds of public interest.
We will tell you immediately if we think an instruction breaches Data Protection Law, and we may pause that particular processing until it is resolved. We are not obliged to give you legal advice, and we will not pretend to.
5 Confidentiality of our people #
Everyone we authorise to process personal data is bound by a written duty of confidentiality that survives their leaving, is trained in data protection before they are given access, and gets access only to what their job needs.
Nobody at Booked has standing access to a customer’s database. Booked runs on your hosting, so we have none by default. Where we need access to help you with something, you grant it, it is time-limited, and every administrative action is written to your own audit log where you can read it.
6 Annex II — the security measures #
Under Article 32 we implement appropriate technical and organisational measures. These are the ones actually in place. The security page has the engineering detail behind each.
Technical measures
| Measure | What is actually implemented |
|---|---|
| Isolation between customers | Architectural, not policy-based. Each customer’s data is in their own database on their own hosting. There is no shared table containing more than one business’s records, so a compromise of one customer cannot expose another. |
| Encryption in transit | TLS on every connection to our hosted services and to every sub-processor. |
| Encryption at rest | Documents are encrypted with AES-256-GCM and stored outside the web root, reachable only through a permission-checked route that sniffs the MIME type and serves under a restrictive Content-Security-Policy. The database itself is encrypted at rest where your host provides it — a matter for your hosting, not for us. |
| Access control | Permission checks on every one of the REST routes, evaluated per request rather than at the menu. Granular staff roles. A passwordless customer portal with single-use, expiring links. |
| Input handling | The public booking form is treated as hostile: prepared statements throughout, nonces on state-changing admin actions, rate limits on every public endpoint, and upload validation by content rather than by file extension. |
| Logging | An audit log of administrative actions, an error log, and a full version history of every answer — a corrected answer supersedes the old one rather than erasing it. |
| Pseudonymisation | Country is stored as a two-letter code resolved locally; no IP address leaves your server for that purpose. AI usage is metered without storing any prompt or response text. |
| Integrity | Signed licence grants (Ed25519) and tamper checks on the plugin’s own files. |
| Resilience | Continuous monitoring of the hosted services with public incident reporting at status. |
Organisational measures
- Least-privilege access to production, reviewed when someone joins or leaves.
- Written confidentiality obligations and data protection training for everyone with access.
- Change control: code review, a fixed release cadence and a published changelog.
- A documented breach procedure with the notification times in section 8.
- A security reporting address, and a commitment not to pursue good-faith researchers.
What we do not have
Measures may change as the product develops, but we will not reduce the overall level of security during your subscription.
7 Annex III — sub-processors #
You give general authorisation for us to engage sub-processors, subject to the notice and objection rights below. Each is bound by written terms no less protective than these, and we remain fully liable to you for what they do.
Several apply only if you switch a feature on. A business that never sends a text message has no relationship with our SMS provider.
| Sub-processor | What it does | Data it sees | Where | Transfer mechanism |
|---|---|---|---|---|
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Card processing, payouts, identity and anti-fraud checks for Booked Payments, and our own subscription billing. | Cardholder name, email, payment amount, card details entered directly into Stripe’s own fields, and for business owners the identity and bank details required by law. | Ireland and the United States | UK Addendum to the EU Standard Contractual Clauses |
| Telnyx LLC | Sending text messages — reminders, confirmations and follow-ups — and, where a country requires one, providing the phone number they are sent from. | Mobile number and the text of the message. | United States | UK International Data Transfer Addendum to the EU Standard Contractual Clauses; Telnyx is also certified under the EU-US Data Privacy Framework |
| Anthropic PBC | Runs the AI features — drafting questions, summarising a month, writing up a consultation note, preparing a dispute response. | Only the structured facts the named feature needs. Anthropic does not train on this data and it is not retained for training. | United States | UK Addendum to the EU Standard Contractual Clauses |
| Google Ireland Limited | Writing your bookings into your Google Calendar, and sending your confirmations and reminders from your own Gmail — whichever of the two you connect. | For the calendar: appointment time, service name and the customer name you choose to include. For email: the message itself, which is the booking email you would have sent anyway. | Ireland and the United States | UK Addendum to the EU Standard Contractual Clauses |
| Microsoft Ireland Operations Limited | Writing your bookings into your Microsoft 365 calendar, and sending your confirmations and reminders from your own Outlook — whichever of the two you connect. | For the calendar: appointment time, service name and the customer name you choose to include. For email: the message itself, which is the booking email you would have sent anyway. | Ireland and the United States | UK Addendum to the EU Standard Contractual Clauses |
Changing this list
- We will give you at least 30 days’ notice by email before a new sub-processor starts, or before an existing one takes on a materially different role.
- You may object within those 30 days on reasonable data-protection grounds, in writing, saying what the grounds are.
- We will work with you to find an answer — usually turning off the feature that needs them. If we cannot, you may terminate the affected part of the service and we will refund the unused part of your fees for it.
- Where a change is urgent and necessary for security, we may act sooner, and we will tell you immediately and explain why.
Your own hosting provider is not a sub-processor of ours. You chose them and your data sits with them under your own contract — which is worth remembering, because for most customers their host sees more of their data than we do.
8 Personal data breaches #
We will notify you without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting personal data we process for you. Twenty-four hours, not seventy-two: your own 72-hour deadline to the ICO should not be spent waiting for us.
The notification will give you what Article 33(3) requires, as far as we know it at the time:
- What happened and when, and when we found out.
- The categories and approximate number of data subjects and records affected.
- The likely consequences.
- What we have done and are doing to address it and limit the harm.
- A named contact who can answer follow-up questions.
Where we do not have all of it at once we will send what we have and follow up in stages rather than delaying the first notification. We will not notify the ICO or your data subjects on your behalf unless you ask us to in writing — that decision is the controller’s and we will not pre-empt it.
We will keep a record of every breach, and give you reasonable help with your own investigation, notification and any subsequent enquiry.
One boundary worth being clear about: a compromise of your website, hosting or WordPress installation is a breach of your systems, not ours. We will help you investigate it as far as we can, but we may have no visibility into it — your data is on your server. That is also why Booked WP Security exists.
9 Special-category and health data #
Booked was built for pharmacies and clinics, so it processes data concerning health as a matter of course. This section says who is responsible for what.
Yours
- Identifying the Article 9(2) condition you rely on — usually explicit consent under 9(2)(a), or the provision of health care under 9(2)(h) where you are a health professional under a duty of confidentiality.
- Where you rely on explicit consent, obtaining it properly: specific, informed, freely given, and recorded. Booked gives you per-question consent records with a timestamp, the wording as it was shown at the time, and a withdrawal that is a timestamp rather than a deletion — so you can prove what was agreed and when.
- Completing a Data Protection Impact Assessment where Article 35 requires one. Large-scale processing of health data usually does. We will give you what you need about the software to complete it.
- Deciding retention. We do not delete a clinical record on our own initiative.
Ours
- Processing it only on your instructions, with the measures in section 6.
- Keeping the specific protections built for it: the answers held per customer with full version history; documents encrypted and outside the web root; discretion rules that refuse to place a sensitive answer in an email subject line or the first 40 characters of a text — the part a locked phone previews — enforced at save time and matched by token shape, so renaming a question cannot slip past it.
- The staff stop control: when a member of your staff stops a message flow for a person, queued runs are cancelled, re-enrolment is blocked, and the stop is re-checked at the moment of sending rather than only at the moment of queuing.
- Including answers in the subject-access export, with sensitive sections marked so that a response can be checked before it is sent.
- Deleting answers when you delete a customer.
Two things we will not do: we will not use health data for any purpose of our own, and we will not send it to an AI feature unless you use a feature that plainly requires it — the AI note-taker being the obvious one, where the whole point is writing up a consultation.
10 Helping you meet your own obligations #
Data subject rights
Because the data is in your database, you can answer most requests yourself and immediately, which is faster than any process involving us. Booked includes, for every customer record: a complete export covering bookings, answers with their history, documents, messages sent and consent records; deletion that removes the customer and their answers; and editing, for correction.
If a data subject contacts us directly about your data, we will not respond to the substance. We will tell them to contact you and tell you it happened, promptly.
Where you need help beyond the built-in tools, we will give it, taking account of the nature of the processing and what is available to us. We do not charge for reasonable assistance.
Impact assessments and consultation
We will give you reasonable help with a Data Protection Impact Assessment under Article 35 and with any prior consultation with the ICO under Article 36, again taking account of what is available to us. In practice that means answering questions about how the software works — which is the part you cannot answer without us.
11 Deletion and return #
When your subscription ends, your data does not go anywhere. It is in your database on your hosting and it stays there, yours to keep, export or delete. We cannot delete it, and we would not want the ability to.
What we delete is our own side:
- Anything held on our platform for you — queued messages, cached licence data, AI usage records beyond the meter — within 30 days of termination.
- Your account, licence and support history on the schedule in the privacy policy.
- Sub-processors delete on their own contractual schedules, which we will confirm on request.
We keep what the law requires us to keep — payment and anti-money-laundering records in particular — and only for as long as it requires, and only for that purpose.
We will certify deletion in writing on request.
12 Audit and information #
We will make available all the information you reasonably need to demonstrate that we meet Article 28, and allow and contribute to audits, including inspections, by you or an auditor you appoint.
Practically:
- Ask us anything about how it works and we will answer — in writing, with detail. The security page is the same information written for everyone, including the gaps.
- One on-site or remote audit per year on 30 days’ notice, at a reasonable time, without unreasonable disruption, and subject to confidentiality. More often if a regulator requires it, or after a breach affecting your data.
- Where an audit needs access to another customer’s environment, we will not give it — that isolation is what protects you too.
- You bear your own costs. We bear ours for the first audit each year.
If we obtain an independent certification or report, we will make it available and you may rely on it in place of your own inspection. We do not have one yet, and section 6 says so.
13 International transfers #
Our own systems are in the United Kingdom. Where a sub-processor is not, Annex III names the country and the mechanism.
Every transfer out of the UK is made under the International Data Transfer Addendum to the EU Standard Contractual Clauses, or under UK adequacy regulations where they cover the destination. We assess the risk of each destination, apply the measures in section 6, and will give you a copy of the clauses for any transfer affecting you on request.
If a transfer mechanism we rely on is invalidated, we will tell you promptly, stop the transfer if there is no lawful alternative, and work with you on one.
You may prevent an international transfer entirely by not enabling the features that involve one. A customer who uses no AI feature, no managed SMS and no connected calendar has no personal data leaving the United Kingdom under this agreement other than through our payment partner, and only if they use Booked Payments.
14 Liability, term and law #
Each of us is liable for our own compliance with Data Protection Law. Liability under this agreement is subject to the limits in section 14 of the terms of service, except where Data Protection Law does not permit it to be limited — in which case it is not limited.
Nothing here limits a data subject’s rights, or a regulator’s powers, against either of us.
This agreement lasts as long as we process personal data for you, and the obligations that should outlive it — confidentiality, deletion, audit records — do.
It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Anything about this document goes to privacy@trybooked.co. If your procurement needs it signed, countersigned or appended to a framework, say so and we will do it.