Data processing agreement
This agreement applies from 12 October 2026. It forms part of the terms of service and governs our processing of personal data on your behalf. It is the written contract that UK GDPR Article 28(3) requires between a controller and a processor.
1. Who is who
You, or the organisation you work for, are the controller. You decide that a plan is written, what goes into it, and who it is sent to.
Thrive Better Living Limited, company number 15248600, Aacsl Accountants House, Unit 9, Astra Centre, Edinburgh Way, Harlow, CM20 2BN, is the processor. We process that plan on your instructions, to issue it to the care team and to record that it was read.
We are a controller in our own right for your practitioner account and for billing. That processing is described in the privacy notice, not here.
2. Subject matter, duration, nature and purpose
| Subject matter | Moving and handling plans written by your practitioners, the codes that open them, and the records of who opened them. |
|---|---|
| Duration | For as long as your subscription runs, plus the retention period in section 8. |
| Nature and purpose | Storing a plan, issuing a plan code, delivering a plan to a care provider you choose, recording access and read acknowledgements, and producing printable copies. |
| Types of personal data | The clinical content of a plan (mobility, transfers, weight bearing, equipment, risks, cognition, continence and similar), the client reference your service issues, the issuing practitioner’s name, role, registration number and contact details, and the name, role and organisation each carer records when they open a plan. |
| Special category data | Yes. A moving and handling plan is data concerning health under Article 4(15). We process it for the provision of health and social care under Article 9(2)(h) and paragraph 2 of Schedule 1 to the Data Protection Act 2018, and we hold the appropriate policy document that condition requires. |
| Categories of data subject | The people your plans are written for, your practitioners, and the carers who open plans. |
| Data we ask you never to send | Names, dates of birth and addresses of the people plans are written for. There is no field for them and they must not be put in free text. |
3. Our obligations
We will:
- process personal data only on your documented instructions, which are these terms and your use of the product, unless we are required to do otherwise by law, in which case we will tell you first unless the law forbids it;
- make sure everyone we authorise to process the data is under a duty of confidence;
- take the technical and organisational measures in section 6;
- engage a sub-processor only on the terms in section 4;
- help you respond to requests from data subjects, by giving you access to the plans and records held under your account and by answering questions about them;
- help you with your obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account what we know and what you can see yourself;
- delete or return the data at the end of the service, as set out in section 8;
- make available the information you need to show compliance with Article 28, and allow and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice and no more than once a year unless there has been a breach;
- tell you immediately if we think an instruction you give infringes data protection law.
4. Sub-processors
You give general authorisation for the sub-processors below. We will give at least 30 days’ notice by email before adding or replacing one, and you may object; if we cannot resolve the objection you may cancel without penalty for the remainder of the term you have paid for.
| Sub-processor | What it does | Where |
|---|---|---|
| Hostinger International Limited | Hosting, application and database storage | Company in Lithuania. Data stored on servers in the United Kingdom. |
| Stripe Payments Europe Limited, with Stripe Inc | Card payments and subscriptions. Billing details only. No plan content reaches Stripe. | Ireland, with processing in the United States under the UK Addendum to the EU standard contractual clauses. |
| Resend | Transactional email: verification, password resets, and the message carrying a plan code | United States, under the UK Addendum to the EU standard contractual clauses. |
We remain liable to you for the acts and omissions of each sub-processor.
5. International transfers
Plan content is stored in the United Kingdom. Where a sub-processor processes personal data outside the UK, as in the table above, the transfer is made under the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment that we will share on request.
6. Security
- Every page and every plan is served over HTTPS.
- Access to the application requires an account and a password; sign-in pauses after repeated failed attempts.
- A plan is opened with a plan code and no account, by design, so that a care provider can open it without signing up. A code expires 12 months after the plan was last saved and can be withdrawn by the issuing practitioner at any time.
- Our staff can see saved plans where it is necessary for support and audit. That access is limited to named administrators, is logged, and everyone with it is under a written duty of confidence.
- Drafts and client references a practitioner has not yet saved are kept in that practitioner’s own browser and stay on that device until removed there. On a shared computer, sign out.
- We test changes before release and keep the platform and its dependencies patched.
We are working towards Cyber Essentials and an NHS Data Security and Protection Toolkit submission. Neither is in place yet, and we will not claim either until it is.
7. Personal data breaches
If we become aware of a personal data breach affecting plans issued under your account, we will tell you without undue delay and in any event within 24 hours of becoming aware, with what we know about what happened, the categories and approximate numbers affected, the likely consequences, and what we are doing about it. You decide whether to report to the Information Commissioner’s Office, because you are the controller. Report an incident to us at hello@handlingplan.com with “Security” in the subject.
8. Deletion and return
Plans and their codes are deleted 12 months after the last save. Re-saving a plan renews it. If you need a longer retention period to meet your own records schedule, tell us before you onboard and we will agree it in writing. On termination we will, at your choice, return the plans held under your account in a readable format or delete them, within 30 days, except where we must keep a copy by law.
9. Audit and evidence
On request we will provide our appropriate policy document, our transfer risk assessment, a data protection impact assessment template for your own use, and answers to an information governance questionnaire. Ask at hello@handlingplan.com.
10. Order of precedence
Where this agreement and the terms of service differ on the processing of personal data, this agreement applies. Where a signed agreement between us and your organisation differs from either, that agreement applies.