Version: 1.0
Effective Date: 11 December 2025
This Data Processing Addendum ("DPA") forms part of the customer agreement governing use of the Medicasimple Services (the "Agreement") and applies where MEDICASIMPLE HEALTHCARE TECHNOLOGIES LIMITED processes Personal Data on behalf of a customer.
1.1 Customer (Controller)
The legal entity that has entered into the Agreement with MEDICASIMPLE HEALTHCARE TECHNOLOGIES LIMITED ("Customer").
1.2 Processor
MEDICASIMPLE HEALTHCARE TECHNOLOGIES LIMITED (company no. 15485001) ("Medicasimple").
2.1 UK GDPR Terms
Terms such as Personal Data, Processing, Controller, Processor, and Special Category Data have the meanings given in the UK GDPR.
2.2 Services
The Medicasimple software and related support/services provided under the Agreement.
2.3 Sub-processor
Any processor engaged by Medicasimple to process Personal Data on behalf of Customer.
3.1 Roles
3.2 Processing Instructions
Medicasimple will process Personal Data only as necessary to provide the Services and in accordance with Customer's documented instructions, including as set out in this DPA and the Agreement.
4.1 Subject matter
Provision of the Services (hosting, account administration, support, maintenance, service monitoring, and customer communications).
4.2 Duration
For the term of the Agreement, plus any period required for return/deletion under Clause 11.
4.3 Nature and purpose
Secure operation of the Services; user authentication; support and troubleshooting; service monitoring; billing and account management; security and fraud prevention.
4.4 Categories of data subjects
Customer staff; clinic staff; authorised users; end-users/patients where applicable.
4.5 Categories of Personal Data
Identification/contact data; account data; authentication data; usage logs; audit logs; support tickets; uploaded files/documents/images; and other data entered into the Services by Customer.
4.6 Special Category Data
The Services may process health data and other Special Category Data depending on Customer's use. Customer is responsible for ensuring a valid lawful basis and Article 9 condition.
Medicasimple shall:
6.1 Lawful Basis
Customer shall ensure it has all rights, notices, consents (if required), and lawful bases required to provide Personal Data to Medicasimple for processing.
6.2 Service Configuration
Customer is responsible for configuring the Services and user permissions appropriately.
7.1 Authorisation
Customer authorises Medicasimple to engage Sub-processors listed in Annex 2.
7.2 Sub-processor Terms
Medicasimple shall ensure each Sub-processor is bound by written terms that are no less protective than this DPA regarding security, confidentiality and data protection.
7.3 Changes to Sub-processors
8.1 Notification
Medicasimple will, where legally permitted, promptly notify Customer if it receives a request from a data subject relating to Customer Personal Data.
8.2 Assistance
Medicasimple will provide reasonable assistance to Customer to fulfil such requests, to the extent Customer cannot do so through the Services' functionality.
9.1 Implementation
Medicasimple will implement and maintain the security measures described in Annex 1.
9.2 Updates
Medicasimple may update Annex 1 from time to time, provided updates do not materially degrade the overall security of the Services.
10.1 Notification
Medicasimple will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
10.2 Information Provision
Medicasimple will provide information reasonably required for Customer to meet its breach notification obligations under UK GDPR.
11.1 Post-Termination
Upon termination or expiry of the Agreement, Medicasimple will:
11.2 Backups/Logs Carve-out
Customer Personal Data may remain in encrypted backups and security logs for a limited period in accordance with Medicasimple's backup retention and security policies, provided such data is:
12.1 Remote-First Audits
Audits will be remote-first and limited to information reasonably necessary to confirm compliance with this DPA, for example:
12.2 Frequency
Customer may conduct an audit no more than once per calendar year, unless a material breach or Personal Data Breach requires additional verification.
12.3 On-site Audits
On-site audits are permitted only where:
13.1 Transfer Authorisation
Customer authorises Medicasimple to transfer Personal Data internationally as necessary to provide the Services, including to Sub-processors located outside the UK.
13.2 Transfer Mechanism
Where required for international transfers, the parties agree that the UK IDTA (Annex 3) or an equivalent lawful transfer mechanism will apply.
13.3 Transfer Risk Assessment
Medicasimple will maintain a transfer risk assessment for such transfers and will provide a summary upon reasonable request.
14.1 Liability Provisions
Liability under this DPA will follow the liability provisions in the Agreement, unless applicable law requires otherwise.
14.2 Non-excludable Liability
Nothing in this DPA limits or excludes liability that cannot be limited or excluded under applicable law.
15.1 Conflict Resolution
If there is any conflict between this DPA and the Agreement regarding processing of Personal Data, this DPA will prevail.
Privacy Contact:security@medicasimple.com
Access control
Encryption
Endpoint security for admin access
Monitoring
Backups & recovery
Vulnerability management
Incident response
Training
Initial list, subject to change notice under Clause 7
Google Cloud EMEA Limited
Amazon Web Services EMEA SARL
Atlassian (Jira/Bitbucket)
Sentry
Intercom
Mixpanel
Klaviyo
HubSpot
Make
Medicasimple Sağlık Teknolojileri A.Ş.
The parties agree that where Personal Data is transferred from the UK to a country not covered by UK adequacy regulations, the transfer will be governed by the UK International Data Transfer Agreement (UK IDTA) on the following terms:
Exporter (Controller)
Customer
Importer (Processor)
MEDICASIMPLE HEALTHCARE TECHNOLOGIES LIMITED (UK)
Non-UK recipient(s) (Sub-processor(s))
Any Sub-processor located outside the UK as listed/updated under Annex 2
Transfer purpose
Provision of the Services
Data
As described in Clause 4 (including possible health data depending on Customer use)
Frequency
Continuous/as needed
Security measures
Annex 1
Transfer Risk Assessment
Maintained by Medicasimple (summary available on request)
.svg)
