Data Processing Agreement

Terms used in this DPA have the meanings given in the UK GDPR and Data Protection Act 2018. Key terms include "UK GDPR" (Regulation (EU) 2016/679 as retained in UK law), "Personal Data", "Data Subject", "Processing", "Data Controller", "Data Processor" (each as defined in UK GDPR), and "Special Category Data" (as defined in Article 9 UK GDPR).

2.1 Employer as Data Controller

The Employer is the Data Controller for:

• employee names and work email addresses;
• job titles, departments, and eligibility information;
• workforce access permissions and authorisation data.

The Employer warrants that it has a lawful basis under Article 6 UK GDPR (and, where applicable, Article 9) for sharing this data with Mothermind and that employees have been informed of the processing through an appropriate privacy notice.

2.2 Mothermind as Data Processor

Mothermind acts as Data Processor on the Employer's behalf when processing the data described in 2.1 for the purposes of account provisioning, identity verification, access management, aggregated usage reporting, and platform administration and support.

2.3 Mothermind as Independent Data Controller

Mothermind acts as an independent Data Controller (and not Processor) for:

• confidential support session records and recordings;
• practitioner clinical and support notes;
• safeguarding records and reports;
• clinical governance and audit records;
• complaints records;
• direct communications between practitioners and employees;
• any data generated through the practitioner-employee relationship.

The Employer has no access to and no controller responsibility for this data.

When acting as Data Processor, Mothermind shall process Personal Data only on documented instructions from the Employer; ensure persons authorised to process the data are subject to confidentiality obligations; implement appropriate technical and organisational security measures; engage subprocessors only in accordance with Section 4; and assist the Employer (at the Employer's cost where the assistance is unreasonably extensive) in:

• responding to Data Subject rights requests;
• demonstrating compliance with UK GDPR Articles 32-36;
• conducting Data Protection Impact Assessments where required.

Mothermind will notify the Employer without undue delay (and no later than 72 hours) on becoming aware of a personal data breach affecting Employer-controlled data; at the Employer's choice, delete or return Employer-controlled Personal Data at the end of the Services, subject to retention required by law or governance obligation; and make available information necessary to demonstrate compliance with Processor obligations.

The Employer provides general authorisation for Mothermind to engage subprocessors, subject to the conditions below.

Current subprocessors

Mothermind will:

• impose data protection terms on each subprocessor materially equivalent to those in this DPA;
• remain liable for the acts and omissions of subprocessors as if they were its own;
• notify the Employer at least 30 days in advance of any new or replacement subprocessor handling Employer-controlled data, where reasonably practicable;
• allow the Employer to object to a new subprocessor on reasonable data protection grounds within 30 days. If unresolved, the Employer may terminate the affected Services without penalty.

Mothermind implements technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS) and at rest;
• role-based access controls and authentication;
• row-level security separating customer data;
• regular security review and patching;
• staff training on data protection and confidentiality;
• audit logging of access to sensitive data;
• secure backup and recovery;
• vendor security due diligence for subprocessors.

Mothermind reviews its security measures regularly and may update them provided the level of protection is not reduced.

Where Personal Data is transferred outside the UK, Mothermind shall implement an approved transfer mechanism under UK GDPR, including the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses with the UK Addendum, or relevant adequacy decisions where applicable.

Mothermind will conduct Transfer Risk Assessments for transfers to countries without an adequacy decision, where required.

The Employer may, no more than once per 12 months and on reasonable notice (minimum 30 days), request reasonable information to verify Mothermind's compliance with this DPA. Mothermind will first provide written information, attestations, and any available third-party audit reports or certifications. On-site audits will only be required where written information is insufficient.

The Employer shall bear its own audit costs. Mothermind's reasonable time costs may be charged. Audits must not unreasonably interfere with Mothermind's operations or the confidentiality of other customers.

Mothermind shall reasonably assist the Employer in responding to Data Subject requests in respect of Employer-controlled data. Employees may exercise rights in respect of Mothermind-controlled data (including session records) by contacting Mothermind directly at hello@mothermind.io. Some rights may be subject to limitations under UK GDPR Article 23, the Data Protection Act 2018, professional secrecy obligations, or safeguarding considerations.

Retention periods are set out in Section 13 of the Employer Terms of Service.

On request following termination, Mothermind will provide the Employer with an export of Employer-controlled data in a commonly used format, within 30 days; and written confirmation of deletion of Employer-controlled data following the agreed retention period. Mothermind-controlled data (including practitioner notes and governance records) is retained in accordance with professional and legal obligations regardless of the Employer's termination.

The liability provisions of the Agreement (Section 11 of the Employer Terms of Service) apply to this DPA. In the event of conflict between this DPA and any other part of the Agreement on data protection matters, this DPA prevails. This DPA continues for the duration of the Agreement and survives termination to the extent necessary to perform retention, deletion, and audit obligations.

This DPA is governed by the laws of England and Wales, with exclusive jurisdiction of the courts of England and Wales.