This applies when your clinic uses a clinic account. Your clinic is the controller; SwainUK Limited is the processor.
What we process
- Subject matter: storing and relaying your clinic's records between its approved iPads, and sending emails the clinic asks for.
- Data: encrypted patient records, encrypted reduced-size photographs, encrypted backups attached to emails, and staff account details.
- People: the clinic's patients and staff.
- Duration: while the clinic account exists; deleted when the owner deletes it.
Our commitments
- Process only on your clinic's documented instructions (using the app is that instruction).
- Patient records are end-to-end encrypted: we hold ciphertext and cannot read it.
- Everyone with access to our systems is bound by confidentiality.
- Security measures: encryption in transit and at rest, per-iPad approval, rate limiting, least-privilege access and audit logging (see Security).
- Use only the sub-processors listed, and tell clinic owners before adding or replacing one, so you can object.
- Help you answer patients' rights requests (the app has a Subject access export) and with security and impact assessments.
- Tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your clinic.
- Delete the cloud copy when the account is deleted. Records on your iPads remain under your control.
- Make information available to show we meet Article 28, and allow reasonable audits.
The full agreement is available on request from privacy@honestface.app.