Data Processing Agreement

Version 2026.09-v3. This DPA forms part of the WhyCare CarePlan Writer Agreement between Buildhope Digital Ltd trading as WhyCare and the Customer.

1. Roles and scope

To the extent the Customer submits personal data relating to residents/service users through WhyCare CarePlan Writer, the Customer is the controller and WhyCare is the processor. WhyCare is an independent controller for account-holder, contract, billing, support, security and business-contact data that it determines how and why to process for its own legitimate business and legal purposes.

This DPA applies to personal data processed by WhyCare on the Customer's behalf to provide the CarePlan Writer service. It is intended to meet the controller-processor contract requirements of applicable UK data-protection law.

2. Processing details

• Subject matter: AI-assisted drafting of care plans from information submitted by authorised users.

• Duration: for the term of the Agreement and the limited period required to complete each request, subject to sub-processor retention/data-control arrangements and legal obligations.

• Nature/purpose: receive anonymised or minimised care information, transmit it securely to the configured AI provider, receive generated draft text, return it to the user, and provide related security/technical operations.

• Data subjects: residents/service users, relatives/representatives where mentioned in care information, and authorised staff where relevant.

• Personal data: care needs, health and disability information, risks, preferences, family/social information, medication information and other information the Customer chooses to submit. This may include special-category health data. Users are instructed to remove unnecessary identifiers and the application performs local name replacement and privacy checks.

3. Documented instructions

WhyCare will process Customer personal data only on documented instructions from the Customer, including the Agreement, this DPA and use of the service by authorised users, unless UK law requires otherwise. Where legally permitted, WhyCare will inform the Customer before processing required by law. If WhyCare believes an instruction infringes applicable data-protection law, it will inform the Customer.

4. Confidentiality

WhyCare will ensure that people authorised to process Customer personal data are subject to appropriate confidentiality obligations and access it only as necessary for their duties.

5. Security

WhyCare will maintain appropriate technical and organisational measures having regard to the nature of the processing and risk. The current measures are described in the Security & Privacy Schedule, including HTTPS transport, role-based access, secure password hashing, CSRF protection, server-side API secrets, input validation, restricted logging and the application's non-retention architecture for resident content.

6. Resident-content retention

The WhyCare application is designed not to write resident source text or generated care-plan content to its application database, analytics or ordinary application logs. Identifiable names entered into the name-replacement fields are intended to remain in browser memory and be replaced locally before AI submission. Users must still review the anonymised preview because other identifiers may be present.

Third-party infrastructure and AI providers process data under their own contractual data-processing and retention arrangements. WhyCare will maintain a Sub-processor Schedule describing active providers. The OpenAI API is not used to train OpenAI models on API inputs or outputs by default; retention and safety-processing arrangements depend on the applicable OpenAI service/data controls. WhyCare will not represent that third-party processing is zero-retention unless the relevant provider contract/data-control setting actually guarantees that.

7. Sub-processors

The Customer gives general written authorisation for WhyCare to use the sub-processors listed in the current Sub-processor Schedule. WhyCare will ensure required processor obligations are imposed on sub-processors by contract and remains responsible for its obligations to the Customer in relation to sub-processor processing.

Where reasonably practicable, WhyCare will give at least 30 days' advance notice of a new sub-processor that will materially process Customer content. The Customer may object on reasonable data-protection grounds during that period. The parties will work in good faith to resolve the concern; if they cannot, either party may terminate the affected service without penalty for the unused future portion of the committed term.

8. International transfers

Where processing involves a restricted international transfer, WhyCare will ensure that an applicable lawful transfer mechanism is used, which may include adequacy regulations, the UK International Data Transfer Agreement/Addendum, or an equivalent lawful mechanism. For AI processing, WhyCare may rely on the transfer mechanisms provided under its agreement with the AI provider.

9. Data-subject rights

Taking account of the nature of processing, WhyCare will provide reasonable assistance to the Customer with requests to exercise data-subject rights. Because resident content is not intentionally retained by the WhyCare application, WhyCare may have no resident content to search after a request has completed.

10. Security incidents

WhyCare will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data processed under this DPA and will provide information reasonably available to help the Customer meet its notification obligations.

11. DPIAs and regulator consultation

Taking account of the nature of processing and information reasonably available to WhyCare, WhyCare will provide reasonable assistance with data-protection impact assessments and prior consultation obligations relating to use of the service.

12. Deletion and return

At the end of the Agreement, WhyCare will delete or return Customer personal data processed on the Customer's behalf where it is retained, unless law requires retention. This does not require deletion of WhyCare's independent-controller records such as contracts, invoices, security audit records or business correspondence. Resident source and generated text should ordinarily have already been discarded by the application workflow.

13. Information and audits

WhyCare will make available information reasonably necessary to demonstrate compliance with the processor obligations applicable to this DPA. Subject to confidentiality and security restrictions, the Customer may conduct or appoint an auditor to conduct a reasonable audit no more than once per year, or more frequently following a substantiated personal-data breach or where required by a regulator. The Customer should normally give at least 30 days' notice and avoid unnecessary disruption.

14. Customer obligations

The Customer is responsible for its lawful basis, transparency, data minimisation, staff authorisation, accuracy of submitted data, professional review of output, and deciding whether the service is appropriate for its processing. The Customer must not deliberately submit unnecessary direct identifiers, and must not use WhyCare to create a replacement resident-record database.

15. Liability and precedence

Nothing in this DPA relieves either party of obligations imposed directly by data-protection law. If this DPA conflicts with another part of the Agreement on a data-protection matter, this DPA prevails. Commercial liability is otherwise governed by the SaaS Agreement to the extent permitted by law.