Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between KOVERNA Ltd ("Processor", "Koverna", "we", "us") and the Customer ("Controller", "you") and applies to the processing of personal data by Koverna on behalf of the Customer in providing the Koverna Service.

This DPA reflects the parties' obligations under UK GDPR, in particular Articles 28, 32 and 33.

KOVERNA Ltd is registered in England and Wales under company number 17541276, registered office 87 Hesketh Lane, Preston, PR4 6AQ.

Subject matter: Koverna will process the Customer's personal data as described in this DPA and the Privacy Policy.

Duration: This DPA applies for the duration of the Customer's subscription to the Service, and thereafter until all personal data has been returned or deleted in accordance with section 12.

Nature and purpose: Koverna processes personal data entered by the Customer into the Service for the purpose of providing the Service, including clinical records, patient and athlete management, appointments, exercise programmes, documents and communications.

Categories of data subjects:

• Patients and athletes whose data is entered by the Customer.
• Authorised Users of the Service within the Customer's organisation (clinicians, coaches, managers, reception staff).
• Players or patients with portal access.

Types of personal data:

• Identifiers: name, date of birth, email, phone, address.
• Health data (special category): clinical notes, injury information, rehabilitation data, medical history.
• Appointment and scheduling data.
• Exercise and rehabilitation programme data.
• Communications and audit logs.

Koverna will process personal data only on the Customer's documented instructions, as provided through the Service's functionality and configuration. The Customer warrants that its instructions comply with UK GDPR and all applicable data protection laws.

Koverna will not process personal data for its own purposes, except as necessary to provide, maintain and secure the Service, or as required by law.

If Koverna receives an instruction that it believes breaches UK GDPR or other data protection law, it will inform the Customer and may suspend performance of the instruction until the Customer confirms or modifies it.

Koverna ensures that personnel authorised to process personal data are subject to appropriate confidentiality obligations and access the data only as necessary to provide the Service.

Access to personal data is restricted through role-based access controls. Koverna's personnel do not have routine access to Customer data; access is granted only for specific support, maintenance or security purposes.

Koverna implements the following technical and organisational measures:

• Encryption of data in transit (TLS/HTTPS).
• Role-based access controls and authentication.
• Regular backups managed by the hosting provider (Base44).
• Audit logging of key actions within the Service.
• Secure password storage (hashed).
• Session management and automatic timeout.
• Separation of Customer data through tenant isolation (practice_id).

Koverna uses the following subprocessors to provide the Service:

• Base44 — hosting, database and infrastructure.
• Stripe — payment processing.
• Resend — email delivery.
• Google — optional OAuth sign-in.

Koverna will notify the Customer in advance of any material change to subprocessors. The Customer may object to a new subprocessor on reasonable data protection grounds, in which case the parties will work together to resolve the objection.

Koverna will assist the Customer in responding to data subject requests (access, rectification, erasure, restriction, portability and objection) by providing tools within the Service for the Customer to access and export data, and by responding to reasonable requests for assistance.

Koverna will assist the Customer with data protection impact assessments (DPIAs) and regulatory consultations where relevant, taking into account the nature of the processing and the information available to Koverna.

Koverna will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data. Koverna will provide the Customer with sufficient information to allow the Customer to meet its own breach reporting obligations under UK GDPR.

Koverna will take reasonable steps to investigate, contain and remediate the breach, and will document the incident and its response.

Koverna will make available to the Customer information necessary to demonstrate compliance with this DPA and UK GDPR Article 28.

The Customer may audit Koverna's compliance with this DPA, subject to reasonable notice and confidentiality requirements. The Customer will bear its own audit costs unless the audit reveals non-compliance.

If personal data is transferred outside the UK, Koverna will ensure that appropriate safeguards are in place, such as UK International Data Transfer Agreements (IDTAs) or Addenda to EU Standard Contractual Clauses.

At the end of the Service, the Customer may export its data through the Service's export features. Koverna will delete the Customer's personal data after a reasonable retention period following termination, unless retention is required by law.

The Customer should export any data it needs before the end of the retention period. After deletion, data cannot be recovered.

Koverna may update this DPA from time to time to reflect changes in subprocessors, security measures or legal requirements. Material changes will be notified to Customers.