ASPIRIUM LTD

Version: 2.0

Last Updated: 26th October 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between Aspirium Ltd and the Customer for the provision of services involving the processing of personal data.

It sets out the parties’ respective obligations under applicable data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”) and Data Protection Act 2018.

1. Parties and Definitions

1.1 Parties

This DPA is entered into between:

Aspirium Ltd, a company registered in England and Wales under company number 16989063, whose registered office is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ (“Aspirium”, “Processor”, “we” or “us”);

and

The business customer purchasing or using Aspirium’s services (“Customer”, “Controller” or “you”).

1.2 Definitions

Agreement: The Terms of Service, applicable Order, this DPA and any incorporated service-specific terms.

Applicable Data Protection Law: The UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 where applicable, and other binding data protection legislation relevant to the processing.

Controller Personal Data: Personal data processed by Aspirium on behalf of the Customer under the Agreement.

Data Subject: An identified or identifiable natural person to whom personal data relates.

Personal Data Breach: A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Processing: Any operation performed on personal data, including collection, storage, retrieval, transmission, modification, use or deletion.

Subprocessor: A third party engaged by Aspirium to process Controller Personal Data on behalf of the Customer.

Services: The hosting, website maintenance, email marketing, analytics, creative, AI and other digital services purchased from Aspirium.

Other expressions defined in the UK GDPR have the meanings given to them in that legislation.

2. Scope and Application

2.1 Purpose

This DPA governs the processing of Controller Personal Data by Aspirium in connection with the Services.

2.2 Roles

For processing performed on the Customer’s behalf, the Customer ordinarily acts as Controller and Aspirium acts as Processor.

Where the Customer acts as a processor for another controller, Aspirium may act as a subprocessor. The Customer must ensure that it has the necessary authority to appoint Aspirium and authorise the processing.

2.3 Independent controller activities

Aspirium acts as an independent Controller when processing personal data for its own legitimate business purposes, including account administration, billing, legal compliance and customer relationship management.

Such processing is governed by Aspirium’s Privacy Policy rather than the processor obligations in this DPA.

2.4 Contractual incorporation

This DPA is automatically incorporated into the Agreement when the Customer orders a Service. It applies whenever Aspirium processes Controller Personal Data on the Customer’s behalf, from the time that processing begins. No separate signature or additional agreement is required.

2.5 Precedence

For matters concerning the protection or processing of Controller Personal Data, this DPA prevails over other parts of the Agreement. An expressly agreed service-specific data protection schedule prevails over this DPA to the extent of a conflict.

Mandatory requirements of Applicable Data Protection Law prevail over conflicting contractual provisions.

2.6 Schedules

The following schedules form part of this DPA:

• Schedule 1 — Processing Details

• Schedule 2 — Technical and Organisational Security Measures

• Schedule 3 — Subprocessors and Supplier Authorisation

• Schedule 4 — Email Marketing and Automation

• Schedule 5 — Service-Specific Processing Restrictions

3. Customer Obligations

3.1 Lawful processing

The Customer is responsible for determining the purposes and lawful basis of its processing activities and ensuring that its instructions comply with Applicable Data Protection Law.

3.2 Privacy information

The Customer must provide appropriate privacy information to individuals whose personal data is processed through the Services.

3.3 Data accuracy and minimisation

The Customer is responsible for ensuring that personal data supplied to Aspirium is accurate, relevant and limited to what is necessary for the intended purposes.

3.4 Authorisation

The Customer warrants that it has the legal authority to disclose Controller Personal Data to Aspirium and to instruct Aspirium to process it.

3.5 Security responsibilities

The Customer must implement appropriate security measures for systems and accounts under its control, including access permissions, passwords and multifactor authentication where available.

3.6 Sensitive information

Limited health information supplied through ordinary hosted website enquiries and booking requests is expressly permitted within the scope and safeguards described in Schedule 5, section 1.

This permission does not extend to clinical record systems, electronic health record systems or patient portals, or to storing or managing clinical records, consultation notes, diagnostic reports or clinical images.

Identifiable health information and other special-category personal data are prohibited in Email Marketing and Design Studio. Identifiable patient information, special-category personal data and criminal-offence data are prohibited in AI features, as further described in Schedules 4 and 5.

Other processing of special-category personal data or criminal-offence data is outside the standard Services unless expressly agreed in a service-specific data protection schedule before processing begins. Such a schedule must identify the permitted data, purposes, instructions and safeguards.

3.7 Healthcare information

Where the Customer operates a healthcare business, it remains responsible for assessing the confidentiality, lawful processing and security requirements applicable to patient information.

The fact that a Service is marketed to healthcare businesses does not mean it is automatically suitable for storing identifiable clinical records.

4. Aspirium’s Processing Obligations

4.1 Documented instructions

Aspirium will process Controller Personal Data only on documented instructions from the Customer, unless otherwise required by applicable law.

Documented instructions include the Agreement, the Customer’s configuration and authorised use of the Services, and additional lawful instructions submitted through agreed support channels.

4.2 Legal requirements

Where Aspirium is legally required to process personal data contrary to the Customer’s instructions, it will notify the Customer before processing unless prohibited by law.

4.3 Unlawful instructions

Aspirium will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

Aspirium may decline or suspend an instruction where reasonably necessary to avoid unlawful processing.

4.4 Purpose limitation

Aspirium will not use Controller Personal Data for independent advertising, unrelated marketing or other purposes outside the Customer’s documented instructions, unless separately authorised by law and appropriately disclosed.

4.5 Personnel confidentiality

Aspirium will ensure that personnel authorised to process Controller Personal Data are subject to appropriate confidentiality obligations.

4.6 Access restrictions

Access to Controller Personal Data will be limited to personnel and authorised subprocessors who reasonably require it to deliver, maintain or secure the Services.

5. Security Measures

5.1 Appropriate protection

Aspirium will implement appropriate technical and organisational measures designed to protect Controller Personal Data against unauthorised or unlawful processing, accidental loss, destruction, alteration and disclosure.

5.2 Risk assessment

Security measures will take account of the nature of the processing, available technology, implementation costs, and the likelihood and severity of risks to individuals.

5.3 Security controls

Measures may include, as appropriate to the relevant Service:

• Role-based access controls.

• Authentication and account security.

• Encryption in transit.

• Encryption at rest where supported and appropriate.

• Security monitoring and logging.

• Malware protection.

• Software updates and vulnerability management.

• Backup and recovery arrangements.

• Restricted administrative access.

• Confidentiality obligations.

• Incident response procedures.

• Supplier security assessments.

5.4 Service-specific measures

The security arrangements applicable to a particular Service may depend on the underlying infrastructure and technology provider.

Aspirium will ensure that the measures required by Article 32 UK GDPR are appropriate to the processing undertaken.

5.5 No absolute guarantee

The parties acknowledge that no technology or security system can eliminate all risks.

This acknowledgement does not reduce Aspirium’s obligations to implement appropriate security measures or its liability for failure to meet contractual or statutory duties.

5.6 Security schedule

Further details are provided in Schedule 2.

6. Assistance with Data Subject Rights

6.1 Assistance

Taking account of the nature of the processing, Aspirium will assist the Customer, through appropriate technical and organisational measures insofar as possible, in responding to requests from Data Subjects.

6.2 Types of request

Such assistance may concern:

• Access to personal data.

• Rectification of inaccurate information.

• Erasure.

• Restriction of processing.

• Data portability.

• Objections to processing.

• Rights concerning automated decision-making, where applicable.

6.3 Direct requests

Where Aspirium receives a request relating to Controller Personal Data directly from a Data Subject, it will notify the Customer without undue delay where legally permitted.

Aspirium will not independently determine the outcome of a request on the Customer’s behalf unless authorised or legally required.

6.4 Costs

Reasonable assistance required under Applicable Data Protection Law will be provided in accordance with this DPA.

Additional work beyond the functionality and assistance reasonably required by law may be subject to agreed charges, provided such charges do not undermine mandatory legal obligations.

7. Personal Data Breaches

7.1 Notification

Aspirium will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data.

7.2 Notification information

To the extent reasonably available, Aspirium will provide:

• A description of the incident.

• The categories and approximate numbers of affected Data Subjects and records.

• The likely consequences.

• Measures taken or proposed to contain and remediate the incident.

• Relevant contact information for further enquiries.

7.3 Progressive disclosure

Where all relevant information is not immediately available, Aspirium may provide it in stages without undue further delay.

7.4 Cooperation

Aspirium will provide reasonable assistance with the Customer’s assessment, investigation, notification and remediation obligations under Articles 33 and 34 UK GDPR.

7.5 Regulatory reporting

Unless legally required otherwise, the Customer remains responsible for determining whether notification to the Information Commissioner’s Office or affected Data Subjects is required.

7.6 Upstream incidents

Where an incident originates with an authorised subprocessor, Aspirium will coordinate with that provider to obtain available information and fulfil its obligations to the Customer.

8. Data Protection Impact Assessments and Consultation

8.1 Assistance

Taking account of the nature of the processing and information available to Aspirium, Aspirium will provide reasonable assistance with:

• Data Protection Impact Assessments.

• Risk assessments.

• Prior consultation with supervisory authorities where required.

8.2 Customer responsibility

The Customer remains responsible for determining whether its processing requires a DPIA and for making decisions about the lawfulness and proportionality of that processing.

8.3 Additional information

Aspirium may request reasonable information about the intended processing before enabling functionality that creates significant privacy or security risks.

9. Subprocessors

9.1 General authorisation

The Customer grants Aspirium general written authorisation to engage subprocessors for the purposes described in this DPA, subject to the safeguards and notification procedures below.

9.2 Existing subprocessors

The subprocessors and supplier categories relevant to the Services are described in Schedule 3.

Only providers actually engaged to process Controller Personal Data for a subscribed Service are authorised under this clause.

9.3 Contractual safeguards

Before allowing a subprocessor to process Controller Personal Data, Aspirium will put in place a written agreement imposing data protection obligations providing the protection required by Article 28 UK GDPR.

9.4 Responsibility

Aspirium remains responsible to the Customer for the performance of its subprocessors’ applicable data protection obligations.

9.5 Changes

Aspirium will inform the Customer of intended additions or replacements of subprocessors with sufficient advance notice to provide a meaningful opportunity to object.

Notice will normally be provided at least 30 days before the proposed change, except where an urgent replacement is necessary for security, continuity or legal reasons.

9.6 Objections

The Customer may object on reasonable data protection grounds within 14 days of receiving notice.

The parties will attempt to resolve the objection in good faith.

If the objection cannot reasonably be resolved, the Customer may terminate the affected Service before the proposed subprocessor begins processing, with an appropriate refund for unused prepaid service.

9.7 Supplier records

Aspirium will maintain a current record of relevant subprocessors, their processing purposes and applicable international transfer arrangements.

10. International Data Transfers

10.1 Restricted transfers

Aspirium will not make a restricted international transfer of Controller Personal Data unless the transfer complies with Applicable Data Protection Law.

10.2 Permitted mechanisms

Where applicable, appropriate mechanisms may include:

• UK adequacy regulations.

• The UK International Data Transfer Agreement.

• The UK Addendum to the EU Standard Contractual Clauses.

• Another valid mechanism permitted under Applicable Data Protection Law.

10.3 Additional safeguards

Where required, Aspirium will undertake or obtain an appropriate transfer risk assessment and implement supplementary safeguards.

10.4 International providers

Certain Services, including email marketing, analytics and AI-related features, may involve international processing or access.

Aspirium will identify the applicable arrangements and ensure appropriate safeguards before the relevant restricted transfers occur.

10.5 Customer instructions

The Customer authorises international processing only where it is necessary for the subscribed Service and complies with this DPA.

10.6 Changes in law

Where an international transfer mechanism becomes invalid or insufficient, Aspirium will take appropriate steps to restore compliance, suspend the affected transfer or discontinue the affected processing.

11. Data Retention, Return and Deletion

11.1 Duration

Aspirium will retain Controller Personal Data only for as long as necessary to provide the Services, comply with documented instructions or meet applicable legal obligations.

11.2 End of Services

Upon termination of the relevant Services, Aspirium will, at the Customer’s choice, delete or return Controller Personal Data and delete existing copies, unless applicable law requires continued storage.

11.3 Data export

Aspirium will provide reasonable assistance with returning Controller Personal Data in an available, commonly used format appropriate to the Service.

The Customer should request exports before termination where practicable.

11.4 Backups

Where Controller Personal Data remains in protected backups after termination, it will remain subject to appropriate security, access restrictions and deletion schedules.

Such data must not be restored into active processing except where legally required or necessary for legitimate recovery purposes consistent with this DPA.

11.5 Legal retention

Aspirium may retain information where required by applicable law, provided it remains protected and is not used for incompatible purposes.

11.6 Subprocessor deletion

Aspirium will ensure that its subprocessor arrangements include appropriate data return or deletion obligations.

11.7 Confirmation

Upon reasonable request, Aspirium will provide confirmation of completion of applicable deletion obligations, subject to lawful exceptions.

12. Records, Information and Audits

12.1 Demonstrating compliance

Aspirium will make available information reasonably necessary to demonstrate compliance with its obligations under Article 28 UK GDPR.

12.2 Audits

Aspirium will allow and contribute to audits and inspections conducted by the Customer or an appropriately authorised auditor, as required by Applicable Data Protection Law.

12.3 Audit arrangements

Audits will be conducted subject to reasonable arrangements designed to protect confidentiality, security, other customers’ information and business continuity.

Where appropriate, relevant third-party certifications, security reports or independent assessments may be used to demonstrate compliance.

12.4 Limitations

Aspirium is not required to disclose information in a manner that would compromise the security of other customers, breach third-party confidentiality obligations or expose unrelated personal data.

Such restrictions must not prevent the Customer from exercising mandatory audit rights.

12.5 Cooperation

Both parties will cooperate in good faith to resolve identified compliance deficiencies.

13. Liability and Indemnification

13.1 Statutory responsibilities

Each party remains responsible for its obligations and liabilities under Applicable Data Protection Law.

13.2 Contractual liability

Subject to applicable law, contractual liability arising under this DPA is governed by the liability provisions in Aspirium’s Terms of Service.

13.3 Non-excludable rights

Nothing in this DPA limits the rights of Data Subjects, the powers of supervisory authorities or any liability that cannot lawfully be excluded.

13.4 Responsibility for instructions

The Customer is responsible for the lawfulness of its processing purposes and instructions.

Aspirium remains responsible for its own compliance, including its obligations concerning security, confidentiality, subprocessors and international transfers.

13.5 Cooperation

Where a claim or regulatory investigation involves both parties, they will cooperate reasonably, subject to legal privilege, confidentiality and applicable law.

14. Term, Changes and General Provisions

14.1 Commencement

This DPA is automatically incorporated into the Agreement as described in clause 2.4 and applies from the time Aspirium begins processing Controller Personal Data on the Customer’s behalf. It remains applicable for as long as Aspirium or its subprocessors retain or process that data, including during data return, deletion and protected backup expiry.

14.2 Survival

Obligations concerning confidentiality, security, data return, deletion, lawful retention and liability survive termination to the extent necessary.

14.3 Amendments

Material amendments affecting the Customer’s data protection rights will be notified in accordance with the Agreement.

Changes required by law may take effect sooner where necessary.

14.4 Severability

If a provision is held invalid or unenforceable, the remaining provisions continue in effect.

14.5 Governing law

This DPA is governed by the laws of England and Wales, subject to mandatory provisions of Applicable Data Protection Law.

14.6 Jurisdiction

The courts of England and Wales have jurisdiction over contractual disputes arising under this DPA, without restricting statutory regulatory rights.

Schedule 1 — Processing Details

1. Subject Matter

Processing of personal data necessary to deliver, maintain, support and secure the Services purchased by the Customer.

2. Duration

For the duration of the relevant Services, together with any lawful period required for data return, deletion, protected backup expiry or statutory retention.

3. Nature of Processing

Processing may include collection, receipt, recording, storage, organisation, retrieval, consultation, transmission, modification, segmentation, reporting, backup, restoration, restriction, export and deletion.

4. Purposes

The purposes include:

• Hosting websites and business email.

• Managing website infrastructure.

• Providing technical support and maintenance.

• Delivering website design and migration services.

• Managing email marketing campaigns and automations.

• Producing marketing reports and analytics.

• Operating creative design tools.

• Providing authorised AI assistance.

• Maintaining security and service functionality.

5. Categories of Data Subjects

Depending on the subscribed Service:

• Customer employees and authorised users.

• Website visitors.

• Patients and prospective patients.

• Newsletter subscribers.

• Marketing contacts and campaign recipients.

• Enquiry form submitters.

• Business contacts and suppliers.

• Other individuals whose personal data the Customer lawfully processes.

6. Categories of Personal Data

Depending on the Service:

• Names and contact details.

• Email addresses and telephone numbers.

• Business and professional information.

• Website form submissions.

• Marketing preferences and consent records.

• Email campaign activity and engagement information.

• Technical identifiers and IP addresses.

• Authentication and access records.

• Website and hosting content.

• Analytics and reporting information.

• Customer-supplied documents and creative materials.

7. Special-Category Data

For standard Website Hosting, permitted special-category data is limited to health information supplied in ordinary administrative enquiries and booking requests, such as a brief description of symptoms or the reason for requesting an appointment.

The permitted processing consists of receipt, transmission, storage, retrieval by authorised users, backup, restoration, deletion and technical access reasonably necessary to operate, secure and support those website functions. Relevant Data Subjects are patients, prospective patients and other enquiry submitters.

This permission is subject to Schedule 5, section 1. It does not authorise clinical record storage or the use of health information for marketing segmentation, profiling, AI processing or creative design.

Email Marketing, Design Studio and AI features are subject to the prohibitions in Schedules 4 and 5. Listing a category of Data Subjects or personal data elsewhere in this Schedule does not override a service-specific restriction.

Any other agreed special-category or criminal-offence data processing must be documented in a service-specific data protection schedule before it begins.

8. Frequency

Processing may be continuous, periodic or event-driven, depending on the Service and Customer instructions.

Schedule 2 — Technical and Organisational Security Measures

Aspirium will implement and maintain measures appropriate to the nature and risks of the relevant processing.

1. Access Control

• Restriction of administrative access to authorised personnel.

• Use of individual accounts where supported.

• Role-based permissions appropriate to operational responsibilities.

• Prompt removal or adjustment of access when no longer required.

• Multifactor authentication for privileged access where supported and appropriate.

2. Transmission Security

• Use of HTTPS/TLS for supported web services and administrative connections.

• Secure methods for transferring credentials and sensitive information.

• Avoidance of unnecessary transmission of personal data.

3. Storage and Infrastructure

• Use of appropriately secured hosting infrastructure.

• Logical separation of customer accounts where supported.

• Restricted access to hosting control panels and management systems.

• Encryption at rest where appropriate to the Service and supported by the relevant infrastructure.

4. Software Security

• Maintenance of supported software.

• Appropriate vulnerability and patch management.

• Malware detection and response where applicable.

• Removal or restriction of compromised components where necessary.

5. Backup and Recovery

• Backup arrangements appropriate to the selected Service.

• Access restrictions for backup data.

• Restoration and recovery processes appropriate to the applicable service arrangements.

• Retention and deletion controls for backup information.

6. Monitoring

• Appropriate logging of security-relevant events.

• Investigation of suspected unauthorised access.

• Monitoring of service health and security alerts where available.

7. Organisational Controls

• Confidentiality obligations for authorised personnel.

• Procedures for responding to security incidents.

• Appropriate supplier due diligence.

• Restriction of access according to operational necessity.

• Periodic review of relevant security measures.

8. Supplier Controls

Aspirium will require subprocessors to implement appropriate security measures and maintain contractual protections consistent with Applicable Data Protection Law.

9. Review and Improvement

Security measures will be reviewed and updated as reasonably necessary to respond to changes in technology, threats, processing activities and legal requirements.

This Schedule describes the security framework Aspirium undertakes to maintain. Individual controls must be implemented as applicable to each Service and must not be represented as deployed where they are not.

Schedule 3 — Subprocessors and Supplier Authorisation

1. General Authorisation

The Customer authorises Aspirium to use subprocessors where necessary to deliver the subscribed Services, subject to Section 9.

Aspirium will maintain a current register identifying the relevant legal entities, processing purposes and applicable international transfer arrangements.

2. Relevant Technology Providers

The following providers or supplier categories may be relevant to Aspirium’s Services.

3. Conditions of Authorisation

A provider listed above is authorised to process Controller Personal Data only where:

1. It is actually engaged to support the Customer’s subscribed Service.

2. An appropriate Article 28-compliant agreement is in place where required.

3. Applicable international transfer safeguards have been established.

4. Processing is limited to the purposes necessary to deliver the Service.

5. The provider is subject to appropriate security and confidentiality obligations.

4. Supplier Register

Aspirium will maintain or make available an up-to-date subprocessor register containing relevant supplier details and processing arrangements.

5. Changes

New or replacement subprocessors are subject to the notice and objection procedure in Section 9.

Schedule 4 — Email Marketing and Automation

1. Platform

Aspirium provides Email Marketing and Automation services using ActiveCampaign technology under a reseller or white-label arrangement.

The Customer contracts with Aspirium for the purchased Service.

2. Processing Purposes

The Customer instructs Aspirium and its authorised subprocessors to process permitted personal data for:

• Contact management.

• Mailing-list imports.

• Campaign creation and delivery.

• Marketing automations.

• Segmentation and personalisation.

• Subscriber preference management.

• Unsubscribe and suppression management.

• Campaign engagement reporting.

• Technical administration and security.

• Data export and deletion.

3. Customer Responsibility

The Customer determines the purposes and lawful basis for its marketing activities.

The Customer must comply with applicable data protection and electronic marketing laws, including the UK GDPR and PECR.

4. Consent and Marketing Permissions

The Customer must ensure that appropriate marketing permissions exist before sending communications.

Where consent is required, the Customer must maintain sufficient evidence of that consent.

Where another lawful marketing route is relied upon, the Customer must ensure that its conditions are satisfied.

5. Prohibited Contact Sources

The Customer must not use unlawfully obtained, harvested or otherwise prohibited mailing lists.

Purchased lists are prohibited where inconsistent with Aspirium’s Acceptable Usage Policy or the applicable ActiveCampaign requirements.

6. Unsubscribe Requests

The Customer must honour applicable unsubscribe and objection rights and maintain appropriate suppression records.

7. Healthcare Information

Email Marketing Services must not be used to upload, record, infer or use identifiable health information or other special-category personal data. Prohibited information includes symptoms, diagnoses, treatment histories, clinical correspondence, and tags, segments, scores or automations that reveal or infer an identifiable person’s health condition or treatment.

Ordinary contact details may be used for a lawful mailing list where the list’s name, selection criteria, associated information and use do not themselves reveal or infer special-category data. Removing a diagnosis field does not make a list permissible if its membership or segmentation still reveals a health condition.

The Customer must configure website forms, booking systems, notifications and other integrations to prevent prohibited information from entering Email Marketing Services.

8. Security

Aspirium will ensure that appropriate contractual security obligations apply to ActiveCampaign where it acts as a subprocessor.

9. International Transfers

International processing must comply with Section 10.

Aspirium will verify the relevant contractual entities and transfer safeguards before permitting restricted transfers of Controller Personal Data.

10. Data Subject Requests

Aspirium will provide reasonable assistance with applicable data subject rights and coordinate with ActiveCampaign where necessary.

11. Security Incidents

Incidents affecting Controller Personal Data will be handled in accordance with Section 7.

12. Termination

On termination, Controller Personal Data will be returned or deleted in accordance with Section 11 and applicable lawful retention requirements.

The Customer should arrange any necessary exports before service access ends.

13. Supplier Terms

Use of the Email Marketing platform remains subject to the applicable ActiveCampaign contractual and acceptable-use requirements incorporated into the Customer’s Agreement.

These requirements do not replace the obligations in this DPA.

Schedule 5 — Service-Specific Processing Restrictions

1. Website Hosting

Hosting Services may process website content, form submissions, user records, technical logs and other permitted Customer-controlled data.

Standard Website Hosting expressly permits ordinary administrative enquiries and booking requests containing limited health information supplied by an individual, such as a brief description of symptoms or the reason for requesting an appointment.

The Customer instructs Aspirium and its authorised hosting subprocessors to receive, transmit, store, back up, restore and delete that information, and to access it only as reasonably necessary to operate, secure, maintain or support the website and its enquiry functions.

Standard Hosting Services are not supplied as a clinical records system, electronic health record system or patient portal and must not be used to store or manage clinical records, consultation notes, diagnostic reports or clinical images.

The Customer controls its forms and must establish an appropriate lawful basis and, where applicable, a condition for processing special-category data; provide privacy information; minimise the information requested; discourage unnecessary medical detail and attachments; and apply appropriate access, security and retention controls.

The Customer must assess the security of form notifications and connected systems. Hosting permission does not authorise transferring health information into Email Marketing, Design Studio, AI features or another Service that prohibits it.

Aspirium remains responsible for its own obligations under this DPA, including appropriate security, confidentiality, subprocessor safeguards and lawful international transfers.

2. Website Care

Aspirium may access Customer websites, databases, administrative systems and relevant personal data where necessary to provide authorised technical support.

Access must be limited to what is reasonably necessary for the approved work.

Aspirium will not intentionally extract or retain Customer personal data for unrelated purposes.

3. Marketing Dashboards

Marketing reporting services may process analytics, advertising, website traffic and related information.

The Customer is responsible for authorising access to connected third-party accounts and ensuring that any disclosure of personal data is lawful.

4. Design Studio

Creative tools may process permitted uploaded images, designs, brand assets and project information.

Customers must not upload or include identifiable patient health information, clinical records or other special-category personal data. This includes identifiable patient photographs or testimonials where their content or context reveals health information.

Customers must not upload passwords, payment-card details or other authentication secrets. These restrictions apply to projects, templates, brand assets, integrations and AI features available within Design Studio.

5. AI Digital Assistant

AI services may process permitted prompts, uploaded content, conversations and generated outputs.

Customers must not submit identifiable patient information, clinical records, special-category personal data, criminal-offence data, passwords, payment-card details or other authentication secrets.

This restriction applies to prompts, conversations, documents, images, connected data sources and automated integrations. Removing a person’s name is insufficient where the remaining information could reasonably identify them.

Customers may use fictional examples or information that has been genuinely anonymised so that individuals are no longer identifiable. AI features are not supplied for maintaining patient records or making clinical decisions about identifiable individuals.

Aspirium will identify the applicable AI processing providers and ensure appropriate data protection arrangements before enabling processing of Controller Personal Data.

6. Rewards and Discounts

Where rewards or partner benefits involve sharing personal data with an external provider, the relevant parties’ roles and processing purposes must be identified.

A third party acting as an independent controller is not automatically an Aspirium subprocessor.

Customers will be provided with relevant information where additional disclosures or privacy arrangements apply.

Contact and Data Protection Enquiries

ASPIRIUM LTD

Company number: 16989063
ICO registration: ZC245198

Registered office:

71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom

Website: https://aspirium.co.uk

Data protection enquiries may be sent to privacy@aspirium.co.uk. Customers may also contact Aspirium through their Customer support system.

Related Documents

• Terms of Service

• Acceptable Usage Policy

• Privacy Policy

• Cookie Policy

End of Data Processing Agreement.