Information governance & data processing

1. Roles and scope

This Data Processing Agreement forms part of the Tempo GP Terms of Service between Studystreaks Ltd (the "Processor") and the GP practice, health board, cluster or other healthcare entity that holds the subscription (the "Controller").

The Controller determines the purposes and means of processing staff workload data. The Processor processes that data solely to provide the subscribed service and on the Controller's documented instructions, which include the instructions given through normal use of the application.

2. Subject matter, duration, nature and purpose

Subject matter: recording, storing, aggregating and reporting on the working time and workload of the Controller's clinical team.

Duration: for the term of the subscription, plus the retention window set out in clause 9.

Nature and purpose: workforce capacity measurement, safe working compliance reporting, and operational improvement planning. Tempo GP is not a clinical system.

3. Categories of data subject and personal data

Data subjects: clinicians and clinical team members of the Controller who hold an account — GP partners, salaried GPs, locums, trainees, ANPs, pharmacists, practice nurses and other roles the Controller adds.

Categories of personal data: account information; workload and operational data; self-reported ratings; uploaded paper sheets; billing data.

No special category data relating to patients is processed. Self-rated cognitive load and IT friction scores are occupational measures recorded voluntarily by the clinician about their own working day.

4. No patient identifiable data

Tempo GP never requests, collects, stores or processes patient identifiable data. Do not enter patient names, dates of birth, CHI or NHS numbers, or identifiable clinical detail into any free-text field, note or friction tag.

The Controller undertakes to instruct its staff accordingly. Free-text fields are optional throughout the application and are excluded from every data export and from all AI processing.

5. Sub-processors

The Controller gives general authorisation for the Processor to engage the sub-processors listed below. The Processor imposes data protection obligations equivalent to this agreement on each of them, and remains fully liable for their performance.

The Processor will give at least 30 days' notice before adding or replacing a sub-processor, during which the Controller may object and, if the objection cannot be resolved, terminate the subscription with a pro-rata refund.

• Supabase (EU (Frankfurt / Ireland)) — Managed Postgres database, authentication and encrypted file storage for uploaded paper sheets.
• Cloudflare (UK / EU edge locations) — Application hosting, edge delivery, TLS termination and DDoS protection.
• Stripe (EU / UK (PCI DSS Level 1)) — Subscription payments and invoicing. Card details are entered directly with Stripe and never reach our servers.
• Lovable AI Gateway (OpenAI / Google models) (EU / US processing under standard contractual clauses) — Reads uploaded paper sheets into numbers, and generates the written workload analysis. Only operational workload figures are sent; inputs are not used to train models and are not retained by the model provider for training.

6. Security measures

Encryption in transit: TLS 1.3 (HTTPS), with HSTS enforced.

Encryption at rest: AES-256 at rest, including database backups.

Logical separation and authorisation: Per-row database authorisation (Row Level Security) scoped to the signed-in clinician. Every table enforces per-user policies at the database layer, so a defect in application code cannot expose another practice's data.

Authentication: Email and password or Google sign-in, with hashed credentials handled by the managed auth provider. Uploaded sheet photographs are held in a private bucket readable only by the clinician who uploaded them.

Personnel: access to production data is limited to named administrators on a least-privilege basis and is used only to investigate faults raised by the Controller.

7. Confidentiality and staff

Everyone the Processor authorises to process personal data is bound by a duty of confidentiality and has received data protection training appropriate to their role.

8. Assistance to the Controller

Data subject requests: the application provides self-service access, correction and export, so most requests need no involvement from the Processor. Where assistance is needed, the Processor will respond within 10 working days.

The Processor will assist the Controller with data protection impact assessments and with prior consultation with a supervisory authority, on request, and will make available the information needed to demonstrate compliance with Article 28.

9. Return and deletion

On termination or expiry: full access for 30 days, read-only export access until day 90, and permanent deletion of all practice and personal records — including backups and uploaded sheet images — at day 90.

Deletion is carried out by an automated nightly process and is irreversible. Earlier deletion can be requested in writing at any time.

10. Personal data breach

The Processor will notify the Controller without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting the Controller's data, together with the nature of the breach, the categories and approximate number of records affected, the likely consequences and the measures taken.

11. International transfers

Primary storage is in the UK / EU. Where a sub-processor processes data outside the UK or EEA, transfers are covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, with a transfer risk assessment on file.

12. Audit

The Processor will make available on request the information necessary to demonstrate compliance with this agreement, including sub-processor certifications and security documentation, and will allow for and contribute to audits by the Controller or an auditor it mandates, no more than once a year unless required by a supervisory authority.

13. Governing law

This agreement is governed by the law of Scotland for UK subscriptions, or the law of the Controller's registered jurisdiction where that differs.