Last updated: 19 August 2026
This Data Processing Agreement (“DPA”) forms part of the Deltaly Platform Terms and applies where Deltaly processes personal data on behalf of a dental practice using Deltaly.
For the processing covered by this DPA, the dental practice (“Practice”) is the Controller and Deltaly is the Processor.
Deltaly may separately act as a Controller for limited processing carried out for its own purposes, such as account administration and platform security, as described in the Deltaly Privacy Notice. That processing is outside the scope of this DPA.
If there is any conflict between this DPA and the Platform Terms in relation to processing personal data on behalf of the Practice, this DPA takes precedence.
1. Definitions
In this DPA, Controller, Processor, Personal Data, Personal Data Breach, Processing, Data Subject and Special Category Data have the meanings given to them by applicable UK data protection law.
Practice means the dental practice using Deltaly.
Deltaly means the provider of the Deltaly platform.
2. Scope and instructions
Deltaly will process Personal Data on behalf of the Practice only as necessary to provide the Deltaly services selected or enabled by the Practice and in accordance with the Practice’s documented instructions.
The Platform Terms, this DPA, the Practice’s configuration and use of Deltaly, and other written instructions agreed between the parties constitute documented instructions.
If Deltaly is required by law to process Personal Data other than on the Practice’s instructions, Deltaly will inform the Practice before doing so unless the law prohibits that notification.
Deltaly will inform the Practice if, in Deltaly’s reasonable opinion, an instruction infringes applicable data protection law.
3. Responsibilities of the Practice
The Practice is responsible for:
- ensuring that its instructions to Deltaly are lawful;
- identifying an appropriate lawful basis for processing Personal Data;
- where Special Category Data is processed, identifying an appropriate Article 9 condition and any applicable condition under the Data Protection Act 2018;
- providing required privacy information to patients and other Data Subjects;
- ensuring Personal Data made available to Deltaly is adequate, relevant, accurate and limited to what is necessary;
- determining which members of its team are authorised to use Deltaly; and
- complying with its obligations as Controller under applicable data protection law.
4. Confidentiality
Deltaly will ensure that people authorised to process Personal Data on behalf of the Practice are subject to appropriate confidentiality obligations and access the information only where necessary for their role.
5. Security
Deltaly will implement and maintain appropriate technical and organisational measures to protect Personal Data in accordance with Article 32 UK GDPR.
These measures include, where appropriate:
- data minimisation and local browser processing;
- encrypted communications;
- access and authentication controls;
- secure hosting;
- software maintenance and security updates;
- appropriate logging and monitoring;
- backup and recovery arrangements; and
- secure development and change-management practices.
Further information about Deltaly’s security measures is set out in its Technical and Organisational Measures and supporting security documentation.
Deltaly may update its security measures as technology, risks and the platform develop, provided that the overall level of protection is not materially reduced.
6. Sub-processors
The Practice gives Deltaly general written authorisation to use sub-processors where reasonably necessary to provide Deltaly services.
Deltaly maintains details of relevant sub-processors in its Subprocessor Register.
Deltaly will provide reasonable notice of material intended changes to sub-processors that process Personal Data on behalf of the Practice, giving the Practice a reasonable opportunity to object on legitimate data-protection grounds.
Deltaly will ensure that relevant sub-processors are subject to appropriate data-protection obligations providing an equivalent level of protection for the Personal Data.
Deltaly remains responsible to the Practice for the performance of its sub-processors’ applicable data-protection obligations.
7. International transfers
Deltaly will not transfer Personal Data processed on behalf of the Practice outside the United Kingdom except in accordance with applicable UK data protection law and the Practice’s documented instructions, including the general instructions contained in this DPA and the use of authorised sub-processors.
Where a restricted transfer requires safeguards, Deltaly will ensure that an appropriate transfer mechanism and any required supplementary measures are in place.
8. Data Subject rights
Taking account of the nature of the processing, Deltaly will provide reasonable assistance to enable the Practice to respond to requests from Data Subjects exercising their rights under UK data protection law.
If Deltaly receives a request relating to Personal Data for which the Practice is Controller, Deltaly will not respond on the Practice’s behalf unless authorised or legally required to do so, and will direct or forward the request to the Practice where appropriate.
9. Personal Data Breaches
Deltaly will notify the Practice without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on the Practice’s behalf.
Taking account of the information available to Deltaly, Deltaly will provide information reasonably required to assist the Practice in meeting its breach assessment and notification obligations.
Deltaly will take reasonable steps to contain, investigate and remediate the incident.
10. Assistance with compliance
Taking account of the nature of the processing and information available to Deltaly, Deltaly will provide reasonable assistance to the Practice with its obligations relating to:
- security of processing;
- Personal Data Breaches;
- Data Protection Impact Assessments; and
- prior consultation with the Information Commissioner’s Office where required.
11. Return and deletion
When processing on behalf of the Practice ends, Deltaly will, at the Practice’s choice, delete or return the relevant Personal Data and delete existing copies unless UK law requires continued storage.
Where immediate deletion from backups is not technically practicable, the information may remain protected and beyond normal use until deletion through the applicable backup lifecycle.
12. Information, audits and inspections
Deltaly will make available information reasonably necessary to demonstrate compliance with Article 28 UK GDPR and this DPA.
The Practice may request reasonable additional information or an audit where necessary to verify compliance. The parties will normally first seek to satisfy such requests through Deltaly’s current governance, security and assurance documentation.
Where an on-site or additional independent audit is reasonably necessary, it will be arranged on reasonable notice, during normal business hours and in a way that minimises disruption and does not compromise the confidentiality or security of other customers or systems.
The Practice will bear its reasonable audit costs unless the audit identifies a material breach of this DPA by Deltaly.
13. Deltaly acting outside the Practice’s instructions
If Deltaly determines the purposes and means of processing Personal Data outside the Practice’s documented instructions, Deltaly will be responsible as Controller for that processing to the extent required by applicable data protection law.
14. Duration and changes
This DPA applies for as long as Deltaly processes Personal Data on behalf of the Practice.
Deltaly may update this DPA where reasonably necessary to reflect changes in law, regulatory guidance or Deltaly services, provided that the protections required by Article 28 UK GDPR are maintained.
Material changes will be notified through an appropriate channel.
Schedule 1 – Details of Processing
Subject matter
Processing of Personal Data by Deltaly on behalf of the Practice in order to provide enabled Deltaly functionality, including patient Membership administration and other features where server-side processing is performed on the Practice’s behalf.
Duration
For the period during which the Practice uses the relevant service, plus any limited period required for secure deletion, backup lifecycle, legal obligations or agreed transition arrangements.
Nature and purpose
Collection, retrieval, transmission, organisation, storage, display, administration, updating and deletion of Personal Data as necessary to provide the relevant Deltaly service on the Practice’s instructions.
Data Subjects
Depending on the services used:
- patients;
- parents, guardians or other authorised people managing linked patient memberships; and
- authorised Practice users where their information is processed on the Practice’s behalf.
Personal Data
Depending on the services used, this may include:
- patient identity and contact information;
- Dentally patient identifiers;
- membership plan, options and status;
- membership dates and service-availability information;
- linked family membership information;
- payment and subscription identifiers and status;
- referral reference numbers and limited referral-status information; and
- other limited administrative information required to provide the instructed service.
Special Category Data
For Membership, Deltaly may process limited health information comprising:
- the Practice’s recommended membership plan; and
- relevant recall information or dates where these reflect or relate to the patient’s dental care requirements.
Deltaly does not determine the clinical recommendation or recall.
Controller obligations and rights
The Practice determines the purposes of the processing, provides lawful documented instructions, determines the relevant Article 6 lawful basis and Article 9 condition where applicable, fulfils its transparency and Data Subject obligations, and may exercise the rights and instructions set out in this DPA.
Schedule 2 – Membership Processing
Where the Practice enables Deltaly Membership, the Practice determines its membership plans, pricing, included services, clinical content, recall arrangements and any patient-specific recommendation.
Deltaly does not determine whether a plan, recall interval, examination, hygiene appointment, treatment or other service is clinically appropriate.
Deltaly processes the limited information supplied or made available by the Practice to administer Membership. This may include:
- presenting membership recommendations to patients;
- recording patient-approved membership changes;
- managing membership status;
- determining when included services become available;
- supporting family membership management; and
- administering payment and subscription status through Stripe.
The Practice’s documented instructions include its authorised configuration and use of Membership and actions taken by its authorised users through Deltaly.
Schedule 3 – Security and Sub-processors
Deltaly’s current technical and organisational security controls are documented in its Technical and Organisational Measures.
The current list of relevant sub-processors and their functions is maintained in the Deltaly Subprocessor Register.
These documents may be updated from time to time as suppliers, services and security controls change.
Acceptance
This DPA forms part of the Deltaly Platform Terms.
By agreeing to the Platform Terms on behalf of a Practice, or by the Practice continuing to use Deltaly where Deltaly processes Personal Data on its behalf, the Practice agrees to this DPA.