Data Processing Agreement

Vocaform

Vocaform Data Processing Agreement

Between EF Osteopathic Clinics Ltd trading as Vocaform (Data Processor) and the subscribing clinic (Data Controller)
Last updated: July 2026

1. Background

This Data Processing Agreement (DPA) forms part of the Terms of Service between EF Osteopathic Clinics Ltd trading as Vocaform (the Processor) and the clinic or individual therapist subscribing to Vocaform (the Controller).

This DPA sets out the terms on which the Processor will process personal data on behalf of the Controller in connection with the provision of the Vocaform platform, in compliance with Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR).

2. Definitions

Personal Data — any information relating to an identified or identifiable natural person as defined in Article 4(1) GDPR.

Processing — any operation performed on personal data as defined in Article 4(2) GDPR.

Data Controller — the clinic or individual therapist who determines the purposes and means of processing patient personal data.

Data Processor — EF Osteopathic Clinics Ltd trading as Vocaform, who processes personal data on behalf of the Controller.

Sub-processor — any third party engaged by the Processor to process personal data on behalf of the Controller.

3. Subject matter and nature of processing

The Processor will process personal data on behalf of the Controller for the purpose of providing the Vocaform clinical documentation platform, including:

  • Delivering the AI-guided case history interview to patients via a secure link
  • Storing and processing patient responses to generate the case history transcript
  • Building and maintaining the clinical record within the platform
  • Generating automated clinical reports
  • Delivering exercises, advice, and reports to patients by email where instructed by the Controller

4. Categories of data subjects

  • Patients of the Controller’s clinic
  • Therapists employed by or working within the Controller’s clinic

5. Categories of personal data processed

  • Patient contact details — name, email address, phone number — provided by the Controller for the purpose of delivering the interview link
  • Patient clinical data — responses to the case history interview, examination findings, diagnosis, treatment plan, and clinical report
  • Patient demographic data — age in years and sex
  • Therapist account data — name, email address, clinic name

6. Duration of processing

The Processor will process personal data for the duration of the Controller’s active Vocaform subscription, plus a period of 30 days following cancellation to allow data export. After this period all identifiable personal data will be permanently deleted from the Processor’s systems.

7. Obligations of the Processor

The Processor agrees to:

7.1 Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or international organisation.

7.2 Ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations.

7.3 Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of personal data in transit and at rest
  • Storage of all personal data on European servers
  • Regular testing and evaluation of security measures
  • Access controls limiting data access to authorised personnel only

7.4 Not engage any sub-processor without prior written authorisation from the Controller, and ensure any sub-processor is subject to the same data protection obligations as set out in this DPA.

7.5 Assist the Controller in responding to requests from data subjects exercising their rights under GDPR, including rights of access, rectification, erasure, restriction, portability, and objection.

7.6 Assist the Controller in ensuring compliance with GDPR obligations relating to security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities.

7.7 Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller.

7.8 Notify the Controller without undue delay upon becoming aware of a personal data breach affecting data processed under this DPA.

7.9 Delete or return all personal data to the Controller on termination of the subscription, and delete existing copies unless European Union or Member State law requires storage.

8. No personal data to AI

The Processor confirms that no identifiable patient personal data is transmitted to or processed through OpenAI or any other external AI language model. The AI-guided case history interview is conducted within Vocaform’s own secure infrastructure. Anonymised aggregate data — where patient consent has been given — may be used for research and product improvement purposes as described in the Privacy Policy.

9. Sub-processors

The Controller provides general written authorisation for the Processor to engage sub-processors for the provision of infrastructure, hosting, and technical services, subject to the conditions in clause 7.4. A current list of sub-processors is available on request from info@vocaform.ai.

10. Transfer of data outside the EEA

The Processor will not transfer personal data outside the European Economic Area without the prior written consent of the Controller, except where required to do so by European Union or Member State law.

11. Obligations of the Controller

The Controller agrees to:

11.1 Ensure that patients are informed of and have consented to the use of Vocaform for clinical documentation purposes, in accordance with applicable data protection law and professional obligations.

11.2 Ensure that the use of Vocaform complies with the Controller’s own data protection obligations, including maintaining an accurate record of processing activities.

11.3 Not instruct the Processor to process personal data in a manner that would breach applicable data protection law.

12. Liability

Each party’s liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA limits either party’s liability for breach of their respective obligations under GDPR.

13. Governing law

This DPA is governed by the laws of Ireland and is subject to the jurisdiction of the Irish courts.

14. Contact

For all data protection queries contact:
EF Osteopathic Clinics Ltd trading as Vocaform
info@vocaform.ai
vocaform.ai