This Data Processing Agreement sets out how Runova handles personal data on the clinic's behalf, as required by UK data protection law (UK GDPR and the Data Protection Act 2018). It forms part of the service agreement between the parties.
This Agreement is made between:
(1) Runova, a trading name of Mr Abdigani Mohamed, registered with the UK Information Commissioner's Office ("Runova", "the Processor"); and
(2) [Clinic legal name], of [clinic address] ("the Clinic", "the Controller").
Together "the parties".
1.1 The Clinic uses Runova's AI receptionist service to receive, respond to and manage customer enquiries made through the Clinic's Instagram account.
1.2 In providing this service, Runova processes personal data relating to the Clinic's customers. For this data, the Clinic is the data controller (it decides why and how the data is used) and Runova is the data processor (it processes the data on the Clinic's instructions).
1.3 This agreement governs that processing. Where the parties' service agreement conflicts with this agreement on data protection matters, this agreement takes precedence.
Subject matter: operation of an AI receptionist that reads and replies to customer Instagram messages, scores enquiries, and presents them in a dashboard.
Duration: for as long as the Clinic is an active client, plus the deletion grace period in clause 7.
Nature and purpose: receiving, storing, analysing and replying to customer enquiries; lead scoring; and dashboard reporting, all to help the Clinic respond to and convert enquiries.
Types of personal data:
Categories of data subjects: the Clinic's customers and prospective customers who message the Clinic's Instagram account.
The parties acknowledge that customers may volunteer health-related information in their messages. The Clinic remains responsible, as controller, for the lawful basis for processing any such information.
Runova shall:
3.1 Process personal data only on the Clinic's documented instructions, including those set out in this agreement and the service setup, unless required to do otherwise by law (in which case Runova will inform the Clinic where permitted).
3.2 Ensure that people authorised to process the data are bound by confidentiality.
3.3 Implement appropriate technical and organisational security measures, including encryption of data in transit, restricted access on a need-to-know basis, and isolation of each clinic's data so that one clinic cannot access another's.
3.4 Not engage another sub-processor without the Clinic's general written authorisation. The Clinic authorises the sub-processors listed in clause 5, and Runova will give the Clinic reasonable notice of any intended changes so the Clinic can object.
3.5 Taking into account the nature of the processing, assist the Clinic, as far as reasonably possible, in responding to requests from individuals exercising their data protection rights.
3.6 Assist the Clinic in meeting its obligations around security, breach notification and data protection impact assessments.
3.7 Notify the Clinic without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Clinic's data.
3.8 At the Clinic's choice, delete or return the Clinic's personal data at the end of the service, as set out in clause 7.
3.9 Make available to the Clinic all information reasonably necessary to demonstrate compliance with this agreement, and allow for and contribute to audits, including inspections, conducted by the Clinic or another auditor mandated by the Clinic, in relation to the processing of the Clinic's personal data.
The Clinic shall:
4.1 Ensure it has a lawful basis to collect and process its customers' personal data, and that its own privacy notice tells customers their enquiries may be handled using an automated assistant provided by a third-party processor.
4.2 Provide instructions to Runova that are lawful.
4.3 Remain responsible for responding to its own customers' data protection requests in the first instance, with Runova's support.
The Clinic authorises Runova to use the following sub-processors to deliver the service:
| Sub-processor | Purpose |
|---|---|
| Meta Platforms (Instagram) | Source of customer messages |
| Supabase | Secure data storage and database |
| Make (Integromat) | Automation that connects the services |
| Anthropic | AI model that generates replies and scoring |
Each sub-processor processes data under its own security and data protection commitments. Runova remains responsible to the Clinic for its sub-processors' performance of data protection obligations.
Some sub-processors may process data outside the UK. Where they do, Runova will ensure an appropriate safeguard recognised under UK data protection law (such as UK adequacy regulations or standard contractual clauses with the UK addendum) is in place.
7.1 The Clinic's conversation and lead data held in Runova's systems is retained for as long as the Clinic is an active client.
7.2 When the Clinic stops using the service, Runova will delete that data from its systems after a grace period of 30 days, unless the Clinic asks in writing for it to be returned first, or unless a limited record must be kept to meet a legal or accounting obligation.
7.3 The original Instagram messages remain in the Clinic's own Instagram account and are within the Clinic's control, not Runova's.
Any notices or data protection requests under this agreement may be sent to Runova by email at runova.ai3@gmail.com. The parties may also use email as the ordinary means of communication for matters under this agreement.
9.1 Each party's liability under this agreement is subject to the limitations set out in the parties' main service agreement.
9.2 This agreement is governed by the laws of England and Wales.
9.3 If any part of this agreement is found to be unenforceable, the rest remains in effect.
This agreement is accepted when the Clinic confirms agreement during onboarding, by ticking the agreement box on Runova's onboarding form, or by confirming agreement to Runova in writing (for example by email). The date of that confirmation is the date this agreement takes effect. A clinic that prefers a traditionally signed copy can request one from Runova.