Data Processing Agreement

This Data Processing Agreement (DPA) sets out the terms under which CBT Flow processes personal data on behalf of practitioners using the platform.

1. Scope

This DPA applies to the processing of personal data by CBT Flow as a data processor on behalf of the practitioner (data controller) in connection with the provision of the CBT Flow platform.

2. Processing Details

CBT Flow processes personal data solely for the purpose of providing the platform services. Processing includes storage, retrieval, and display of clinical data entered by practitioners.

3. Security Measures

CBT Flow implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular testing.

4. Sub-processors

CBT Flow uses sub-processors for hosting and infrastructure. A current list of sub-processors is available upon request.