1. Definitions and scope
Controller Personal Data means personal data processed by Eselram on behalf of the Controller in connection with Eselram. Data Protection Law means the UK GDPR, Data Protection Act 2018 and other applicable UK data-protection legislation as amended from time to time. Terms such as controller, processor, personal data, processing, personal data breach and data subject have the meanings given by Data Protection Law.
Service arrangements and proposed partnership
Under the current arrangements, Eselram provides and supports the hosted service. The proposed Laser Station pilot is an introduction and evaluation arrangement; referrals alone do not authorise The Laser Station to access practitioner client records or make it the processor for those records. Pilot practitioners must agree the applicable service terms and this DPA before using the service with personal data.
A later licence under which The Laser Station sells and operates the service is subject to a separate agreement. Before any operator change takes effect, the parties must identify the operating legal entity, document its role and any technical supplier's role, update the customer agreement, privacy information and subprocessor notice, and establish the required binding processing arrangements and authorisations. This DPA does not itself transfer the service or authorise a new operator to access records. Software ownership and commercial royalties do not determine data-protection roles or grant access to practitioner data.
2. Processing details
Subject matter: hosted booking, client management, forms, consultation, treatment record, payment reference and communications services. Duration: while the customer's hosted account is active, any agreed export/closure period and legally required retention. Nature and purpose: tenant provisioning and routing, storage in tenant-specific Cloudflare D1 resources, managed R2 object storage where uploads are used, retrieval, communication delivery, technical support, security, backup, restoration and deletion. Data subjects: practitioners' clients, prospective clients, account owners and other authorised contacts or users whose data is supplied to the service. Data categories: contact details, bookings, form answers, consent/signature records, photographs, treatment/clinical notes, health information, payment references and associated metadata. Special-category data: health information where treatment workflows are used. The Controller remains responsible for identifying a lawful basis and applicable Article 9 condition.
3. Controller instructions
Eselram will process Controller Personal Data only on documented instructions from the Controller, including these terms, the Terms of Service, configured service settings and written support instructions, unless UK law requires otherwise. If Data Protection Law permits, Eselram will inform the Controller before processing required by law. Eselram will promptly inform the Controller if, in Eselram's opinion, an instruction infringes Data Protection Law.
Client records must not be used for unrelated marketing, equipment sales or partner sales activity. Disclosures to a referral or commercial partner require a separate lawful basis and any necessary Controller instruction. Eselram processes its own business account, subscription billing and service administration data under the roles and purposes described in its Privacy Notice; this does not give it an independent purpose for using practitioner clinical records.
4. Confidentiality
Eselram will ensure that persons authorised to process Controller Personal Data have committed themselves to confidentiality or are under an appropriate statutory duty of confidentiality and access the data only as necessary for their role.
5. Security
Eselram will implement appropriate technical and organisational measures under Article 32 UK GDPR, taking account of the risk, including tenant-level access restrictions, authentication, secure transport, restricted operational access, separation of test and live environments, security logging, incident response and proportionate backup/recovery controls. Eselram will review and test measures as appropriate. Eselram will document and review the implementation and effectiveness of these measures, including tenant isolation, administrator access, key handling and backup arrangements, taking account of the processing risks. The Controller is responsible for its own authorised users, devices, lawful configuration and independently controlled integrations.
Technical support, maintenance, bug fixing and recovery access must be authorised, limited to the task and restricted to people who need it. A supplier's ongoing maintenance responsibilities or software ownership do not create unrestricted access to client data. The Controller should avoid sending unnecessary clinical information in support requests.
6. Subprocessors
The Controller gives Eselram general written authorisation to appoint subprocessors needed to provide the service. Eselram will maintain a current Subprocessors & Integrations Notice, ensure each subprocessor is bound by written obligations imposing the same data-protection obligations required by this DPA, insofar as applicable to the processing it performs, and remain responsible to the Controller for performance of Eselram's processor obligations by its subprocessors.
Eselram will inform the Controller in writing in advance of intended additions or replacements of subprocessors, giving reasonable notice so the Controller may raise a reasonable, documented objection on data-protection grounds. The parties will work in good faith to address the concern. If no reasonable alternative is available, either party may discontinue the affected feature or terminate the affected service in accordance with the Terms.
Managed email delivery, including Resend where used, forms part of the processing chain for practitioner communications. Optional Gmail or Google Analytics connections and payment integrations are described in the linked notice. Whether a provider is a subprocessor or an independent controller depends on its actual processing and applicable terms; a customer-owned account or separate credentials do not alone remove it from the processing chain. Optional analytics must not receive clinical form answers, treatment notes, photographs or signatures.
Subscription billing for access to Eselram is separate from practitioner treatment payments through Stripe Connect. Changing a subscription billing account does not itself transfer connected practitioner accounts, treatment payments or authority over client records.
7. Data-subject rights
Taking account of the nature of processing, Eselram will provide reasonable assistance by appropriate technical and organisational measures, insofar as possible, to enable the Controller to respond to requests to exercise data-subject rights. If Eselram receives a request relating to Controller Personal Data, it will not respond on the merits except on the Controller's instructions or where legally required, and may direct the requester to the Controller.
8. Personal data breaches
Eselram will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller Personal Data. As information becomes reasonably available, Eselram will provide details needed to assist the Controller with its obligations, which may include the nature of the breach, categories of affected data and people, likely consequences, and measures taken or proposed. Eselram's notification does not constitute an admission of fault or liability.
9. Assistance and DPIAs
Taking account of the nature of processing and information available to Eselram, Eselram will provide reasonable assistance with the Controller's obligations concerning security, breach notification, data protection impact assessments and prior consultation with the ICO where Data Protection Law requires it.
10. International transfers
Eselram will not initiate a restricted transfer of Controller Personal Data except on documented instructions or where an applicable UK adequacy regulation, International Data Transfer Agreement, UK Addendum to approved standard contractual clauses or another lawful transfer mechanism applies. The Controller authorises transfers made by approved subprocessors in accordance with those safeguards. Customer-selected third-party accounts may create separate transfer responsibilities for the Controller.
11. Return and deletion
At the Controller's choice following termination of the relevant processing services, Eselram will return or delete Controller Personal Data and delete existing copies, unless applicable law requires retention. The parties will document the available export or deletion method and applicable timetable when the Controller requests closure, subject to legal retention requirements. Data held temporarily in secure backups will be restricted from ordinary use and removed according to a documented backup lifecycle. No fixed export format, recovery period or deletion deadline is guaranteed unless separately agreed in writing, without prejudice to Eselram's duties under applicable data-protection law.
A pilot ending or a proposed commercial licence ending does not transfer ownership of practitioner client data to Eselram or The Laser Station. Any agreed continuity or handover period must preserve authorised access and provide for return or deletion under this clause. Clinical data must not be retained simply because software ownership or commercial arrangements change.
12. Audit and compliance information
Eselram will make available information reasonably necessary to demonstrate compliance with applicable Article 28 processor obligations and allow and contribute to reasonable audits or inspections by the Controller or an auditor mandated by it. Audits must be proportionate, protect the confidentiality and security of other customers and Eselram systems, and ordinarily use existing documentation or remote evidence before intrusive inspection. Except following a qualifying breach or where a regulator requires otherwise, the Controller will give reasonable notice and bear its own audit costs.
13. Controller obligations
The Controller is responsible for ensuring that its instructions and processing are lawful, fair and transparent; identifying lawful bases and any required special-category conditions; providing privacy information; obtaining any required consent; data minimisation and accuracy; retention; user permissions; data-subject requests; and assessing whether its use of Eselram requires a DPIA or other safeguards.
14. Liability and order of terms
Liability arising under this DPA is subject to the liability provisions in the Terms of Service except to the extent Data Protection Law prohibits a limitation. If this DPA conflicts with the Terms on the processing of Controller Personal Data, this DPA takes priority to the extent of the conflict.
15. Contact
Service name: Eselram
Current legal service provider / Processor: Marlese Rosch Haden trading as ESELRAM.COM
Email: [email protected]
Business correspondence address: 2 Hagbourne Close, Woodcote, RG8 0RZ, United Kingdom