Skip to content
SafeTrace
Sign inStart a trial

Draft, requires legal review. These documents are drafts and are not yet in force. Text in [square brackets] is still to be completed or confirmed.

SafeTrace Data Processing Agreement

Version 0.1 (draft for legal review), 13 October 2026. Not yet in force.

This Data Processing Agreement ("DPA") forms part of the SafeTrace Terms of Service (the "Terms") between [MEDICORE LEGAL ENTITY NAME] Limited, trading as Medicore (CRO [CRO NUMBER], [REGISTERED ADDRESS]) ("Medicore", the "Processor") and the Customer (the "Controller"). It applies whenever Medicore processes Personal Data on the Customer's behalf in providing SafeTrace.

Capitalised terms not defined here have the meaning given in the Terms or in the GDPR.

1. Definitions

  • Applicable Data Protection Law:
  • Regulation (EU) 2016/679 (the "GDPR");
  • the Data Protection Act 2018 (Ireland);
  • the ePrivacy Regulations (S.I. No. 336 of 2011);
  • where the Customer is established in the United Kingdom, the UK GDPR and the Data Protection Act 2018 (UK);
  • any other law relating to personal data that applies to a party's processing under the Terms.
  • Customer Personal Data: Personal Data in Customer Data processed by Medicore on the Customer's behalf. Annex 1 describes it.
  • Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
  • Sub-processor: any third party that Medicore engages to process Customer Personal Data.
  • Restricted Transfer: a transfer of Customer Personal Data to a country outside the European Economic Area that has no adequacy decision under Article 45 GDPR.
  • SCCs: the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

2.1 The Customer is the controller of Customer Personal Data and Medicore is its processor. Where the Customer acts as a processor for a third party (for example a service provider testing equipment for a hospital), Medicore is its sub-processor. The Customer warrants that its own controller has authorised Medicore's engagement on the terms of this DPA.

2.2 Medicore is an independent controller only for the Personal Data described in its Privacy Notice. This covers account, billing, support and website data used to run its business. This DPA does not apply to that data.

2.3 Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects.

3. Customer instructions

3.1 Medicore will process Customer Personal Data only on the Customer's documented instructions, unless EU or Member State law requires otherwise. In that case Medicore will tell the Customer of the legal requirement first, unless the law prohibits this on important grounds of public interest.

3.2 The Customer's instructions are:

  • (a) these Terms and this DPA;
  • (b) the Customer's and its Users' use and configuration of the Service, including settings, roles, client scopes, Connected Apps and webhooks;
  • (c) any other written instruction agreed by the parties.

3.3 Optional features. Turning on an optional feature is an instruction to process the data it needs. In particular, if an owner turns on analyser photo capture when it is available, the Customer instructs Medicore to send the photo and the relevant procedure steps to the AI sub-processor in Annex 3 to propose values for the User to confirm.

3.4 Medicore will tell the Customer promptly if, in its opinion, an instruction infringes Applicable Data Protection Law. It need not carry out that instruction until the Customer confirms or changes it.

3.5 The Customer is responsible for:

  • the lawfulness of its instructions;
  • having a lawful basis for the processing;
  • giving data subjects any information required under Articles 13 and 14 GDPR;
  • keeping patient information and other special category data out of the Service (Annex 1).

4. Confidentiality

Medicore ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, either by contract or by statute. Access is given only to the extent needed to provide, secure and support the Service.

5. Security

5.1 Medicore will implement and maintain appropriate technical and organisational measures under Article 32 GDPR, including those in Annex 2. Medicore may update these measures, but not so as to reduce the overall level of protection.

5.2 The Customer is responsible for the security measures within its control. These include:

  • configuring roles and client scopes appropriately;
  • keeping credentials, authenticator devices and API keys secure;
  • removing access for leavers and unused Connected Apps;
  • not uploading data that the Service is not designed to hold, as described in the Terms.

6. Sub-processors

6.1 The Customer gives general authorisation for Medicore to engage Sub-processors. The current list is in Annex 3 and at [SUBPROCESSOR URL, e.g. https://safetrace.ie/legal/subprocessors].

6.2 Medicore will give the Customer at least 30 days' notice of any intended addition or replacement of a Sub-processor, by email to owners or in the Service.

  • The Customer may object on reasonable data protection grounds within that period.
  • The parties will then discuss the objection in good faith.
  • If Medicore cannot reasonably accommodate the objection, the Customer may terminate the affected Service. It will receive a pro-rata refund of prepaid fees for the unused period.

6.3 Medicore will impose data protection obligations on each Sub-processor by written contract. These obligations will be no less protective than this DPA. Medicore remains liable to the Customer for each Sub-processor's performance.

6.4 In an emergency affecting the security or continuity of the Service, Medicore may replace a Sub-processor at shorter notice. It will notify the Customer as soon as possible, and clause 6.2's objection right then applies.

7. International transfers

7.1 Medicore hosts the primary database and file storage in the European Union, in Supabase's eu-west-1 region (Ireland), and runs the application's server functions in Vercel's dub1 region (Dublin) [CONFIRM before publication].

7.2 Medicore will make a Restricted Transfer only where a valid transfer mechanism under Chapter V GDPR is in place. Examples are:

  • an adequacy decision, including the EU-US Data Privacy Framework for certified recipients;
  • the SCCs, together with a transfer impact assessment and any supplementary measures needed.

7.3 Where the SCCs apply between Medicore and a Sub-processor, Medicore enters into Module 3 (processor to processor).

8. Assistance to the Customer

8.1 Data subject requests. Medicore will help the Customer respond to requests from data subjects exercising their rights under Chapter III GDPR, by appropriate technical and organisational measures and as far as possible. The Service lets the Customer find, export and correct records. If Medicore receives a request directly, it will pass it to the Customer without undue delay and will not respond itself, except to direct the person to the Customer.

8.2 Other assistance. Medicore will provide reasonable assistance, taking into account the nature of processing and the information available to it, with:

  • the Customer's obligations under Articles 32 to 36 GDPR;
  • data protection impact assessments;
  • prior consultation with the Data Protection Commission.

Medicore may charge reasonable costs for assistance beyond what the Service's features and Medicore's standard documentation provide.

9. Personal Data Breaches

9.1 Medicore will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

9.2 The notification will include, as far as then known:

  • the nature of the breach, including the categories and approximate numbers of data subjects and records concerned;
  • the likely consequences;
  • the measures taken or proposed;
  • a contact point.

Information may be provided in phases.

9.3 Medicore will take reasonable steps to contain, investigate and mitigate the breach. It will cooperate with the Customer so that the Customer can meet its obligations under Articles 33 and 34 GDPR.

9.4 Medicore's notification is not an admission of fault or liability.

9.5 Unsuccessful attempts that do not compromise security, such as pings, port scans and failed sign-in attempts, are not Personal Data Breaches.

10. Return and deletion

10.1 On termination, the Customer may export Customer Personal Data using the Service's export features or the API, or request an export within 30 days.

10.2 Medicore will then delete Customer Personal Data from the live Service within 90 days, and from backups within the backup cycle in Annex 2. This does not apply where EU or Member State law requires storage. In that case Medicore will protect the data, keep it confidential and process it only for the purpose required.

10.3 On request, Medicore will confirm deletion in writing.

11. Audits

11.1 Medicore will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including this DPA, Annex 2, the Sub-processor list and, where available, summaries of third-party certifications or penetration test results.

11.2 If that information is not reasonably sufficient, or a supervisory authority requires it, the Customer may carry out an audit, including an inspection, by itself or through an independent auditor bound by confidentiality, on these conditions:

  • (a) at least 30 days' written notice;
  • (b) no more than once in any 12 months, unless following a Personal Data Breach or a regulator's request;
  • (c) during business hours, without unreasonable disruption and without access to other customers' data;
  • (d) at the Customer's cost.

11.3 Audits of Sub-processors are satisfied by Medicore providing their certifications and reports, unless Applicable Data Protection Law requires more.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, including the separate cap in clause 13.5(c) of the Terms. Nothing in this DPA limits either party's liability to data subjects under Article 82 GDPR, or limits liability in a way the GDPR does not permit.

13. Term, precedence and changes

13.1 This DPA lasts as long as Medicore processes Customer Personal Data.

13.2 If this DPA conflicts with the Terms, this DPA prevails on data protection matters. If the SCCs apply and conflict with this DPA, the SCCs prevail.

13.3 Medicore may update this DPA to reflect changes in Applicable Data Protection Law, a regulator's guidance or the Service, provided the update does not reduce the protection of Customer Personal Data; otherwise, on notice under clause 15 of the Terms.

13.4 This DPA is governed by the laws of Ireland, and the courts of Ireland have exclusive jurisdiction.

Annex 1: Details of processing

Subject matter. Hosting and processing Customer Data so that the Customer can record the inspection, testing, release and lifecycle of medical electrical equipment in SafeTrace.

Duration. The term of the Terms plus the return and deletion period in clause 10.

Nature and purpose.

  • Storage, retrieval, organisation and display of equipment, procedure and test records.
  • Recording declarations, release, quarantine and override decisions with the person and time.
  • Access control, including client-scoped access for client viewers and Connected Apps.
  • Sending notifications and digests by email.
  • Generating reports, labels and exports.
  • Delivering data to the Customer's Connected Apps and webhooks.
  • Optional features when an owner turns them on, such as analyser photo capture when it is available.
  • Support and security monitoring.

Categories of data subjects.

  • The Customer's Users: owners, quality managers, engineering leads, engineers, auditors and client viewers.
  • Contacts at the Customer's clients, sites and suppliers.
  • People named in records, such as the person responsible for a location or vehicle.
  • People who appear incidentally in photos or free-text notes, which the Customer should avoid.

Categories of Personal Data.

  • Identity and contact details: name, work email, job title, picture.
  • Account data: authentication identifiers, two-step sign-in enrolment (not the secret itself), memberships and roles.
  • Activity data: the audit trail of actions with timestamps, and IP-derived security logs.
  • Work records: who tested, declared, released, quarantined or overrode, when, and any drawn signature or attestation.
  • Content entered by the Customer, such as notes, nonconformity descriptions and photos.

No patient data; special categories. The Service is designed for equipment records and is not intended for patient information or any special category data (Article 9 GDPR) or data about offences (Article 10 GDPR). The Customer must not enter them, must keep free-text notes and photos to the equipment, and must remove any such data it finds. If it is entered despite this, it is processed only as Customer Personal Data under this DPA.

Frequency. Continuous for the duration of the Service.

Retention. As managed by the Customer during the term, then per clause 10.

Annex 2: Technical and organisational measures

Access control and tenancy

  • Every tenant-owned record carries the organisation identifier. Access is enforced both in application code and by PostgreSQL row-level security on every table, with default-deny grants.
  • Fixed roles with a single permission system enforced in the database. Client viewers and Connected Apps can be limited to particular clients (and apps to particular sites).
  • Browser clients receive only publishable (non-privileged) keys. No service-role key is used in the application.
  • Automated tests check permission boundaries, including cross-organisation reads, on every table.

Authentication

  • Managed authentication (Supabase Auth) with hashed passwords and secure, HTTP-only session cookies.
  • Two-step sign-in (TOTP) is required for owners, quality managers and engineering leads, and for release, override, user, settings and billing management whatever the role.
  • Invitation tokens, API keys and job tokens are stored only as SHA-256 hashes.

Encryption

  • TLS 1.2+ in transit.
  • Encryption at rest for the database and file storage, provided by the hosting sub-processors [CONFIRM: AES-256].
  • Webhook signing secrets are sealed with an application key before storage.

Integrity and evidence

  • Published procedure versions, released runs and their reports are immutable and versioned; they are never overwritten.
  • An append-only audit trail, written by database triggers, records every change with the actor and timestamp. Token hashes never enter it.

Files

  • Private storage buckets; files are downloaded only through short-lived signed links after a permission check.
  • Uploads are type-checked from their bytes and size-limited; SVG images are not accepted as pictures, and logos are sanitised. SHA-256 hashes are recorded.
  • [Malware scanning: planned, CONFIRM before publication.]

Availability and resilience

  • Managed PostgreSQL with daily backups and point-in-time recovery [CONFIRM retention, for example 7 to 35 days].
  • Restore procedures are tested [CONFIRM].
  • A health endpoint is monitored for uptime.

Application security

  • Input validation (Zod) at every input boundary.
  • Server-side authorisation of every change, checked again in the database.
  • Security headers on every response; API rate limits per key.
  • Webhooks are signed and are never sent to private, loopback or link-local addresses.
  • Dependencies installed from a lockfile.

AI features (planned)

  • Off until configured and turned on by an owner.
  • Only the photo and the relevant procedure steps are sent.
  • Outputs are proposals that a User must confirm; pass and fail are never decided by the model.
  • The provider does not train on API data [CONFIRM against Anthropic's commercial terms].

Organisational measures

  • Staff confidentiality obligations.
  • Least-privilege access to production.
  • Access reviews [CONFIRM frequency].
  • Incident response procedure.
  • Data protection training.
  • Sub-processor due diligence.

Monitoring

  • Error monitoring scrubs personal data, and request bodies and record content are excluded.
  • The website uses no analytics or tracking cookies.

Annex 3: Sub-processors

See Sub-processors. That list forms part of this Annex.