Data Processing Agreement - Truephase Notes

Version 0.1 · 7 November 2026 · the test-version agreement. Between the clinic ("you") and Truephase AI Limited ("Truephase"), company 17469289, 11 St. Nicholas Road, Thorne, Doncaster, England, DN8 5BS. It forms part of the Terms of Use and is drafted to meet the checklist in Article 28 of the UK GDPR. Version 1.0 will follow a solicitor's review and must be in place before any real patient's information is processed.

1. Roles and words

1.1 You decide why and how your patients' personal data is used. You are the controller. Truephase handles that data only to provide Notes and only as this agreement and your written instructions allow. Truephase is the processor.

1.2 "Personal data", "processing", "controller", "processor", "personal data breach" and "special category data" have the meanings given in the UK GDPR. "Patients" means the people whose consultations are written up with Notes. "Users" means your staff who sign in to Truephase. A "sub-processor" is another company Truephase uses to run part of Notes for you; they are listed in Annex 3. "Saved note" means one record of one form filled for one patient, as described in Annex 1.

1.3 Where Truephase decides how its own systems work - which providers it uses, how it secures data, how long it needs data to run Notes - it does so within the limits set here.

2. What Truephase will process

2.1 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of people are set out in Annex 1.

2.2 Truephase will process personal data only for the purposes in Annex 1 and only for as long as Annex 1 says, unless UK law requires otherwise, in which case Truephase will tell you first unless the law forbids that.

2.3 Truephase never keeps the conversation between your physiotherapist and the patient. It is sent to the AI sub-processor to draft the notes and is not stored by Truephase. Truephase never receives or stores audio.

3. Truephase's obligations

3.1 Instructions. Truephase will process personal data only on your documented instructions. This agreement, the Terms of Use, and the settings you choose on the Truephase website (including your retention period) are those instructions. If Truephase believes an instruction breaks data protection law, it will tell you promptly and may pause that instruction.

3.2 Confidentiality. Only Truephase staff who need access to provide Notes will have it, and each is bound by a written confidentiality obligation. No Truephase member of staff can read a saved note's text or patient reference through Truephase's systems: the database grants staff only counts, never the text columns. At present Truephase's staff is its director alone.

3.3 Security. Truephase will maintain at least the measures in Annex 2 and will not reduce them during the term without your agreement.

3.4 Sub-processors. You authorise the sub-processors in Annex 3. Truephase will give you at least 14 days' written notice by email before adding or replacing one. You may object in writing within that period on reasonable data-protection grounds; if the objection cannot be resolved, you may end Notes without penalty and clause 3.8 applies. Truephase has written terms with each sub-processor imposing obligations no less protective than this agreement, and remains fully responsible to you for their performance.

3.5 Helping with people's rights. If a patient or user asks you to see, correct, delete or restrict their data, or makes such a request to Truephase directly, Truephase will tell you within 2 working days and will find, provide, correct or delete the data within 5 working days of your instruction. Because the patient reference is encrypted and Truephase does not read it, Truephase will normally need you to identify the saved notes concerned, either by deleting them yourself from your Notes history or by giving Truephase the dates and patient reference in writing. The procedure is in Retention and deletion.

3.6 Helping with security and assessments. Truephase will help you meet your obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner's Office, taking into account the nature of the processing and the information Truephase has. Truephase's own DPIA for Notes is available to you on request and may be adopted into yours.

3.7 Breach notification. Truephase will tell you about any personal data breach affecting your data without undue delay and in any case within 24 hours of becoming aware of it, by email to your clinic owner's address, giving what it knows about the nature of the breach, the patients and data affected, the likely consequences, and what Truephase has done or proposes to do. Truephase will update you as it learns more. It will not tell the Information Commissioner's Office or affected patients on your behalf unless you ask it to.

3.8 End of the agreement. Within 14 days of the end of the Terms of Use, Truephase will give you a copy of your saved notes in a common format at no charge. Within 30 days of the end, Truephase will delete all of your personal data from its systems, including every saved note, every log row and your Stripe customer record, and will instruct its sub-processors to do the same, unless UK law requires retention. Two things are kept: invoices and payment records for six years because tax law requires it, and the record of which versions of these terms you accepted for six years so each of us can show what was agreed. Truephase will confirm deletion in writing on request.

3.9 Truephase's own use. Truephase will not use your patients' data for any purpose of its own, including training AI models, marketing, or improving Notes for other clinics, except that Truephase may keep aggregated, anonymous statistics (such as the number of forms filled per month) that cannot identify any person or your clinic.

3.10 Records and audits. Truephase keeps a record of its processing activities on your behalf. Once a year, and after any breach affecting you, Truephase will answer your reasonable written questions about its compliance within 14 days, and may answer by providing its sub-processors' independent security reports. If the answers are not sufficient, you or an independent auditor bound by confidentiality may audit Truephase's relevant systems on 30 days' notice, during business hours, remotely where possible, no more than once a year unless a breach has occurred, at your cost unless the audit finds a material breach of this agreement. Truephase is a very small company; audits will be scoped so they can be completed in one working day.

4. Your obligations

4.1 You are responsible for having a lawful basis for the processing in Annex 1, including the Article 9 condition for health data, for your own privacy notice to patients, and for the lawfulness of your instructions. The basis Truephase expects clinics to rely on is Article 9(2)(h) UK GDPR with paragraph 2 of Schedule 1 to the Data Protection Act 2018 (provision of health care by a registered professional); you confirm your own basis.

4.2 Telling patients. You will tell patients, in your privacy notice and at the clinic, that an AI tool provided by Truephase helps write up their consultation notes, that the written answers are stored by Truephase for the retention period, and that the conversation itself is not kept. Truephase provides suggested wording in Recording and telling patients.

4.3 Recording. If your physiotherapists use the Record button, you will make sure the patient is asked first, every time, in the words Truephase provides or words of your own that say the same, and that a patient who says no is written up by typing instead. You will not record a real patient while the extension states that recording is for practice only (Annex 3, speech-to-text).

4.4 Checking the AI. Every answer written by Notes is a draft. Your physiotherapist will read each answer before saving it into JellyPx, and remains responsible for the clinical record. Truephase never presses Save.

4.5 Your users. You will keep your list of users current, remove users who leave, keep logins and the clinic's join code private, and tell Truephase at once if a login may have been compromised.

4.6 JellyPx. You confirm that your use of a browser extension on JellyPx is permitted under your agreement with JellyPx.

4.7 Test version. While this agreement is version 0.1, you will use Notes only with practice patients and made-up conversations, and will not enter, paste or record any real patient's personal data.

5. Information that leaves the United Kingdom

5.1 Truephase's database is in London. The AI model is run by Anthropic PBC in the United States: the form questions and the conversation leave the UK for the time it takes to draft the notes and are not retained there. For this transfer Truephase relies on Anthropic's data processing addendum and, as applicable, the UK Extension to the EU-US Data Privacy Framework or the Information Commissioner's Office's International Data Transfer Addendum.

5.2 Stripe processes clinic billing details, never patient data, under Stripe's own UK and international arrangements.

5.3 Truephase will not transfer your personal data to any other country without your prior written agreement and a lawful mechanism.

6. Liability

6.1 Each of us is liable to the other for breach of this agreement, subject to section 10 of the Terms of Use. Neither of us can limit or exclude what the law does not allow to be limited or excluded, including a person's right to claim compensation under data protection law and any fine imposed by the Information Commissioner's Office.

7. General

7.1 If this agreement conflicts with the Terms of Use on a data-protection matter, this agreement wins.

7.2 This agreement lasts for as long as Truephase holds any of your personal data, and clauses 3.8 and 3.9 continue to apply after it ends.

7.3 This agreement is governed by the law of England and Wales.

7.4 You accept this agreement by ticking the box when you register your clinic's Truephase account. Truephase records the version accepted, a fingerprint of its text, the date and time, the login used and the internet address (IP address) it was accepted from. No signature is needed. If you would prefer a signed copy, email privacy@truephase.co.uk and we will provide one.

Annex 1 - The processing

Subject matter. Drafting clinical notes for physiotherapy forms in JellyPx from the consultation between your physiotherapist and the patient, and storing the written answers so your clinic can look back at them.

Duration. The term of the Terms of Use plus the deletion period in clause 3.8. Each saved note is kept for your retention period (below) and then deleted automatically.

Nature. Receiving the open form's questions, the conversation text and the patient reference from the extension; sending questions and conversation to an AI model to draft answers; encrypting and storing the answers and patient reference; returning the answers to the extension; showing saved notes to your users on the Truephase website; logging who did what; automatic deletion.

Purpose. To help your physiotherapists write up consultations accurately and quickly, with every answer checked by the physiotherapist before saving.

Types of personal data. Patients: patient number, name and date of birth as shown on the JellyPx page (the patient reference); what the patient and physiotherapist said, in transit only; the AI's written answers, which are clinical notes. Users: name, email, mobile number, HCPC number, clinic, role, login records, actions taken in Notes.

Special categories. Health data, as the core purpose: the conversation (in transit only) and the written clinical notes.

Categories of people. Your patients, including under-18s where you treat them; your physiotherapists and clinic owner.

Retention. Saved notes: 12 months from creation by default; you may set a shorter period for your clinic from 30 days upward, and may delete any saved note at any time. Account log: 6 years. User accounts: the life of the account plus 30 days. Details in Retention and deletion.

Annex 2 - Security measures

• Separation of clinics. Every saved note is tagged with your clinic, and the database itself refuses to show it to anyone outside your clinic (row-level security on every table). This is enforced by the database, not only by the website. Each rule is covered by an automated test that a user from one clinic cannot read another's.
• Encryption with a key outside the database. Answers and the patient reference are encrypted by Truephase's server before they are stored (AES-256-GCM), using a key held only in the server's configuration, never in the database. A copy of the database alone cannot be read.
• Encryption in transit and at rest. All connections use HTTPS. The hosting provider encrypts stored data and backups.
• UK region. Database, authentication and backups in London (AWS eu-west-2). Server code runs in London.
• No keys in the browser. The extension holds only the user's own login token. The AI key, database service key and Stripe keys exist only on the server. The extension talks only to Truephase's server.
• Access control and logging. Every fill, refused fill, view of a saved note, deletion, connection and disconnection is written to an append-only log that your clinic owner can read. Truephase staff can see counts, never text. Administrative access to the hosting consoles is limited to the director, with two-factor authentication.
• Staff never see patient text. The database grants the staff role no access to the text columns of saved notes.
• Automated deletion. A scheduled job applies the retention periods every night and records what it deleted in the log.
• Backups. Daily encrypted backups by the hosting provider, kept for a short rolling period (currently 7 days).
• Checked automation. Messages from Stripe are signature-checked before anything is stored; handlers are safe to run twice.
• Incident response. A written breach plan naming the responsible person, the containment steps and the 24-hour notification timeline, in place before any real patient's data is processed.
• Minimisation. The conversation and audio are never stored by Truephase.

Annex 3 - Sub-processors

The sub-processors for Notes are those listed at Companies we work with on the date you accept this agreement. The published list is the authoritative version, and clause 3.4 governs changes to it. On the date of this version they are:

Until a speech-to-text provider with a signed data agreement is in place, the extension's Record button uses Chrome's built-in recogniser, which sends audio to Google LLC with no agreement with Truephase. It is labelled practice-only and must not be used with real patients (clause 4.3).