Data processing
Data processing agreement
How Baton Clinical Ltd handles the information a clinic puts into Baton about its patients and its staff. It forms part of the contract between us and every clinic that uses Baton, as UK GDPR Article 28 requires.
Version 1.0, in force from 28 October 2026.
1. Who this is between
This agreement is between Baton Clinical Ltd, a company registered in England and Wales with company number 17548392, whose registered office is 1a Blunts Lane, Whittlesey, Peterborough PE7 1AH ("we", "us"), and each clinic that uses Baton under a contract with us ("the clinic").
For the information described in section 2, the clinic is the controller and we are its processor. Words such as "personal data", "processing" and "personal data breach" have the meaning they have in the UK GDPR and the Data Protection Act 2018.
It applies from the day the clinic starts a trial or signs its contract with us, and for as long as we hold any of the clinic's information.
2. What we process, and why
| What we do | Provide Baton to the clinic: store its records, run its patient portal, booking, forms, messages, letters, prescriptions, payments, staff files and reports, and keep the service working, backed up and secure. |
|---|---|
| Why | Only so that the clinic can provide care and run its service. Never for our own purposes. |
| Whose information | The clinic's patients, and people connected with them such as parents, carers, GPs and referrers; and the clinic's own staff, applicants and the people who give them references. |
| What information | Names, contact details, dates of birth, NHS and file numbers, identity documents, appointments, payments, messages and documents. For patients, health information, including mental health assessments, diagnoses, medicines, questionnaires, consultation recordings and transcripts. For staff, professional registration, training, DBS checks, references and health declarations. |
| How long | For as long as the clinic's contract lasts, then as section 13 says. |
3. Only on the clinic's instructions
We process the clinic's information only on its documented instructions. Its contract with us, this agreement, and the settings it chooses in Baton are those instructions. If the law requires us to do something else with it, we will tell the clinic first, unless the law forbids that.
We never sell it, never use it for marketing, and never use it to train artificial intelligence.
If we think an instruction breaks data protection law, we will tell the clinic straight away.
4. Confidentiality
Everyone at Baton who can reach the clinic's information is bound to keep it confidential. We open a clinic's records only when the clinic asks us for help, or when we must to keep Baton working and safe. Baton records every time anyone, including us, opens or changes a record, and the clinic can see that record.
5. Security
We protect the clinic's information with measures suited to health information, including:
- servers in the United Kingdom, reached only over encrypted connections
- each person at the clinic sees only what their role allows, and clinicians see only their own patients' records
- staff sign in through the clinic's own Microsoft 365 account, with its multi-factor authentication, where the clinic uses it
- a record of who opened or changed each record, and when
- a backup every night, kept for 14 days, and a tested way to restore it
- updates to Baton released first to a separate test server, never straight to the clinic's live system.
We review these measures as Baton changes, and whenever a risk is found.
6. Subprocessors
The clinic agrees that we may use these companies to provide Baton. Each acts only on our instructions, under a written contract that gives the clinic's information the same protection as this agreement. We remain responsible to the clinic for what they do.
| Company | What they do | Where |
|---|---|---|
| IONOS | Host the servers Baton runs on, and its backups | United Kingdom |
| Mailjet (Sinch) | Deliver the emails Baton sends to patients, staff and others for the clinic | European Union |
We will tell the clinic by email at least 30 days before we add or replace a subprocessor. If the clinic objects for a reason to do with data protection, we will try to meet its concern; if we cannot, the clinic may end its contract without penalty before the change takes effect.
7. Services on the clinic's own accounts
Some of Baton's features work through services the clinic chooses and holds its own account with. The clinic's own agreement with each company covers them, not ours, and Baton connects to them only if the clinic sets them up.
| Company | Used for | Where |
|---|---|---|
| Microsoft 365 and Azure | Staff sign-in, Teams video appointments, and transcribing consultations, only in Microsoft's UK South region | United Kingdom |
| Anthropic | Drafting reports for a clinician to check, if the clinic turns it on | United States: see section 8 |
| Stripe | Taking patients' card payments into the clinic's own Stripe account | United Kingdom, European Union and United States |
8. Information sent outside the UK
Baton and its backups are kept in the United Kingdom. Our subprocessor Mailjet is in the European Union, which UK law recognises as giving adequate protection. We do not send the clinic's information anywhere else outside the UK without the clinic's instruction and a safeguard UK law recognises.
If the clinic turns on report drafting, Baton sends the material for each report, encrypted, to Anthropic in the United States, using the clinic's own account. Anthropic does not use it to train its AI and deletes it within 30 days. The safeguard is the UK Addendum to the standard contractual clauses in Anthropic's data processing addendum, which forms part of the clinic's agreement with Anthropic. Anthropic publishes the companies it uses in its list of subprocessors. A patient the clinic marks "no AI" never has anything sent.
9. Helping with patients' and staff's rights
We help the clinic answer requests from people who use their rights: to see a copy of their information, to correct it, to delete it, to limit or object to its use, or to take it elsewhere. Baton lets the clinic do most of this itself. If a request reaches us instead, we pass it to the clinic the same working day and do not answer it ourselves.
10. Breaches
If we become aware of a personal data breach affecting the clinic's information, we will tell the clinic without undue delay, and in any case within 48 hours. We will say what happened, whose information and what kind is involved, what the likely effects are, and what we have done and will do about it, and keep the clinic told as we learn more. The clinic decides whether to report it to the ICO or to the people affected, and we help it to do so.
11. Impact assessments and the ICO
We give the clinic the information it needs for its data protection impact assessments about Baton, and help it if it has to consult the ICO. We work with the ICO if it asks.
12. Information and audits
We give the clinic the information it needs to show that this agreement is kept. The clinic, or an auditor it appoints who is bound to confidentiality, may audit how we handle its information, once a year or after a breach, on 30 days' notice, at the clinic's cost and without disturbing the service to other clinics.
13. When the contract ends
When the clinic's contract ends, we give it a full copy of its records within 30 days, in a standard format another system can read. Thirty days after that, we delete them from Baton. Our nightly backups then delete them within a further 14 days. If the law requires us to keep anything, we keep only that, only for as long as required, and use it for nothing else. We confirm in writing when the deletion is done.
14. General
If this agreement and the clinic's contract with us disagree about personal data, this agreement wins. We may update it when the law or our subprocessors change; we will tell the clinic by email at least 30 days before a change takes effect, and earlier versions are available on request. This agreement is governed by the law of England and Wales.
Questions about it: email hello@baton-clinical.com, or write to us at our registered office.