Data processing agreement

Version 0.1, 2026-10-07, owner: Turstone Ltd (Ireland). Status: agent-reviewed draft.

Turstone Ltd (Ireland). [Company number: pending registration] [Registered office: pending registration]

Agent-reviewed draft. Not legal advice and not in force until signed. A professional legal review is recommended once revenue allows.

This agreement sits under the Chairfill terms of service between the practice (the "Controller") and Turstone Ltd (the "Processor"). It meets Article 28(3) of the GDPR and the Data Protection Act 2018. The Data Protection Commission (DPC) is the supervisory authority.

1. Subject matter, duration, nature and purpose

  • Subject matter: Turstone provides Chairfill: appointment-recovery tooling that reads the practice's appointment book, sends reminder, recall and waitlist text messages, and shows staff to-dos and the money recovered. Where the practice switches them on, it also sends review requests, takes booking requests from a public page, receives and answers patients' texts in a two-way inbox, optionally sends and receives through WhatsApp, and creates payment requests that patients pay into the practice's own Stripe account.
  • Duration: from the start of the pilot or subscription until deletion under section 10.
  • Nature: storing, matching, scheduling, sending text messages and emails, reporting.
  • Purpose: appointment administration for the Controller only. Turstone does not use the data for its own purposes, does not sell it, does no advertising with it, and does not train any model on it. Chairfill v1 uses no AI or large-language-model processing of customer data.

2. Types of personal data

Administrative contact data only:

  • patient or contact: source-system id, first name, last-name initial (for staff display), mobile number, email address, date of last completed visit;
  • appointments: start and end, and the staff member or chair;
  • calendar times and busy blocks (start and end only) of calendars the practice maps; calendar titles and descriptions are never stored;
  • message log (who, which template, when, delivery status, link clicks and outcomes), opt-outs, waitlist entries, staff to-dos;
  • audit-log entries about the practice's own staff and agency users acting in the practice's account (who did what, and when);
  • (front-office modules, only where the practice switches them on) a record that a review was asked for (a hash of the person and the visit date); booking requests (first name, mobile, preferred weekdays and times of day, held for the periods in Turstone's data protection impact assessment); the texts patients send to the practice's number, which may contain anything the patient writes and are stored sealed (section 8); a WhatsApp consent record (mobile, when given, withdrawn or found unreachable); and payment request metadata (the amount in whole cents, the kind, the status and the times; never card data, which stays with Stripe).

Turstone is the controller, not the processor, for the account and sign-in data of owners, staff and agency users (identity, role, the owner's reminder email, sign-in events). That data is outside this agreement and is covered by the privacy notice. The practice is the controller of the audit-log entries about its own staff.

Turstone never reads or stores treatment, appointment type or reason, notes, charts, medical history or any other clinical data from the practice's systems, and its own messages never contain any. The Controller must not send any. The one place a patient can write free text is the two-way inbox: Turstone does not search, read or use those texts, stores them sealed with the practice's own key and deletes the text after 90 days, but cannot stop a patient writing something clinical, which is why the inbox is not for clinical questions (terms, section 5).

3. Data subjects

Patients and other contacts of the practice; the practice's staff and any agency people, but only as they appear in the practice's audit log.

4. Documented instructions

Turstone processes only on the Controller's documented instructions: this agreement, the terms, and the settings the practice makes in the product. Turstone immediately informs the Controller if it believes an instruction infringes data protection law.

5. Confidentiality

Everyone at Turstone with access is bound by confidentiality. Turstone staff access to practice data is limited to metadata through the audited ops console; reading more needs a time-limited, logged break-glass session that the practice can see in its audit log.

6. Security (Article 32)

Turstone applies the measures in security annex and keeps them at least at that level.

7. Sub-processors

The Controller gives general written authorisation for the sub-processors in the public list, including WhatsApp Ireland Limited, which is used only if the Controller switches WhatsApp on and which transfers the data on to WhatsApp LLC and Meta Platforms, Inc. in the United States (section 12). Turstone gives 30 days' notice of a new or replaced sub-processor (by email to the owner and on the public list). The Controller may object on reasonable data-protection grounds within that time; if the parties cannot resolve it, the Controller may end the agreement without penalty. Turstone binds each sub-processor to terms no less protective than these and remains responsible for them.

8. Data-subject requests and assistance

The practice, as Controller, answers requests from patients (access, rectification, erasure, restriction, objection). Turstone assists, taking into account the nature of the processing:

  • the practice's own system remains the source of the data; a correction there reaches Chairfill at the next sync or import;
  • opt-out is built in: a patient opts out through the link in any message, and all texts from that practice to that mobile number stop;
  • erasure of a person: through the practice's source system and re-sync, or by asking Turstone support, which acts on the Controller's instruction;
  • a patient's texts in the inbox are sealed with the practice's key, scrubbed after 90 days, and deleted with the conversation after 24 months without movement; a person's WhatsApp consent record is deleted on the Controller's instruction (an erasure request) and when the practice leaves;
  • Turstone forwards any request it receives to the Controller without undue delay and does not answer it itself.

Turstone also assists with data protection impact assessments and prior consultation (Articles 35 and 36) and gives the information needed to show compliance (Article 28(3)(h)). A template DPIA is in Turstone's template DPIA (available from Turstone on request).

For payments, the Controller contracts with Stripe directly: the practice has its own Stripe account under its own agreement with Stripe and is the merchant of record. Stripe acts under that agreement, not as Turstone's sub-processor for the payment, and Turstone never holds, receives or pays out funds. Turstone's processing is limited to creating Checkout Sessions on the Controller's instruction and reading their status.

9. Personal data breach (Articles 33 and 34)

Turstone notifies the Controller without undue delay and in any case within 24 hours of becoming aware of a personal data breach affecting the Controller's data, with what it knows: nature, categories and approximate numbers, likely consequences, measures taken, and a contact. Turstone keeps investigating and updates the Controller. The Controller decides whether to notify the DPC (within 72 hours of the Controller becoming aware, Article 33) and the data subjects (Article 34); Turstone helps with both.

10. Deletion at the end

  • When the agreement ends, Turstone stops processing and starts deletion of the Controller's personal data within 30 days.
  • Backups are overwritten within 35 days of their creation, so deleted data leaves them within 35 days of the deletion; nothing is restored from them for any other purpose.
  • At the Controller's choice, made before the end, Turstone deletes or returns the data (Article 28(3)(g)). The practice's source system already holds its own patient data, so no copy of that is returned. On request before the end, Turstone provides an export of the opt-out list and the message log. Without a choice, Turstone deletes.
  • On request Turstone gives a deletion certificate.
  • Where law requires Turstone to keep something (for example billing records), it is kept only for that purpose.

11. Audits

Turstone makes available the information needed to show compliance: its written security documents now, and, once they exist (they are committed before any real practice data, see the security annex), the restore-drill result, the ZAP full-scan result and the summary of the agent security review. Turstone also relies on its sub-processors' own audit reports and passes them on where it may. The Controller may audit with 30 days' notice, at most once a year unless a breach has occurred, during business hours and under confidentiality.

12. International transfers

Data is hosted in the EU (AWS eu-west-1, backups in eu-central-1; Twilio Ireland, whose Irish region IE1 stores and processes texts up to the telecom carriers; Auth0 EU tenant). One exception is disclosed: AWS CloudFront and the web application firewall process requests at edge locations in the EU and North America (price class 100), which includes request paths, client IP addresses and TLS termination; the firewall and certificate control plane are in AWS us-east-1 and hold no request log. Where a provider has a US parent, Turstone relies on the Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework, supported by the transfer impact assessments in Turstone's transfer impact assessments. If the Controller switches WhatsApp on, WhatsApp Ireland Limited processes those messages and transfers them to WhatsApp LLC and Meta Platforms, Inc. in the United States under the EU-US Data Privacy Framework (Standard Contractual Clauses reserved). Turstone transfers outside the EEA only on these terms.

13. Liability

Liability under this agreement follows the limits in the terms of service.

14. Agency access

If the practice lets an agency set up or run Chairfill, the agency acts for the practice, which must have its own written agreement with that agency. Turstone's access grants to agencies are time-limited, can be ended by the owner at any time, and are logged.

15. Order of precedence

On data protection, this agreement prevails over the terms of service.

Annex: security measures (Article 32)

The measures are in two lists: those in place in the product and its infrastructure code, and those Turstone commits to complete before any real practice data is processed.

In place

Tenant isolation, in three layers

  1. Every practice's rows carry a tenant id and PostgreSQL row-level security (RLS) is forced on every tenant table; the application role cannot bypass it.
  2. Composite foreign keys keep related rows inside one tenant.
  3. Every request and job runs inside a tenant-scoped transaction; there is a cross-tenant test for every route.

The application process is trusted to set the tenant. That is a known limit of pooled RLS, and it is why the code paths that set it are small, mutation-tested and reviewed.

Encryption

  • At rest: the database, backups, logs and storage use customer-managed keys in AWS KMS. Stored connector credentials are sealed with per-practice data keys wrapped by KMS; sign-in refresh tokens are sealed with a platform data key wrapped by KMS.
  • In transit: TLS 1.2 or higher to the app; the application connects to the database with verify-full TLS against the pinned RDS certificate authority; production refuses to start otherwise.
  • Links in text messages carry a random token of at least 128 bits, stored hashed, single-purpose, expiring, and containing no personal data.

Identity and access

  • Sign-in through Auth0 (EU tenant). Multi-factor authentication is required for owners and agency users; staff roles are limited by permission in our database.
  • Agency access is a time-limited grant approved by the owner with a pairing code, revocable at any time.
  • Sessions: 30 minutes idle, 12 hours absolute; refresh tokens rotate and are sealed.
  • Least privilege: separate database roles for the application, the worker, migrations and the ops console; separate cloud task roles per service.

Turstone operator access

The ops console reads metadata only through column-level grants. Reading anything more needs a break-glass session (1 to 60 minutes, a reason from a fixed list, a ticket reference). Every console action is written to an append-only access log, and break-glass writes a row in the practice's own audit log.

Data minimisation and logging

  • Only the administrative fields in the DPA are stored; calendar titles and descriptions never are.
  • No personal data, secrets or message bodies in application logs; errors are serialised with a safe serialiser. The edge keeps no path or query in its logs and none at all on the link host.
  • Text-message bodies are scrubbed after 90 days; see the retention table in Turstone's data protection impact assessment.

Front-office modules

  • Free text a patient sends to the practice's number is sealed (encrypted with the practice's data key, bound to the practice and the message) before it is stored, is never shown whole in a list or a log, and its ciphertext is deleted after 90 days.
  • The public booking-request page and the website contact form use single-use signed tickets and rate limits; the booking page also proves the mobile with a code by text, limited per number, per address and per day.
  • Patient payments use Stripe Checkout on the practice's own Stripe account: card data never reaches Turstone (the scope is SAQ-A), Turstone holds no funds and keeps no saved cards. A Stripe secret exists only in the ops service family; the web service never holds one.
  • WhatsApp (optional): messages go through WhatsApp Ireland Limited, which transfers them to WhatsApp LLC and Meta Platforms, Inc. in the United States (see Turstone's transfer impact assessments); the access token, the app secret and the verify token are separate secrets, each held only by the service that needs it.

Messaging controls

Fixed templates with a closed set of variables, no patient free text echoed, an opt-out link in every message that suppresses all future messages to that number for that practice, quiet hours, a cap on recalls per person, and exactly-once sending keys.

Availability and recovery

Multi-AZ database; the database's own automated backup window is 14 days, and a vaulted copy in a second EU region (eu-central-1) is kept 35 days, so backups are overwritten within 35 days of creation. Monitoring and alarms on the sending, sync, retention and billing paths.

Vulnerability management and secure development

Dependency and secret scanning, static analysis (Semgrep with custom rules), container scanning, a ZAP baseline scan in CI, strict TypeScript and lint rules, mutation testing on the security core, and CI gates on every change. Third-party images and dependencies are pinned and at least 7 days old.

Incident response

See the breach-response runbook; the DPA commits Turstone to notify the practice within 24 hours of awareness.

Committed before any real practice data

  • A restore drill: restoring the database from backup and recording the result.
  • A ZAP full scan (CI runs only the baseline today).
  • An agent adversarial security review of the hosted app (cross-tenant access, authentication, links, webhooks, uploads), with its findings fixed.

Until these are done, Turstone processes no real practice data.