Page Comparison

...

This Agreement is dated .

1. PARTIES

A. Patients Know Best (“PKB”); and

B. The Providers (listed in Schedule 4), (“Providers”),each a “Party” and together the “Parties”. 

2. BACKGROUND

A. The Lead Controller has contracted with PKB under the Commissioning Contract to provide patients with access to and some control of their health data. The PKB platform facilitates patient access to their health data contributed by the Providers and facilitates the patient to add information which may be viewed by their health and care providers and other people of their choosing. The Providers are all organisations with a legal duty to provide free at the point of delivery care to individuals (as part of the NHS), to which PKB supports the facilitation of this duty.

B. Data received by PKB from the Providers is here referred to as the Patient Record. 

C. Providers are Independent Controllers and PKB are Processors of the Patient Record.

D. Where a Patient has activated access to their health data, any personal data entered by them is referred to as the Patient Account. 

E. PKB is the Controller for data within the Patient Account.

F. Where personal data within the Patient Account is accessed by a Provider, PKB and the accessing Provider are Joint Controllers.

G. The Parties consider it is necessary to use certain Personal Data between them to give effect to the objectives of the Processing and this Joint Controller Arrangement and Data Processing Contract (“Agreement”) sets out the framework for such use, including the principles and procedures that the Parties shall adhere to and the responsibilities the Parties owe to each other.

H. Where PKB are Processors for the Providers, Part 1, 3, 4 and the Schedules shall apply. 

I. Where PKB are Joint Controllers with the Providers, Parts 1,2,4 and the Schedules shall apply.

3. DEFINITIONS AND INTERPRETATION

3.1 Unless specifically provided for in this Agreement, the following terms shall have the following meanings:

3.2 The following rules of interpretation apply to this Agreement:

3.2.1 clause, schedule, and paragraph headings shall not affect the interpretation of this Agreement.

3.2.2 a person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality).

3.2.3 the Schedules form part of this Agreement and shall have effect as if set out in full in the body of this Agreement. Any reference to this Agreement includes the Schedules;

3.2.4 unless the context otherwise requires, words in the singular shall include the plural and, in the plural, shall include the singular;

3.2.5 a reference to a statute, statutory provision or other legal instrument is a reference to it as amended, extended, or re-enacted from time to time; and

3.2.6 any words following the terms including, include, in particular, for example or any similar expression shall be construed as illustrative and shall not limit the sense of the words, description, definition, phrase or term preceding those terms.

3.3 In the event and to the extent of a conflict between: 

3.3.1 the main body of this Agreement and the Schedules, except as expressly stated otherwise, the main body of this Agreement shall prevail to the extent of such conflict.

4. SCOPE AND APPLICATION

4.1 This Agreement applies to the processing of Personal Data on the PKB Platform. Any reference in this Agreement to PKB Data shall be interpreted as a reference to any Personal Data held on the PKB Platform.

4.2 For the purpose of Data Protection Laws, this Arrangement shall prevail in the event of a conflict with the Commissioning Contract and any other agreement between the Parties and PKB.

4.3 For the avoidance of doubt, PKB will comply with all necessary data protection obligations while acting as sole controller.

4.4 Where PKB Data under this Agreement is accessed by another Provider organisation, that organisation shall be considered a Third Party under Article 4 of UK GDPR.

5. COMMENCEMENT AND DURATION

5.1 This Agreement shall commence on the date set out at the top of it (the “Commencement Date”) and shall continue in accordance with its terms.

6. PATIENT AND REGULATORY ENGAGEMENT

6.1 Prior to the commencement of Processing, in respect of the activities contemplated by this Agreement, the Parties shall cooperate with each other to: 

6.1.1 conduct patient engagement activities to assist the Parties in considering the views of patients; and

6.1.2 develop supporting materials for the provision of information to patients regarding the Processing of PKB Data;

6.1.3 For a period of not less than eight weeks, promote by all reasonably available and effective communication channels with patients and the public the proposed processing activity, purpose, risks and expected benefits using a layered approach and notifying and explaining the right and process for opting out.

6.2 Following the commencement of processing activity, the Providers will continue to promote the proposed processing activity in accordance with their duty of transparency.

7. AGREED PURPOSES

7.1 The Parties agree to only Process PKB Data under this Agreement for:

7.1.1 The provision of health and social treatment and care

7.1.2 Provide a platform for patients to access and add to their PKB health record

7.1.3 Allow patients to determine which organisations can view their profile

7.1.4 Maintaining a patient level record for statutory period

7.1.5 The maintenance by PKB of the PKB platform and data held on it

7.1.6 [Add here other purpose agreed by the parties]

each of the above, an “Agreed Purpose”.

PART 2  - APPLICABLE WHERE A JOINT CONTROLLER RELATIONSHIP EXISTS

8. LAWFUL BASES FOR PROCESSING AND CLASSIFICATION OF PARTIES

8.1 The lawful bases for each Party’s Processing of Personal Data and the classification of the Parties for the purposes of Data Protection Law under this Agreement is set out in Schedule 2.

9. PROVIDER’S RESPONSIBILITY FOR PATIENT-FACING COMMUNICATIONS.

9.1 Generally

9.1.1 Except where expressly stated in this Agreement or agreed by the Parties in writing, Providers shall be responsible for all communications with Data Subjects in relation to Personal Data covered by this Part 2, prior to the creation of the Patient Account:

9.1.1.1 the provision of information to Data Subjects in accordance with Article 13 and 14 of the GDPR;

9.1.1.2 responding to Data Subject Requests as set out in clause 9.2; 

9.1.1.3 notifying Data Subjects of a Personal Data Breach where such notification is required by Data Protection Law.

9.1.2 Notwithstanding the above, each of the Parties acknowledges that a Data Subject may exercise its rights under Data Protection Law against and of the Parties in relation to Personal Data covered by this Part 2  under this Agreement and nothing in this Agreement shall prevent either Party from complying with its obligations under Data Protection Law.

9.2 Data Subject Access Requests.

1. If either Party receives a Data Subject Access Request related to Personal Data covered by this Part 2: 

   1. it shall notify the other within five (5) Business Days of receiving the Data Subject Access Request;

   2. Each Providers shall be responsible for responding to the Data Subject Access Request received by them;

   3. PKB shall provide Providers with reasonable assistance in responding to the Data Subject Access Request including, taking into account the nature of the Processing, assisting Providers by appropriate technical and organisational measures, insofar as this is possible to respond to requests from Data Subjects exercising their rights under Data Protection Law; and

   4. Providers shall keep PKB reasonably informed as to the status and resolution of the Data Subject Access Request.

2. DATA MINIMISATION (INCLUDING OPT-OUT) AND PSEUDONYMISATION

   1. Taking into the cost of implementation and the nature, scope, context and purposes of Processing as well as the risks of varying likelihood and severity for rights and freedoms of Data Subjects each Party shall implement appropriate technical and organisational measures, including pseudonymisation, to ensure that the use of Personal Data in relation to the processing is minimised. 

   2. Each Party shall periodically review data minimisation measures implemented in accordance with this clause 10, and may agree with the other Party further steps to be taken to ensure the minimisation of Personal Data as may be required by Data Protection Law and in any case no less than every three years.

3. GENERAL OBLIGATIONS OF THE PARTIES

   1. Each Party shall implement appropriate technical and organisational measures to protect Personal Data against unauthorised or accidental access, loss, alteration, disclosure, destruction or other unauthorised or unlawful forms of Processing (such measures may include, where appropriate, the pseudonymisation and encryption of Personal Data covered by this Part 2 and other measures referred to in Article 32(1) of the GDPR).

   2. Each Party shall ensure that its personnel who have access to Personal Data covered by this Part 2 for the performance of this Agreement are under an obligation of confidentiality and ensure that such access is limited to those individuals who need to know and access PKB Data.

   3. Upon becoming aware of a Personal Data Breach relating processing where both Parties are Joint Controllers, each Party shall: 

      1. notify the other Party in writing without undue delay, and in any event within forty-eight (48) hours, (such notification to include the provision of information as is required under Data Protection Law in respect of the Personal Data Breach); 

      2. promptly take reasonable steps to investigate, mitigate and remediate the Personal Data Breach; and 

      3. provide reasonable assistance to the other Party, in relation to the other Party’s efforts to investigate, mitigate and remediate the Personal Data Breach. 

   4. PKB shall not transfer Personal Data covered by this Part 2 from the United Kingdom to another jurisdiction without the prior written approval of the Providers and without putting in place appropriate safeguards where required for compliance with Data Protection Law.

   5. Each Party shall notify the other Parties in writing within five (5) Business Days if it receives a “Third Party Communication” including but not limited to:

      1. any communication from the ICO or any other regulatory authority in connection with Personal Data covered by this Part 2  or;

      2. a request from any third party for disclosure of Personal Data covered by this Part 2 where compliance with such request is required or purported to be required by Applicable Law,

   6. Each Party shall provide the other Party with reasonable assistance in responding to any Third Party Communication and shall work with the other Party to determine the most appropriate Controller to respond to any Third Party Communication (the“Responsible Controller”) provided that nothing in this Agreement shall prevent a Party from responding to a Third Party Communication to the extent required by Applicable Law. 

   7. The Responsible Controller shall keep the other Party informed as to the status of the resolution of any Third-Party Communication, and the Parties shall provide all such assistance to one another as may be reasonably requested in respect of the same. 

   8. Each Party shall provide reasonable assistance to the other Party in ensuring compliance with its obligations under Data Protection Law taking into account the nature of the Processing for the purposes of this Agreement and the information available to it, including in respect of each Party’s obligations as set out in this Agreement relating to:

      1. security of Processing;

      2. notification of a Personal Data Breach to the ICO;

      3. communication of a Personal Data Breach to the affected Data Subjects; and

      4. Data Protection Impact Assessments and any subsequent consultations with the ICO.

   9. Each Party shall provide the other Party with such information as the other Party may reasonably request to demonstrate compliance with this Agreement, and if the requesting Party (acting reasonably) considers that such information does not demonstrate the other Party’s compliance with this Agreement, to allow for audits, including inspections, by the requesting Party or an auditor mandated by the requesting Party to verify the other Party’s compliance with this Agreement subject to: 

      1. such audit or inspection being conducted during the other Party’s usual business hours and on reasonable advance notice; and 

      2. the Party conducting the audit and any third-party auditor: 

      3. using reasonable endeavours to minimise any disruption on the other Party’s business; and

      4. complying with any reasonable requirements imposed by the other Party to protect the safety, integrity and security of its premises and systems, and the confidentiality of the other Party’s or third-party confidential information.

   10. Each Party shall bear its own costs of any audit or inspection under clause 11.9, unless the audit or inspection was conducted by an independent third party and such third party determines the audited Party has materially breached its obligations under this Agreement in which case the audited Party shall reimburse the auditing Party in respect of its reasonable and properly incurred costs of engaging such third party to conduct such audit or inspection.

   11. The Parties shall keep this Agreement under review and either Party may request a change to this Agreement as may be reasonably required to comply with Data Protection Law. Upon receipt of such a request from a Party, the Parties shall discuss and consider such request in good faith and do all things reasonably necessary to comply with Data Protection Law, including varying this Agreement or entering into any subsequent agreements.

4. JOINT CONTROLLERS

   1. Each Party acknowledges and agrees that there is a common objective in respect of the Processing and are Joint Controllers for the purpose of Data Protection Law in respect of such Processing. 

   2. Each of the Parties shall perform the obligations allocated to it the table below following allocation of responsibilities in accordance with Article 26 of the GDPR:

13. USE OF PROCESSORS

    1. Where PKB uses a Processor to Process Personal Data covered by this Part 2 a, PKB shall:

    2. provide Providers with such information regarding such processors as Providers may reasonably request. For clarity, PKB shall not be required to provide Providers with details of any commercial terms between PKB and any Processor; 

    3. ensure that such Processing is subject to an agreement as required by Article 28(3) of the GDPR; and

    4. where Providers have provided their prior written approval to the international transfer of Personal Data covered by this Part 2  conduct such international transfer in accordance with Data Protection Law.

14. COMBINATION WITH OTHER DATA

    1. Providers acknowledge and agree that PKB may combine Providers Data to external sources of health data (including other Trusts, patient inputted data and third-party application data) with the objective of increasing the quality and breadth of the Personal Data covered by this Part 2.

15. DATA RETENTION AND DELETION

    1. The Parties shall not retain or Process Personal Data covered by this Part 2 under this Agreement for longer than is necessary to carry out the Agreed Purposes. 

...

2. The Processor shall provide all reasonable assistance to the Controller in the preparation of any Data Protection Impact Assessment prior to commencing any processing. Such assistance may, at the discretion of the Controller, include:

3. a systematic description of the envisaged processing operations and the purpose of the processing;

4. an assessment of the necessity and proportionality of the processing operations in relation to the Services;

5. an assessment of the risks to the rights and freedoms of Data Subjects; and

6. the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data.

7. The Processor shall, in relation to any Personal Data Processed in connection with its obligations under this Agreement:

8. process that Personal Data only in accordance with Schedule 1, unless the Processor is required to do otherwise by Law. If it is so required, the Processor shall promptly notify the Controller before processing the Personal Data unless prohibited by Law;

9. ensure that all measures in Schedule 2 are adhered to and met at all times of the processing and has in place all Protective Measures, which have been reviewed and approved by the Controller as appropriate to protect against a Data Loss Event having taken account of:

   1. the nature of the data to be protected;

   2. the harm and risks that might result from a Data Loss Event;

   3. assessment of the technical and non-technical controls to mitigate these risks; and

   4. the cost of implementing any measures if required;

   5. ensuring that the Processor Personnel do not process Personal Data except in accordance with this Agreement, and in particular Schedule 1;

   6. taking all reasonable steps further detailed in schedule 2, both technical and non-technical to ensure the reliability and integrity of any Processor Personnel who have access to the Personal Data and ensure that they:

10. are aware of and comply with the Processor’s duties under this clause;

11. are aware of and comply with the Processor’s duties under this clause;

12. are subject to appropriate confidentiality undertakings with the Processor or any Sub-processor. This includes but is not limited to commercially sensitive information and Personal Data;

13. are informed of the confidential nature of the Personal Data and commercially sensitive information and do not publish, disclose or divulge any of the Personal Data or commercially sensitive information to any third Party unless directed in writing to do so by the Controller or as otherwise permitted by this Agreement; and

14. have undergone adequate annual training in the use, care, protection and handling of Personal Data and are assessed as competent to undertake the processing activity or activities; 

15. keep personal data and commercially sensitive information confidential for the length of the contract and ensure that once the contract has ended or terminated that personal data and commercially sensitive information is kept confidential indefinitely.  

16. not transfer Personal Data outside of the European Economic Area (EEA) unless the prior written consent of the Controller has been obtained and the following conditions are fulfilled:

    1. the Controller or the Processor has provided appropriate safeguards in relation to the transfer (whether in accordance with UK GDPR Article 46) as determined by the Controller;

    2. the Data Subject has enforceable rights and effective legal remedies;

    3. the Processor complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred (or, if it is not so bound, uses its best endeavours to assist the Controller in meeting its obligations); and

    4. the Processor complies with any reasonable instructions notified to it in advance by the Controller with respect to the processing of the Personal Data;

    5. the Processor notifies the Data Controller prior to any transformation of the Personal Data which is not part of this agreed processing but occurs due to the transfer of Personal Data from the service provider to or from another organisation party to this agreement.

17. at the written direction of the Controller, delete or return the Personal   Data (and any copies of it) to the Controller on termination of the Agreement unless the Processor is required by Law to retain the Personal Data.

4. The Processor shall notify the Controller within 72 hours if it:

5. receives an Individual Rights Request or any Freedom of Information (FOI) / Environmental Information Regulations (EIR) request relating to this processing;

6. receives a request to rectify, block or erase or transfer any Personal Data by the data subject;

7. receives any other request, complaint or communication relating to either Party's obligations under the Data Protection Legislation;

8. receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data Processed under this Agreement;

9. receives a request from any third Party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law; or

10. becomes aware of a Data Loss Event.

11. The Processor’s obligation to notify under clause 16.4 shall include the provision of further information to the Controller in phases, as details become available.

6. Taking into account the nature of the processing, the Processor shall provide the Controller with full assistance in relation to either Party's obligations under Data Protection Legislation and any complaint, communication or request made under clause 16.4 (and insofar as possible within the timescales reasonably required by the Controller) including by promptly providing:

7. the Controller with full details and copies of the complaint, communication, data loss event or request;

8. such assistance as is reasonably requested by the Controller to enable the Controller to comply with an Individual Rights Request within the relevant timescales set out in the Data Protection Legislation;

9. the Controller, at its request, with any Personal Data it holds in relation to a Data Subject;

10. assistance as requested by the Controller following any data loss event;

11. assistance as requested by the Controller with respect to any request from the Information Commissioner’s Office, or any consultation by the Controller with the Information Commissioner's Office.

12. The Processor shall allow for audits of its Data Processing activity by the Controller or the Controller’s designated auditor. 

8. The Processor when ensuring that it has in place such Protective Measures, having been reviewed and approved by the Controller, shall follow the reasonable request of the Controller to supply such evidence as requested by the Controller within 28 days.  

...

11. Before allowing any Sub-processor to process any Personal Data related to this Agreement, the Processor must:

12. notify the Controller in writing of the intended Sub-processor and processing; 

13. obtain the written consent of the Controller;

14. enter into a written agreement with the Sub-processor which gives effect to the terms set out in this clause 1 and associated schedules such that they apply to the Sub-processor; and

15. provide the Controller with such information regarding the Sub-processor as the Controller may reasonably require.

16. The Processor shall remain fully liable for all acts or omissions of any Sub-processor.

13. The Controller may, at any time on not less than 30 Working Days’ notice, revise this clause by replacing it with any applicable controller to processor standard clauses or similar terms forming part of an applicable certification scheme (which shall apply when incorporated by attachment to this Agreement).

14. The Parties agree to take account of any guidance issued by the Information Commissioner’s Office. The Controller may on not less than 30 Working Days’ notice to the Processor amend this agreement to ensure that it complies with any guidance issued by the Information Commissioner’s Office.

15. The Controller may immediately terminate this Agreement on written notice to the Processor. The Processor may not terminate this Agreement without the written consent of the Controller.

...

36. GOVERNING LAW AND DISPUTE RESOLUTION

    1. Governing law

       1. This Agreement and all matters arising out of or in connection with it, including any Dispute and any dispute resolution procedure provided for in this Agreement, shall be governed by, and construed in accordance with, the law of England and Wales.

    2. Dispute resolution:

       1. The Parties shall resolve any Disputes in accordance with the Commissioning Contract terms.

37. SCHEDULE 1: DATA PROCESSING PARTICULARS

    1. PERSONAL DATA TO BE PROCESSED

       1. This Schedule describes the types of PKB Data that may be Processed under this Agreement. The Parties may agree to amend the descriptions in this clause at any time with the approval of the Parties.

       2. For clarity, PKB Data Processed under this Agreement shall be subject to the data minimisation measures described in clause 10, including:

    2. Providers applying data minimisation measures prior to sharing any data with PKB; and 

    3. the Parties continuing to review the data minimisation measures to ensure the minimisation of Personal Data within PKB Data as may be required by Data Protection Law.

       1. PKB Data to be Processed under this Agreement may include data from the following sources: 

4. The inclusion of personal data of any natural person under the age of 13 should be considered on a case by case basis.

...

PKB will only act under the following instruction of the Provider for this Processing operation 

39. SCHEDULE 3: SECURITY CONTROLS

...