Data Processing Agreement: [PRODUCT NAME]

Version: v0.1 DRAFT (16 Oct 2026)

1. Who this is between

• You, the coach ("the controller"), as named in your [PRODUCT NAME] account.
• SH Studios Digital Ltd ("SH", "the processor"), company number [PLACEHOLDER: company number], [PLACEHOLDER: registered address], ICO registration ZC225207.

This agreement is part of the Coach Terms. You accept it by ticking the box at your first sign-in. If this agreement and the Coach Terms disagree on personal data, this agreement wins.

2. What this agreement covers

You decide why and how your clients' and enquirers' personal data is used. We handle it for you, to run [PRODUCT NAME]. Annex 1 lists the data, the people it is about, what we do with it and for how long.

This agreement does not cover data about you as our customer (your account and billing). We are the controller of that, and our privacy notice at https://pt.shstudios.uk/privacy explains it.

3. What we promise

3.1 Only on your instructions

We process your clients' data only to run the app for you, as these terms, your settings and your actions in the console describe. Those are your documented instructions. If we think an instruction breaks data protection law, we will tell you. If the law makes us process data in another way, we will tell you first, unless the law forbids that.

3.2 Confidentiality

Only people who need access to run or support the app can reach your clients' data. Each of them is bound to keep it confidential.

3.3 Security

We keep the data safe with the measures in Annex 2, and we keep them up to date.

3.4 Sub-processors

• You give us general permission to use the sub-processors in Annex 3.
• Each one is bound by a written contract with data protection terms at least as strong as this agreement.
• We tell you at least 30 days before we add or replace a sub-processor, by email and in the console. If you object on reasonable data protection grounds, tell us within that time. We will try to find a way round it. If we cannot, you can end the Coach Terms without penalty before the change.
• We stay responsible to you for what our sub-processors do.

3.5 Helping with your clients' rights

The app lets you and your clients:

• export a client's data (the client's "Download my data", and your "Export everything");
• correct data in the console;
• delete a client's account (in the app, at https://pt.shstudios.uk/delete-account, or by request);
• record and withdraw consents.

If a client sends a request to us instead of you, we pass it to you without delay and do not answer it ourselves unless you ask us to. If you need more help than the app gives, we help at no charge for reasonable requests.

3.6 Breaches

If we become aware of a personal data breach affecting your clients' data, we tell you without undue delay, and aim to do so within 48 hours. [DECIDE: 48 hours is a recommendation, so that you can meet your own 72-hour duty to tell the ICO.] We tell you what happened, what data and how many people may be affected, what we have done, and who to contact. We help you notify the ICO and your clients if needed.

3.7 Helping with your other duties

We give you the information you reasonably need for a data protection impact assessment, or if the ICO asks you about the app.

3.8 At the end

When your account closes:

1. you can export everything first;
2. we delete your clients' data within 30 days;
3. except data you told us to keep for its retention period (for example signed health checks), which we keep, locked, and delete at the end of that period;
4. and except where the law makes us keep something.

Backups are overwritten on their normal cycle: [DECIDE: recommended 35 days, see README "Backups"].

3.9 Audits

We make available the information you need to show we keep to this agreement. You can ask questions in writing at any time. You may audit us, or have an independent auditor do it, once a year with 30 days' notice, at your cost, without seeing other coaches' data. We may answer first with written answers and our providers' own security reports.

4. Your promises

• You have a lawful basis for the data you put in the app. For health data, you rely on your clients' explicit consent, which the app collects with a separate, unticked box.
• You give your clients your own privacy notice.
• You are registered with the ICO, unless an exemption applies.
• Your instructions to us follow the law.

5. Transfers outside the UK

Our main database and files are in London. Some sub-processors are based in, or give support from, other countries. We transfer data outside the UK only with a safeguard the UK GDPR allows: an adequacy decision (including the UK-US data bridge for certified US companies), or the IDTA or UK Addendum with a transfer risk assessment. Annex 3 names the safeguard for each.

6. How long this agreement lasts

It lasts as long as we hold your clients' data, including after your account closes until the deletion in section 3.8 is done.

Annex 1: details of the processing

Default retention. The coach can change these in settings. [DECIDE: H-13 / 05 D13; these are the build defaults until the founders decide.]

A nightly job deletes data that reaches its date and logs what it deleted.

Annex 2: security measures

• Every table carries the coach's ID. Database access rules (row-level security) are forced on every table, so one coach's data cannot be read by another coach or another coach's client. Tests check this on every change.
• Server-only secrets never reach the app or the browser. Builds are scanned for secret keys.
• HTTPS for every connection. Encryption at rest by the hosting providers.
• Google refresh tokens are encrypted (AES-GCM) and stored in a schema the app's API cannot reach.
• Booking and resume links use random tokens that are stored only as hashes. No personal data in web addresses.
• Enquirer IP addresses are stored only as a salted hash, to limit spam.
• Health answers are append-only: they cannot be edited after they are signed.
• Notifications and calendar events never contain health details or message text.
• Error reports have health fields, messages and form answers removed, with IP collection and screen recording off. [DECIDE: M7 D4]
• Sign-in by a one-time email code. No passwords to leak.
• Admin accounts on our providers use two-factor sign-in. [VERIFY before launch]
• Daily backups by Supabase, plus a nightly encrypted copy held by SH. [VERIFY: the nightly copy is encrypted at rest on the backup host]
• An audit log of changes to clients, consents, bookings and programmes.

Annex 3: sub-processors

We give at least 30 days' notice of changes. Each row needs a dated link to the provider's DPA and region page before launch.

Not sub-processors: Apple's App Store and Google Play distribute the app and act under their own terms. We run no analytics, advertising or tracking tools.