Data Processing Agreement

Last updated 8 October 2026

Parties and scope

This Data Processing Agreement (“DPA”) is between Meridian Health Systems Ltd, trading as LeafletPlan, a company registered in England and Wales under company number 17035613, with its registered office at 145 Stanwell Road, Penarth, CF64 3LL (“LeafletPlan”, “we” or “us”), and the customer who uses the LeafletPlan service (“Customer” or “you”).

For Customer Personal Data, you are the controller and we are the processor. This DPA does not cover the account, billing, marketing-site or security data for which we are controller. Our Privacy Notice covers that.

1. Relationship with the Terms

This DPA forms part of the LeafletPlan Terms of Service (the “Terms”). It starts when you accept it and lasts while we process Customer Personal Data. On the protection of Customer Personal Data, this DPA prevails over the Terms. A signed Enterprise agreement or DPA that expressly replaces this DPA prevails over it, and mandatory terms of Applicable Data Protection Law prevail over all of them.

2. Definitions

  • Applicable Data Protection Law: the UK GDPR, the Data Protection Act 2018, and any other data protection law that applies.
  • Customer Personal Data: personal data we process on your behalf through the service.
  • Subprocessor: another processor we engage to process Customer Personal Data.
  • Anonymous Information: information derived from use of LeafletPlan that cannot reasonably identify any person or customer.

“Personal Data Breach”, “controller”, “processor”, “processing” and “data subject” have their meanings in Applicable Data Protection Law.

3. Processing description

We deliver digital patient information leaflets and keep the related audit trail. This means collecting, encrypting, storing, retrieving, sending and erasing the data the service needs. Data subjects are patients and other recipients. Customer Personal Data may include a recipient's name and email address, selected clinical content, the delivered leaflet, delivery and interaction events, timestamps and limited request metadata, from which health information may be inferred. Processing also includes creating Anonymous Information, and it continues for the term of the service and any retention period under section 12.

4. Your instructions

You instruct us to process Customer Personal Data only to provide, secure and support the service, to carry out what you do in the product, to create Anonymous Information under the Terms, and to follow your other lawful documented instructions. We will not process it for any other purpose unless the law requires it, and where allowed we will tell you first. We will tell you if we believe an instruction infringes Applicable Data Protection Law, and we may pause it until that is resolved.

5. Your responsibilities

As controller, you must:

  • have a lawful basis for the processing and meet any health-data requirements;
  • give data subjects the information that Applicable Data Protection Law requires;
  • make sure your instructions and use of the service comply with Applicable Data Protection Law;
  • handle data-subject requests and regulatory duties, with our help where needed; and
  • tell us about changes to your instructions that affect our obligations.

6. Our obligations, confidentiality and security

We process Customer Personal Data only on documented instructions and meet the processor duties in Article 28 UK GDPR. Only authorised staff who need it may access it, under confidentiality obligations. We keep appropriate technical and organisational measures against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and we test them regularly. We remain responsible for our Subprocessors' data protection obligations.

7. Data-subject and regulatory assistance

We will help you respond to requests to access, correct, erase, restrict, object to or port Customer Personal Data, and pass to you any request we receive directly unless the law prevents us. We will also reasonably help with security duties, data protection impact assessments, prior consultation with the Information Commissioner's Office or another regulator, and notices to regulators or affected people.

8. Personal Data Breaches

We will tell you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. As facts emerge, we will describe its nature and likely consequences, the categories and approximate numbers of people and records affected, our contact point, and the measures taken. Our notice is not an admission of fault or liability.

9. Compliance information and audits

We will provide the information reasonably needed to show compliance with this DPA, and allow audits by you or an independent auditor you appoint where Applicable Data Protection Law requires. Audits need reasonable notice, must protect other customers' data and our confidential information, and should rely first on existing audit reports where they give enough assurance. Each party bears its own costs, unless the audit finds a material breach by us.

10. Subprocessors

You give general written authorisation for us to use the providers on our list of Subprocessors, under written data protection obligations that suit each one's service. We will give reasonable advance notice of a new Subprocessor that may process Customer Personal Data. You may object on reasonable data protection grounds. If we cannot resolve the objection in good faith, you may stop using the affected feature or end the service.

11. International transfers

We make a restricted transfer of Customer Personal Data only where Applicable Data Protection Law permits it. Where the recipient is not covered by UK adequacy regulations, we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with supplementary measures where needed.

12. Return, erasure and retention

When the service ends, we will return or delete Customer Personal Data as you choose, subject to the documented retention instruction, unless the law requires us to keep it. This DPA applies to the data until it is deleted or becomes Anonymous Information.

13. Liability, changes and termination

Each party's liability under this DPA is subject to the limits in the Terms, except where Applicable Data Protection Law does not allow them. We may amend this DPA to reflect changes in law, guidance or the service. We will give reasonable notice of a material change, and we will not materially reduce the protection of Customer Personal Data during a paid term. This DPA ends when we hold no Customer Personal Data, except for terms that by their nature continue.

14. Governing law

This DPA and any non-contractual obligations arising from it are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, unless Applicable Data Protection Law or an incorporated transfer mechanism requires otherwise.