This Agreement is entered into between you (the Data Controller) and OH Specialists Hub (the Data Processor) when you create an account and accept these terms.
1. Definitions
Controller: The individual or organisation (you) that determines the purposes and means of processing personal data.
Processor: OH Specialists Hub, operated by Craig Page RGN DipOH, which processes personal data on behalf of the Controller to provide the OH Advisor Pro service.
Personal Data: Any information you submit to OH Advisor Pro that relates to an identified or identifiable natural person.
Special Category Data: Health-related personal data as defined under Article 9 UK GDPR.
2. Scope & Purpose
The Processor shall process personal data solely for the purpose of providing the OH Advisor Pro AI guidance service — including generating occupational health guidance, storing conversation context within a session, and sending account-related communications.
The Processor shall not process personal data for any purpose other than those expressly instructed by the Controller.
3. Nature of Personal Data Processed
The following categories of data may be processed:
- Account data: name, email address, password hash, employer/organisation name
- Usage data: query count, subscription status, login timestamps
- Query content: occupational health questions submitted to the AI — which may incidentally contain Special Category health data relating to third-party employees
- Payment data: processed exclusively by Stripe — not stored by OH Specialists Hub
Important: OH Advisor Pro includes automatic PII detection. If a name, date of birth, NHS number, NI number, or address is detected in a query, processing stops and you are prompted to resubmit with anonymised details. No conversation history is retained between sessions.
4. Processor Obligations
The Processor shall:
- Process personal data only on documented instructions from the Controller
- Ensure all personnel authorised to process the data are bound by confidentiality obligations
- Implement appropriate technical and organisational security measures (AES-256-GCM encryption at rest, TLS 1.3 in transit)
- Not engage any sub-processor without prior written consent, except those listed in Section 6
- Assist the Controller in responding to Data Subject requests under UK GDPR Articles 15–22
- Notify the Controller without undue delay (and within 72 hours where feasible) upon becoming aware of a personal data breach
- Delete or return all personal data on termination of the service, at the Controller's choice
- Provide all information necessary to demonstrate compliance with Article 28 UK GDPR
5. Data Location & Transfers
All personal data is stored exclusively in the United Kingdom on a DigitalOcean LON1 server. No personal data is transferred outside the UK. The Processor will not transfer personal data to any third country without explicit written consent from the Controller.
6. Approved Sub-Processors
The Controller provides general authorisation for the following sub-processors, each subject to equivalent data protection obligations:
- Anthropic (UK/EU infrastructure): AI inference for generating OH guidance responses. Query content is transmitted for inference only — Anthropic does not store queries for training without consent.
- Brevo (EU): Transactional email delivery (account confirmations, notifications). Name and email address only.
- Stripe (UK/EU): Payment processing. Payment card data is processed exclusively by Stripe under their own compliance framework (PCI DSS Level 1).
- DigitalOcean (LON1, UK): Cloud infrastructure and hosting.
The Controller will be notified of any intended changes to sub-processors, giving reasonable opportunity to object.
7. Lawful Basis & Special Category Data
Processing of Special Category health data (Article 9 UK GDPR) is carried out under Article 9(2)(b) — processing necessary for obligations in the field of employment and social security — and Article 9(2)(h) — processing for the purposes of occupational medicine and assessment of the working capacity of employees.
The Controller warrants that they have an appropriate lawful basis for any Special Category data submitted to the service, and that they are processing such data in the context of occupational health management.
8. Data Retention
Account data is retained for the duration of the subscription and for 12 months following account closure, after which it is permanently deleted. Query content is not retained between sessions. Billing records are retained for 7 years in accordance with HMRC requirements.
9. Security Measures
The Processor maintains the following technical and organisational measures:
- AES-256-GCM encryption for all data at rest
- TLS 1.3 for all data in transit
- Access controls limiting data access to authorised personnel only
- Audit logging of all data access events
- Regular backups with tested recovery procedures
- ICO registration: ZC115930
10. Controller Rights
The Controller may at any time: request information about processing activities; request deletion of their data; object to processing; request a copy of all personal data held. Contact: dpa@ohspecialistshub.co.uk
11. Governing Law
This Agreement is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales. This Agreement incorporates the requirements of the UK GDPR and the Data Protection Act 2018.
Data Controller: You — by creating an account and accepting this agreement, you confirm you are acting as a Data Controller and have authority to enter into this agreement on behalf of your organisation.
Data Processor: OH Specialists Hub, operated by Craig Page RGN DipOH · ICO ZC115930 · dpa@ohspecialistshub.co.uk
