All legal documents

Data Processing Agreement

Dappros Ltd, trading as Ethora. Template version 1.0, 10 November 2026.

This is the Data Processing Agreement ("DPA") that Ethora signs with customers whose use of Ethora involves personal data under the UK GDPR, the EU GDPR, Canada's PIPEDA or similar laws. It covers two deployment models, chosen in the signature block:

• Model A, customer-hosted: you run the Ethora server on infrastructure you control. Ethora is a software vendor and technical sub-processor that touches your data only when you ask for support. This is the model most of our enterprise and healthcare customers use.
• Model B, Ethora-hosted: Ethora runs the server for you (a dedicated server or an Ethora Cloud account). Ethora is your processor and hosts the data in the region named in the order.

Protected health information under HIPAA is governed by the separate Business Associate Agreement, which prevails over this DPA for that data. To receive a copy for signature, write to support@ethora.com. Legal questions: legal@ethora.com.

1. Parties and incorporation

This DPA forms part of, and is incorporated into, the agreement under which Ethora provides its software and services to the customer named in the signature block (the "Services Agreement"): the Ethora Terms of Service for Ethora Cloud, an Enterprise agreement, or an order for a dedicated or Private Practice server. "Provider" or "Ethora" means Dappros Ltd, trading as Ethora, a company registered in England and Wales under company number 11455432, 38 Munden Grove, Watford, WD24 7EE, United Kingdom. "Customer" means the customer named in the signature block.

2. Definitions

• Data Protection Laws means all laws that apply to the processing of Personal Data under this DPA, including the UK GDPR and the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679), Canada's Personal Information Protection and Electronic Documents Act and the substantially similar provincial laws, and US state privacy laws where they apply.
• Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach and Supervisory Authority have the meanings given in the Data Protection Laws. Where PIPEDA applies, Controller reads as the organisation accountable for the personal information and Processor as the organisation processing it on that organisation's behalf.
• Customer Data means the Personal Data that Ethora processes on Customer's behalf under the Services Agreement, as described in Annex 1.
• Sub-processor means a third party engaged by Ethora to process Customer Data.
• Deployment Model means Model A (customer-hosted) or Model B (Ethora-hosted), as elected in the signature block.
• Services means the software and services Ethora provides under the Services Agreement.

3. Roles of the parties

1. Customer is the Controller (or the accountable organisation) of all Customer Data, including any personal health information Customer chooses to process, and determines the purposes and means of processing.
2. Ethora acts solely as a Processor, or, under Model A, as a software vendor and technical sub-processor acting on Customer's behalf. Ethora does not determine the purposes or means of processing and is not a data custodian of Customer Data.
3. Where Customer is itself a Processor for its own clients, Customer confirms that its Controller has authorised the engagement of Ethora as a Sub-processor on these terms.

4. Scope and nature of processing

1. Processing is limited to what the Services need: real-time communication, messaging, file exchange, user accounts, push notifications, AI agent and translation features when Customer enables them, and the platform's administrative functions.
2. Model A. Customer hosts the server, the database, file storage and backups. Ethora does not store or persist Customer Data on its own systems in the ordinary course. Ethora processes Customer Data only transiently: in memory during a support session that Customer has requested, in diagnostic material Customer chooses to share, and as the minimal technical metadata that a licensed server sends to Ethora's licence service as described in the Privacy and Telemetry Notice (which contains no message content, files or end-user identities).
3. Model B. Ethora hosts the server, the database, file storage and backups on the infrastructure and in the region named in Annex 3, and processes Customer Data for as long as the Services Agreement runs.
4. Customer's documented instructions are the Services Agreement, this DPA, the configuration Customer sets in the Services, and written support requests. Ethora will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the instruction until it is confirmed or withdrawn.

5. Categories of data and data subjects

The categories of Customer Data, the Data Subjects and the retention periods are set out in Annex 1. Special categories of Personal Data, including health data, are processed only where Customer has chosen to use the Services for them and, for protected health information under HIPAA, only on a covered deployment under the Business Associate Agreement.

6. Duration

This DPA applies for as long as Ethora processes Customer Data under the Services Agreement and until the deletion or return under clause 13 is complete.

7. Customer responsibilities

Customer is responsible for:

1. the lawful basis for processing, the notices given to Data Subjects and any consents required;
2. the lawfulness of its instructions and of the content its users put into the Services;
3. under Model A, the hosting, infrastructure security, network, encryption at rest, backups, patching and access control of the servers it operates, and for applying the configuration recommended by Ethora, including the HIPAA configuration guide where health data is involved;
4. under both Models, the configuration of its workspace, the provisioning of its users, the roles and room memberships it grants, the integrations it connects and the devices its users use;
5. its own regulatory compliance, including impact assessments, records of processing and any registration or consultation its regulator requires, with Ethora's assistance under clause 8.

8. Ethora's obligations

Ethora will:

1. process Customer Data only on Customer's documented instructions, unless required to do so by law, in which case Ethora will inform Customer before processing unless the law prohibits it;
2. ensure that its personnel who access Customer Data are bound by confidentiality obligations, are trained, and access Customer Data only to the extent a support request, an update or a security incident requires, with access logged;
3. implement and maintain the technical and organisational measures in Annex 2;
4. assist Customer, by appropriate technical and organisational measures and insofar as possible, in responding to requests from Data Subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection). The Services provide export, edit and deletion functions for this purpose; where support is needed, Ethora responds within 10 business days of a written request;
5. assist Customer in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation with a Supervisory Authority, taking into account the nature of the processing and the information available to Ethora;
6. make available the information necessary to demonstrate compliance with this DPA and allow for audits under clause 12;
7. not sell Customer Data, not use it for marketing, and not use it to train or improve machine learning models;
8. delete or return Customer Data under clause 13.

9. Sub-processing

1. Customer gives general authorisation for Ethora to engage the Sub-processors listed in Annex 3 for the elected Deployment Model.
2. Ethora will impose on each Sub-processor, by written contract, data protection obligations equivalent to those in this DPA, and remains liable to Customer for the Sub-processor's performance.
3. Ethora will give Customer at least 30 days' written notice before adding or replacing a Sub-processor that will process Customer Data, by email to the notice address in the signature block and by updating Annex 3 on this page. Customer may object on reasonable grounds related to data protection within that period; if the parties cannot resolve the objection, Customer may terminate the affected Services under the Services Agreement without penalty for the remaining term.
4. Under Model A, Ethora engages no Sub-processor for Customer Data. Customer's own hosting and service providers are Customer's processors, not Ethora's Sub-processors.

10. Security measures

Ethora applies the technical and organisational measures in Annex 2, appropriate to the risk, including encryption in transit on every endpoint, encryption at rest for the data Ethora hosts, access control by role with two-step verification for administrators, logging of administrative actions, separation of customer environments, secure development practices and a vulnerability disclosure process. Ethora may update the measures from time to time provided the overall level of protection does not decrease.

11. Personal Data Breach notification

1. Model B. Ethora will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data, with the information Customer needs for its own notifications (nature of the breach, categories and approximate numbers of Data Subjects and records, likely consequences, measures taken or proposed), and will supplement the notice as information becomes available. Ethora will cooperate with Customer's investigation and mitigation.
2. Model A. Ethora's notification duty covers only Personal Data Breaches within systems Ethora controls (its support tooling, its licence service and any diagnostic material Customer shared). Breaches within the servers Customer operates are detected, assessed and notified by Customer; Ethora will assist on request, including with a security fix to the software where the breach involves a vulnerability in it.
3. Where the Business Associate Agreement applies, its reporting clause governs reports about protected health information.

12. Audits

1. Ethora will make available, on request and no more than once in any 12-month period unless a Supervisory Authority requires otherwise, the documentation needed to demonstrate compliance with this DPA: a description of the measures in Annex 2, summaries of security testing, completed security questionnaires and the records of Sub-processors.
2. If the documentation is insufficient to demonstrate compliance, or a Supervisory Authority requires it, Customer or an independent auditor bound by confidentiality may audit Ethora's relevant processing on at least 30 days' written notice, during business hours, in a manner that does not disrupt Ethora's business or expose other customers' data, at Customer's cost unless the audit reveals a material breach of this DPA.
3. Under Model A, Customer audits the infrastructure it operates itself; Ethora's audit obligations relate to the software and to the support access described in clause 4.2.

13. Data deletion and return

1. On termination or expiry of the Services Agreement, Ethora will, at Customer's election, delete or return all Customer Data it holds and delete existing copies, unless a law requires Ethora to keep it, in which case Ethora will keep it confidential and process it only for that purpose.
2. Model B. Customer has the export window in the Services Agreement (30 days for Ethora Cloud) to export its data through the Services; Ethora then deletes the live data within 30 days and backups within 90 days as they expire.
3. Model A. Ethora holds no Customer Data at termination other than diagnostic material Customer shared for support, which Ethora deletes within 30 days.

14. International transfers

1. Ethora is established in the United Kingdom. Under Model A, Ethora transfers no Customer Data out of Customer's infrastructure; support access takes place from the locations listed in Annex 3. Under Model B, Customer Data is hosted in the region named in Annex 3.
2. Where Data Protection Laws require a transfer mechanism for a transfer to a country without an adequacy decision, the parties incorporate by reference the EU Standard Contractual Clauses (Decision (EU) 2021/914, Module Two or Module Three as applicable) and the UK International Data Transfer Addendum, with Customer as data exporter and Ethora as data importer, the details in Annexes 1 to 3 serving as the appendices. Where PIPEDA applies, this DPA provides the contractual protection PIPEDA requires for personal information processed by a service provider outside Canada.

15. Liability

The liability caps and exclusions in the Services Agreement apply to this DPA, and the parties' combined liability under the Services Agreement and this DPA together does not exceed those caps, except where the Data Protection Laws do not allow liability to be limited.

16. Governing law

This DPA is governed by the law that governs the Services Agreement and is subject to the same dispute resolution terms, without prejudice to the rights of Data Subjects and Supervisory Authorities under the Data Protection Laws.

17. Precedence and changes

1. On the processing of Customer Data, this DPA prevails over the Services Agreement. On protected health information under HIPAA, the Business Associate Agreement prevails over this DPA.
2. The parties will amend this DPA as needed to comply with changes in the Data Protection Laws. Ethora may publish an updated template version on ethora.com; an update applies to a signed DPA only when both parties sign it, except for updates to Annex 3 made under clause 9.3.
3. This DPA may be signed in counterparts and electronically.

Signature block

Annex 1. Details of processing

Annex 2. Technical and organisational measures

1. Encryption in transit: TLS 1.2 or higher on every endpoint (API, chat server, file storage, admin panel). Encryption at rest for databases, file storage and backups hosted by Ethora under Model B. Optional end-to-end encrypted rooms, enabled per app by Customer.
2. Access control: role-based access in the Services; two-step verification on Ethora's own administrative accounts and available to Customer administrators (required per app at Customer's option); per-integration server tokens that can be revoked individually; archived users locked out.
3. Ethora personnel access: limited to named engineers, only for a support request, an update or a security incident, for the duration needed, and logged. Under Model A, only where Customer grants access and by the means Customer chooses.
4. Logging and audit: sign-ins, API calls and administrative actions logged; optional immutable export of the audit log to object-locked storage.
5. Separation: each customer's data separated by app and tenant in the platform; dedicated servers are single-tenant.
6. Availability and backups (Model B): automated backups, restore procedures, monitoring and alerting.
7. Secure development: code review, dependency and secret scanning in the build pipeline, security fixes released as part of the regular release line, release images built and published from the pipeline.
8. Vulnerability handling: private disclosure to security@ethora.com, acknowledgement within 3 business days, as described in the Support Policy.
9. Organisational: confidentiality obligations for all personnel, data protection training, a named security contact, incident response procedure, review of these measures at least annually.
10. Sub-processor management: written contracts, due diligence before engagement, the list in Annex 3 kept current.

Annex 3. Sub-processors and personnel locations

Ethora personnel who may access Customer Data for support work from the United Kingdom and from Ukraine. Changes to this Annex follow clause 9.3.