v2026-05-01

Data Processing Agreement

Between:

Data Controller: You, the practitioner using HoldSpace ("Controller")

Data Processor: HoldSpace ("Processor")

Effective date: March 2026

This DPA forms part of the HoldSpace Terms of Service and governs the processing of personal data by the Processor on behalf of the Controller, pursuant to GDPR Article 28 and UK GDPR.

Note on client interactions: in the course of providing the Service, the Processor also collects personal data directly from the Controller's clients — specifically when they book sessions through the Controller's booking page or complete intake forms designed by the Controller. This data is processed on behalf of the Controller under this DPA. The Processor's own Privacy Policy applies to these interactions and is presented to clients at the point of data collection.

1. Definitions

"Personal Data", "Special Category Data", "Processing", "Data Breach" — as defined in GDPR Articles 4 and 9.

"Sub-processor" — any third party engaged by the Processor to process Personal Data on behalf of the Controller.

2. Scope and Purpose of Processing

2.1. Subject Matter

The Processor provides cloud-based practice management including scheduling, client record management, voice note recording, AI-powered transcription, note structuring, session status summaries, deep analysis, and customizable client intake forms.

2.2. Processing Activities

Activity Description Data involved
Client record storage Storing and displaying client records entered by Controller Name, email, bio, session history
Intake form collection Collecting responses to forms designed by Controller Form responses (content determined by Controller)
Booking management Collecting booking requests from Controller's clients Client name, email, appointment time
Voice transcription Converting voice dictation audio to text via Deepgram Audio stream, resulting text
Note structuring Organizing notes into structured format via Google Gemini Text of notes
Status summary Generating brief session status from previous notes via Google Gemini Text of previous session notes
Deep analysis Generating analytical summary across all notes via Google Gemini Text of all session notes for a client
Notifications Sending booking confirmations and reminders via Resend Client email, name, appointment details

2.3. Data Subjects

  • Primary: Clients of the Controller (individuals receiving services from the practitioner)
  • Secondary: The Controller themselves (practitioner account data)

2.4. Special Category Data

The Processor acknowledges that session notes, voice transcriptions, bio fields, and intake form responses are likely to contain health-related data (GDPR Article 9). The Processor applies the same level of security protection to all data fields without distinction.

2.5. Duration

Processing continues for the duration of the Controller's use of the Service, plus the deletion period specified in Section 10.

3. Controller Obligations

The Controller warrants that:

  • It has a lawful basis (including under Article 9 where applicable) for all personal data processed through the Service.
  • It has provided appropriate notice to data subjects, including informing clients that their data is stored in a cloud-based service and that AI is used for processing.
  • It has obtained necessary consents, particularly for health-related data in intake forms, session notes, and voice dictation.
  • It takes responsibility for the content and structure of custom intake forms.

4. Processor Obligations

The Processor shall:

  • Process Personal Data only on documented instructions from the Controller, unless required by law.
  • Ensure authorized persons are bound by confidentiality obligations.
  • Implement technical and organizational security measures (see Section 5).
  • Not engage sub-processors without general written authorization (Section 6).
  • Assist the Controller in responding to data subject requests.
  • Assist with GDPR Articles 32–36 obligations (security, breach notification, DPIA).
  • Upon termination, delete all Personal Data as specified in Section 10.
  • Make information available to demonstrate compliance and allow audits.

5. Security Measures

  • Encryption in transit (TLS 1.2+) for all data, including session notes, voice dictation, intake form responses, and AI-generated content.
  • Encrypted backups (age encryption).
  • Access controls with authentication (bcrypt password hashing).
  • Immutable audit logging of data access and modifications.
  • Logical data isolation between practitioners.
  • Rate limiting on authentication and API endpoints.
  • Hosted on Hetzner (Finland, Helsinki) — ISO 27001 certified data center.
  • All data fields treated with equal security regardless of content.

6. Sub-processors

The Controller grants general written authorization to engage sub-processors. Current list at: holdspace.pro/subprocessors.

14 days' email notice before engaging new sub-processors. Controller may object within 14 days.

AI Sub-processor — Special Provisions

The AI sub-processors used for transcription (Deepgram) and note structuring, status summaries, and deep analysis (Google Gemini):

  • Process data over encrypted connections only.
  • Deepgram: model improvement opt-out enabled (audio not used for training). Audio processed on EU-based servers.
  • Google Gemini: contractually prohibited from using data for model training.

7. Data Subject Rights

The Processor assists the Controller in responding to data subject requests under GDPR Chapter III. The Service provides data export (JSON), client record deletion (cascading), and data editing.

If a client contacts the Processor directly, the Processor will redirect the request to the Controller.

8. Data Breach Notification

The Processor shall notify the Controller without undue delay and within 72 hours of becoming aware of a Data Breach, including: description of the breach, categories and approximate numbers affected, likely consequences, and measures taken.

9. International Data Transfers

Primary data storage is in the EU (Finland). Where data is transferred outside the EEA (for AI processing), safeguards include Standard Contractual Clauses (SCCs), EU-US Data Privacy Framework, and encryption.

10. Data Deletion

When the Controller deletes a client record, all associated data is removed: name, email, bio, all session records, all note versions, all AI-generated content, and all intake form responses. Data is fully removed from our servers within 30 days.

Upon account termination: Controller may export data for 30 days. After 30 days, all data is permanently deleted. Confirmation available upon request.

11. Audits

The Processor makes compliance information available upon reasonable request. Controller may audit once per year with 30 days' notice, during business hours.

12. Term and Termination

This DPA remains in effect for the duration of the Controller's use of the Service. Upon termination of the Service agreement, the Processor shall delete all Personal Data in accordance with Section 10.

Contact

For DPA-related inquiries: [email protected]