Data Processing Agreement

Last updated: 24 October 2026

Parties and roles

This agreement forms part of the Terms of Service between your practice ("Customer", the controller) and Hypermetron, the company that operates HyperCRM (the processor) — Hypermetron is also the party that contracts with and invoices your practice, and is a controller in its own right for that billing relationship. It governs our processing of personal data on your behalf and is written to satisfy Article 28 of the GDPR. For our full legal entity details, or a countersigned copy for your compliance file, write to hello@hypercrm.app.

What we process, and why

• Subject matter: providing the HyperCRM practice management service.
• Duration: for as long as your account is open, plus the deletion window below.
• Nature and purpose: scheduling, clinical record-keeping, forms, file storage and invoicing, as configured by you. Also: appointment reminders by text message and email; your practice website, its online booking and its public forms; the in-app assistant, which reads and writes the records a member asks it about; the phone assistant, where your practice uses it, which answers your line and can take a booking; moving your data in from your previous system, which our team runs for you on request; our team working inside your account where you ask us to, such as setting up your website or an import; and, where a practitioner turns it on, sending their appointments to a calendar they choose (see Calendar sync below).
• Types of personal data: patient demographics, clinical notes, form responses, uploaded documents, imaging and 3D scans, appointments and invoices — including health data, which is special-category data under Article 9. An uploaded image is resized to fit 2560 pixels, converted to WebP and stripped of its metadata as it arrives, and we do not keep the original file; PDFs and 3D scans are stored exactly as you send them. If your practice needs the untouched original of a photograph, keep your own copy.
• Categories of data subject: your patients and your staff. Also anyone who books or writes to you through your HyperCRM website or its forms without being a patient yet; anyone who rings a line the phone assistant answers, whether or not they become a patient; and the referrers you record (their name, kind, phone, email and your notes about them).

Our obligations

We will:

1. process personal data only on your documented instructions, including as to transfers, unless the law requires otherwise — and where it does, tell you first unless we are legally forbidden from doing so;
2. ensure that everyone we authorise to process the data is under a duty of confidentiality;
3. implement appropriate technical and organisational security measures — set out concretely on the security page: passkey authentication, role-based access, an audit log of every change to a record, private file storage served only through short-lived signed links, and encryption in transit and at rest;
4. engage sub-processors only on the terms below;
5. help you respond to data-subject requests — access, correction, deletion, portability and objection;
6. help you meet your own obligations on security, breach notification and data protection impact assessments (Articles 32 to 36);
7. delete or return the personal data at the end of the service, as described below;
8. make available the information you need to demonstrate compliance, and submit to audits as described below.

Sub-processors

You give general authorisation for us to engage the sub-processors published at sub-processors, which names each one, what it processes, and whether it is essential or only active when a practice enables it.

We will give you at least 30 days' notice before adding or replacing a sub-processor, during which you may object on reasonable data-protection grounds. We impose data-protection obligations on each sub-processor equivalent to those in this agreement, and we remain responsible to you for their performance.

Calendar sync: data sent where you choose

Each practitioner can send their own appointments to a calendar outside HyperCRM. There are two ways. They can connect their own Google account, where we create a separate calendar named after your practice. Or they can create a private subscription link, which any calendar app can read (Apple Calendar, Outlook, Google Calendar and others).

• What is sent: for each appointment, the patient's name, the service, the start and end time, the chair or room, the location's name and address where your practice has more than one, and a link back into HyperCRM that opens only after sign-in. A booking taken over the phone for someone who is not yet on your records shows "Phone booking" and the service until a person saves the patient. A booking request that the practice has not yet confirmed shows "Booking request" and the service, without the patient's name. Blocked time is sent as "Unavailable". We never send notes, phone numbers, email addresses or any other part of the clinical record.
• It is health data. A patient's name next to a service and a time at a practice can reveal health information. Treat it as special-category data under Article 9.
• Who decides. Each practitioner decides for themselves whether to connect their own calendar or create a link, in their own account settings. We treat a practitioner turning it on as an instruction from your practice under this agreement. The practice owner can see in Settings → Team who has a calendar connected. Your practice remains the controller. It is responsible for telling its team when calendar sync is or is not appropriate, and for the lawful basis and the Article 9 condition for this disclosure.
• The recipient is yours, not ours. Google, Apple, Microsoft or any other calendar provider receives the data under the practitioner's, or your practice's, own agreement with that provider. It does not act on our behalf. It is therefore not our sub-processor, and the sub-processor terms above do not apply to it.
• Transfers. These providers may hold the data outside the EEA, including in the United States. Whether that transfer is acceptable, for example under the EU-US Data Privacy Framework, is for your practice to assess.
• One way only. We read nothing from these calendars. With Google we ask only to manage the calendar we create, plus the account's email address. We cannot see the practitioner's other calendars or events.
• The subscription link is a credential. Anyone who holds it can see those appointments without signing in. It should be kept like a password. The practitioner can create a new link, which stops the old one at once, or turn it off. If the link is added to a cloud calendar, that provider's servers fetch it and keep a copy.
• What we store. For Google: a long-lived refresh token, which lets us keep that calendar up to date, encrypted (AES-256-GCM); the id of the calendar we created; the Google account's email address; and which appointment has an event in which calendar (ids and a checksum, never names). For a link: only a one-way hash of it. We cannot show a link again once it has been created.

Deletion. When a practitioner disconnects Google, we delete the HyperCRM calendar from their Google account and give up our access. We then delete the token and our records of it. The same happens on its own when a member is removed from your practice or your account closes. If the practitioner has already removed our access in Google, we can no longer reach that calendar, and they need to delete it there themselves. When a link is turned off or replaced, it returns an empty calendar, so apps clear it at their next refresh. We delete the hash of a revoked link after 90 days. When a patient is erased, we remove their name from their synced events in Google. If the practitioner's connection needs reconnecting at that moment, the name is removed once they reconnect. Apps that use a private link drop the name the next time they refresh. Copies the calendar company keeps itself, such as event history or notification emails, are outside our control.

Personal data breaches

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations under Articles 33 and 34. We will not wait until we have a complete picture before telling you that something has happened.

International transfers

Some of our sub-processors are based outside the EEA, principally in the United States. Those providers offer the standard safeguards for such transfers — Standard Contractual Clauses and, where applicable, participation in the EU–US Data Privacy Framework. Ask us and we will provide the transfer documentation we hold for each provider so you can map it in your own records. This does not cover the calendar providers your practitioners choose for calendar sync, which are covered in the section above.

Audit

We will make available, on your reasonable request, the documentation needed to demonstrate our compliance with this agreement. We do not hold a SOC 2 report or an ISO 27001 certificate, and we will not imply otherwise.

Return and deletion

What "return" means here, precisely. Four things come out of the product yourself, at any time, at no charge and with no waiting period: your patient list, your reports and the activity log as CSV, and every file you have uploaded. The rest of the record — clinical notes, appointments, invoices and receipts, dental and gum charts, courses of appointments, and your referrers — has no self-service export yet. Ask us and we will produce it for you; say so before you close the account, because closing starts the deletion window below. We would rather write this down than let "delete or return" imply a button that does not exist.

After your account closes we delete your personal data within 30 days, except where the law requires us to keep it. That window exists so an accidental closure is recoverable — it is not a retention period you should rely on to meet a clinical record-keeping obligation, which stays with your practice. A subscription that lapses or is cancelled does not close the account and deletes nothing: the data is kept, read-only, until you close it.

Changes and governing law

We will update this agreement as the product and our processors change, and the date at the top will always reflect the current version. It is governed by the same law as the Terms of Service.