Data Processing Schedule
1. Roles and scope
1.1 For Clinical Data, the Customer (the practice) is the controller and Akoua Pty Ltd (ACN 700 204 388) is the processor.
1.2 For Account Data (practitioner names, sign-in credentials and factors, billing records, support correspondence), Akoua is an independent controller; that processing is described in the UK Privacy Notice, not this Schedule.
1.3 "Clinical Data" means data processed through the Akoua service in the course of a consult or its documentation: session audio (transient), transcripts, drafted and confirmed clinical notes, letters, patient identifiers the Customer enters, and processing-evidence records.
2. Subject matter, duration, nature and purpose
Processing consists of: capture and transient handling of consult audio; automated transcription; automated drafting of clinical documentation for the Customer's review; storage and retrieval of the resulting records; and generation of processing-evidence and audit records. Processing continues for the subscription term plus the deletion window in §9. Data subjects: the Customer's patients and practitioners. Special-category data: health data, inherently.
3. Processing location
3.1 Clinical Data at rest is stored in the United Kingdom (Akoua's UK deployment, hosted in AWS eu-west-2, London).
3.2 Automated transcription runs on Deepgram's EU regional service (Frankfurt, Germany) and automated note drafting on Amazon Bedrock, invoked from Amazon Web Services' London region (eu-west-2) and served in Amazon Web Services' European Union regions, as the ordinary processing route for every consult, on the Customer's instructions and under the consent the Customer gives as the organisation for that processing, disclosed on every note. Ordinary consent to record is a separate authority, given for each consultation, and is not the basis for this processing. No Clinical Data is stored or processed outside the UK/EU in the ordinary operation of the service.
3.3 Remote access for support and platform administration may occur from Australia under the transfer safeguards in §8.
4. Processor obligations (Article 28(3))
Akoua shall: (a) process Clinical Data only on the Customer's documented instructions, the use of the service constituting those instructions; (b) ensure persons authorised to process are under confidentiality obligations; (c) implement the technical and organisational measures in Annex A; (d) engage sub-processors only under §7; (e) taking into account the nature of processing, assist the Customer in responding to data-subject rights requests through the service's rights-request workflow — export, purge with evidence retention, and an auditable trail; (f) assist the Customer with its Article 32–36 obligations; (g) at the Customer's choice, delete or return Clinical Data per §9; (h) make available information necessary to demonstrate compliance, and allow and contribute to audits as described in §10.
5. Personal data breach
Akoua shall notify the Customer without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting Clinical Data, with the information required by Article 33(3) so far as then known, supplemented as it becomes available. Notification is made to the registered practice-owner email and by in-product notice.
6. Confidentiality of processing — automated-only handling
In its ordinary operation the service processes Clinical Data by automated means only. Akoua personnel do not access Clinical Data content except: (i) at the Customer's request for support; (ii) where required to investigate an incident or suspected breach; (iii) where required by law. All such access is authenticated, role-restricted, logged in an append-only audit record, and occurs under §8 when performed from outside the UK.
7. Sub-processors
7.1 The Customer gives general written authorisation to the sub-processors on the UK Sub-processor List, as updated per §7.2.
7.2 Akoua will give at least 30 days' notice of any intended addition or replacement, by email to the practice owner, during which the Customer may object on reasonable data-protection grounds; if the objection cannot be resolved, the Customer may terminate the affected service with a pro-rata refund.
7.3 Akoua imposes data-protection obligations materially equivalent to this Schedule on each sub-processor before it begins processing Clinical Data for the United Kingdom service, and remains liable for their performance.
8. International transfers
8.1 Storage stays in the United Kingdom per §3.1. The automated transcription and note drafting in the European Union under §3.2 is UK-to-EU processing covered by the UK's adequacy regulations for the EEA.
8.2 Remote support and administrative access from Australia would be a restricted transfer. The agreement template for that transfer incorporates the ICO's International Data Transfer Agreement (IDTA) with the EU Standard Contractual Clauses by reference, supported by a transfer risk assessment. That documentation is not yet executed. The service is open to United Kingdom organisations.
8.3 No Clinical Data is transferred to any other third country.
9. Deletion and return
On termination, or on the Customer's instruction, Akoua deletes Clinical Data within 14 days, except: (i) processing-evidence and audit records retained as required for legal claims and regulatory accountability — the evidence trail is append-only by design, and deletion of clinical content preserves it; (ii) backups, which expire on their retention cycle of 35 days. Deletion is performed so the data is irrecoverable in the ordinary course.
10. Audit
Akoua satisfies audit requests first by written information and available third-party attestations of its infrastructure providers. On-site or remote audits: no more than once per 12 months, on reasonable notice, at the Customer's cost, and with no access to other customers' data.
Annex A — Technical and organisational measures
- Isolation: the UK deployment runs in its own cloud account, isolated from every other Akoua region; UK Clinical Data never co-mingles with other regions'.
- Encryption: TLS in transit throughout; encryption at rest via managed keys (KMS) for database, object storage and secrets.
- Access control: passkey-first authentication with second-factor fallback; role-based access; platform-administrative access is separately gated, logged, and (per §6) exceptional.
- Auditability: security-relevant actions and processing events are recorded in append-only stores enforced at the database layer.
- Processing evidence: every external processing hop — which provider, where, under what consent basis — is recorded immutably and is disclosable to the practice in-product.
- Provider controls: transcription (Deepgram EU) runs under a zero-retention configuration for audio and transcripts and an opt-out from provider model-improvement programmes (live configuration, and contractual under the Deepgram data-processing agreement); note drafting (Amazon Bedrock) does not store prompts or outputs or use them to train models under AWS's published commitments.
- Anonymous voice handling: the transcription provider receives anonymous diarisation only; voice identity is not disclosed to it.
- Backups: automated, encrypted, within the UK region, on a 35-day cycle.
- Personnel: access limited to named individuals under confidentiality obligations; production access from Australia only via the audited administrative surface.