Last updated: 18 July 2026
Template — review before use. This DPA is provided as a starting point. Have it reviewed by a qualified adviser and complete the bracketed details before signing with a Clinic.
This Data Processing Agreement ("DPA") forms part of the agreement between the Clinic ("Controller") and [Legal entity name] ("Volofio" / "Processor") for the Volofio service ("Service"). It applies where Volofio processes personal data on the Controller's behalf and reflects Article 28 of the UK GDPR.
"UK GDPR", "personal data", "processing", "controller", "processor" and "data subject" have the meanings given in the UK GDPR and the Data Protection Act 2018. "Sub-processor" means any processor engaged by Volofio.
The Controller is the controller and Volofio is the processor of the personal data processed under the Service. Volofio processes personal data only on the Controller's documented instructions (including those given through configuring the Service), unless required by law.
| Subject matter | Provision of the AI receptionist Service (answering calls/messages, booking, reminders). |
|---|---|
| Duration | For the term of the agreement and until data is deleted or returned per clause 9. |
| Nature and purpose | Receiving, recording, transcribing and responding to calls/messages; scheduling appointments; sending notifications; analytics for the Controller. |
| Categories of data subjects | The Controller's patients and callers; the Controller's staff users. |
| Categories of personal data | Names, phone numbers, optional email addresses, appointment details, call recordings, transcripts, summaries and message content. |
| Special category data | Not required by the Service. Call content may incidentally reveal health-related information; the agent does not solicit clinical detail, triage, or give medical advice. |
The Controller gives general authorisation for Volofio to engage the sub-processors listed below to provide the Service. Volofio imposes data-protection obligations on each sub-processor substantially the same as those in this DPA and remains responsible for their performance. We will give reasonable notice of changes to sub-processors and allow the Controller to object on reasonable data-protection grounds.
| Sub-processor | Purpose |
|---|---|
| Supabase | Database, authentication, storage |
| Vercel | Application hosting |
| ElevenLabs | Conversational AI voice and speech-to-text |
| Twilio | Telephony and SMS |
| Calendar availability and booking (where connected) | |
| Anthropic | Large-language-model responses (where enabled) |
| Resend | Transactional and summary email |
Where a sub-processor processes personal data outside the UK, Volofio ensures an appropriate transfer mechanism is in place (UK adequacy regulations, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, with supplementary measures where needed).
Volofio will make available information reasonably necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the Controller or its authorised auditor on reasonable notice, subject to confidentiality and not more than once per year unless required by a supervisory authority or following an incident.
Volofio will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and provide information reasonably required to help the Controller meet its own notification obligations.
On termination or expiry of the Service, and at the Controller's choice, Volofio will delete or return the Controller's personal data and delete existing copies, unless UK law requires storage. The Service provides an export and a permanent-deletion function to support this.
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the main agreement.
Controller: [Clinic legal name] — signed [name], [title], [date].
Processor: [Legal entity name] — signed [name], [title], [date].