Data Processing Agreement

3.1 Subject Matter

CQC IQ processes Personal Data to provide the CQC IQ platform and associated services as described in the Terms of Service.

3.2 Duration

CQC IQ will process Personal Data for the duration of the Customer's Subscription and for 30 days thereafter (for the purposes of data export), unless a longer retention period is required by law.

3.3 Nature and Purpose of Processing

Processing is carried out for the purpose of providing the Service, which includes:

• Storing and retrieving checklist completion data
• Processing AI mock inspector session inputs and outputs
• Analysing video frames for compliance issues (Clinic Walkthrough Scan)
• Sending transactional emails to Authorised Users
• Providing readiness scores and reporting

3.4 Types of Personal Data

The Personal Data processed includes:

• Names and email addresses of Authorised Users
• Job titles and organisational roles
• Activity data and usage logs
• Content entered into the Service by Authorised Users (notes, action descriptions, playbook content)

3.5 Categories of Data Subjects

The Data Subjects are Authorised Users of the Service — employees, contractors and agents of the Customer.

4.1 Instructions

CQC IQ will process Personal Data only on documented instructions from the Customer, unless required to do so by applicable law. The Terms of Service and this DPA constitute the Customer's instructions to CQC IQ.

4.2 Confidentiality

CQC IQ will ensure that all personnel authorised to process the Personal Data are bound by appropriate confidentiality obligations.

4.3 Security

CQC IQ will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate:

• Pseudonymisation and encryption of Personal Data
• Ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems
• Ability to restore availability and access to Personal Data in a timely manner in the event of an incident
• Process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures

4.4 Sub-processors

The Customer provides general authorisation to CQC IQ to engage sub-processors. CQC IQ will:

• Inform the Customer of any intended changes to sub-processors with at least 14 days' notice
• Impose equivalent data protection obligations on sub-processors by contract
• Remain liable to the Customer for the performance of sub-processors' obligations

4.5 Data Subject Rights

CQC IQ will assist the Customer in fulfilling its obligations to respond to Data Subject rights requests, having regard to the nature of the processing. Given the nature of the Service, most Data Subject rights requests will relate to Authorised Users who can exercise their rights directly through account settings.

4.6 Data Protection Impact Assessments

CQC IQ will provide reasonable assistance to the Customer in carrying out data protection impact assessments and prior consultations with supervisory authorities where required.

4.7 Security Incidents

CQC IQ will notify the Customer without undue delay (and in any event within 72 hours) after becoming aware of a Security Incident affecting Personal Data processed under this DPA. The notification will include, to the extent available:

• A description of the nature of the Security Incident
• The categories and approximate number of Data Subjects and Personal Data records affected
• The name and contact details of CQC IQ's data protection contact
• Likely consequences of the Security Incident
• Measures taken or proposed to address the Security Incident

4.8 Deletion or Return

Upon termination of the Service, CQC IQ will, at the Customer's choice, delete or return all Personal Data to the Customer within 30 days, and delete existing copies unless required to retain them by law.

4.9 Audit

CQC IQ will make available all information necessary to demonstrate compliance with the obligations in this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or a mandated auditor. The Customer may request such an audit no more than once per year and must give at least 30 days' written notice.