Data processing agreement

Last updated 13/10/2026

In short: Your laboratory controls its data; we process it only to run VipLIMS for you. We keep it confidential and secure, use only the sub-processors listed publicly, give 30 days' notice before adding or replacing one, tell you about a personal data breach within 48 hours of becoming aware of it, help you meet your obligations, allow audits, and delete or return your data when you leave. This agreement applies automatically when you accept the Terms of service.

Version 1.0. Effective date: 13 October 2026.

Evaluation period

While VipLIMS is an evaluation service, laboratories must not enter personal data about real patients (see the Evaluation period section of the Terms of service). This DPA nevertheless applies in full to any personal data the laboratory enters, including its users' details.

1. Parties and scope

1.1 This data processing agreement ("DPA") is between:

• the organisation that holds a VipLIMS account (the "laboratory" or "controller"); and
• Visiopath Ltd, a company registered in England and Wales under company number 12096339, of 5 East Close, London W5 3HE, United Kingdom ("Visiopath", "processor", "we").

1.2 This DPA forms part of the Terms of service. It applies to all personal data that the laboratory, or users acting for it, enter into or upload to VipLIMS ("customer personal data"). It sets out the terms required by Article 28(3) of the UK GDPR and of the EU GDPR (Regulation (EU) 2016/679), read with the Data Protection Act 2018 (together, "data protection law").

1.3 If this DPA conflicts with the Terms of service, this DPA takes priority for the processing of customer personal data.

1.4 Personal data for which Visiopath is itself the controller (website request data, account holders' contact and sign-in details, contact messages, newsletter subscriptions and donation records) is covered by our Privacy policy, not by this DPA.

2. Definitions

"Controller", "processor", "personal data", "special categories of personal data", "data subject", "personal data breach", "processing" and "supervisory authority" have the meanings given in data protection law. "Sub-processor" means a third party engaged by Visiopath to process customer personal data. "Working day" means a day other than a Saturday, Sunday or public holiday in England.

3. Details of the processing

3.1 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

3.2 The laboratory determines the purposes and means of processing customer personal data. Visiopath processes it only to provide VipLIMS to the laboratory.

4. Processing only on documented instructions (Article 28(3)(a))

4.1 We will process customer personal data only on the laboratory's documented instructions, including with regard to transfers to a third country or an international organisation. The Terms of service, this DPA, and the laboratory's use and configuration of VipLIMS are the laboratory's complete instructions at the date of acceptance. Further instructions must be in writing and consistent with the nature of the service.

4.2 If the law requires us to process customer personal data other than on the laboratory's instructions, we will tell the laboratory of that requirement before processing, unless the law prohibits this on important grounds of public interest.

4.3 We will tell the laboratory promptly if, in our opinion, an instruction infringes data protection law.

4.4 We will not process customer personal data for our own purposes. We will not sell it, use it for advertising, or mine or profile it. Platform administrators see only laboratory metadata and counts, never clinical records, and cannot sign in as laboratory users.

5. The laboratory's obligations

The laboratory is responsible for:

1. having a lawful basis under Article 6, and a condition under Article 9 (and, in the UK, Schedule 1 to the Data Protection Act 2018 where relevant) for health and genetic data, for all customer personal data;
2. giving privacy information to patients and other data subjects;
3. the accuracy and quality of customer personal data, and the lawfulness of its instructions;
4. managing its users, their roles and their access;
5. deciding how long to keep records, in line with the professional and legal retention rules that apply to it;
6. carrying out any data protection impact assessment and, for NHS organisations, any clinical safety or information governance assessment its own rules require.

6. Confidentiality (Article 28(3)(b))

We will make sure that everyone authorised to process customer personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and accesses it only as needed to provide, support or secure the service.

7. Security (Article 28(3)(c) and Article 32)

We will implement and maintain appropriate technical and organisational measures to protect customer personal data, as required by Article 32. The measures in place at the effective date are described in Annex 2. We may update them, provided that the overall level of protection is not reduced.

8. Sub-processors (Article 28(2) and 28(4))

8.1 General authorisation. The laboratory gives general written authorisation for Visiopath to engage sub-processors. The current list is published on our Sub-processor list and summarised in Annex 3.

8.2 Notice of changes. We will give at least 30 days' notice before adding or replacing a sub-processor, by updating the sub-processor list, announcing the change in the changelog, and emailing laboratory administrators.

8.3 Objections. The laboratory may object on reasonable data protection grounds by writing to [email protected] within the notice period. We will discuss the objection in good faith. If we cannot resolve it, the laboratory may export its data and close its account before the change takes effect.

8.4 Emergency replacement. If a sub-processor stops providing its service without warning, or a change is needed urgently to protect customer personal data, we may make the change with shorter notice. We will tell laboratory administrators as soon as possible and explain why, and clause 8.3 applies from that date.

8.5 Flow-down and liability. We will impose on each sub-processor, by written contract, data protection obligations that offer no less protection than this DPA, including sufficient guarantees of appropriate technical and organisational measures. We remain fully liable to the laboratory for the performance of each sub-processor's obligations.

9. Assistance (Article 28(3)(e) and (f))

9.1 Data subject requests. VipLIMS lets the laboratory find, view, correct and export records itself. If we receive a request directly from a data subject about customer personal data, we will forward it to the laboratory without undue delay, and in any event within 5 working days, and will not respond except on the laboratory's instructions. Taking into account the nature of the processing, we will help the laboratory by appropriate technical and organisational measures to respond to requests to exercise data subject rights.

9.2 Security, breaches, impact assessments and consultation. Taking into account the nature of the processing and the information available to us, we will help the laboratory to meet its obligations under Articles 32 to 36: security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with a supervisory authority.

9.3 Cost. Assistance that the service already provides, and assistance with a breach caused by us, is free. For extensive or bespoke assistance, we may agree a reasonable charge with the laboratory in advance.

10. Personal data breaches (Article 33(2))

10.1 We will notify the laboratory of a personal data breach affecting customer personal data without undue delay and in any event within 48 hours of becoming aware of it, by email to the laboratory's administrators.

10.2 The notice will include, as far as the information is available:

1. the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;
2. the likely consequences;
3. the measures taken or proposed to deal with the breach and to reduce its possible adverse effects;
4. the name and contact details of our contact point for more information.

10.3 Where we cannot provide all the information at once, we will provide it in stages without further undue delay. We will take reasonable steps to contain and investigate the breach, keep a record of it, and cooperate with the laboratory. We will not notify the laboratory's data subjects or supervisory authority on the laboratory's behalf unless it asks us to or the law requires us to.

10.4 Notifying a breach is not an admission of fault or liability.

11. Audits and information (Article 28(3)(h))

11.1 We will make available to the laboratory all information reasonably necessary to demonstrate compliance with Article 28 and this DPA, including this DPA, the security description in Annex 2, the sub-processor list, our security and data protection summary and, when we hold them, relevant certificates or audit reports. We will answer reasonable security questionnaires, including those needed for NHS Data Security and Protection Toolkit and Digital Technology Assessment Criteria (DTAC) assessments.

11.2 We do not yet hold any security certification. Our roadmap is Cyber Essentials, then Cyber Essentials Plus, then ISO/IEC 27001.

11.3 If that information is not enough to demonstrate compliance, or a supervisory authority requires it, the laboratory or an independent auditor it appoints may carry out an audit or inspection, on these conditions:

• at least 30 days' written notice, except after a personal data breach or where a supervisory authority requires otherwise;
• no more than once in any 12-month period, except in those cases;
• during normal business hours, without unreasonably disrupting our operations;
• the auditor is bound by confidentiality and must not access other laboratories' data or compromise the security of the service;
• each party bears its own costs, unless the audit reveals a material breach of this DPA by us.

12. Deletion or return at the end of the service (Article 28(3)(g))

12.1 Return. At any time, a laboratory administrator can download a full export from Account → Data export: a ZIP file of JSON and CSV files for each record type, plus report PDFs. This is how customer personal data is returned.

12.2 Deletion. When the laboratory closes its account, a 30-day grace period begins, during which any administrator can cancel the closure. When the period ends, an automated process permanently deletes all customer personal data and files of the laboratory, anonymises user accounts that belonged only to that laboratory, and records that the deletion took place.

12.3 Audit trail. On the laboratory's instruction, given by accepting this DPA, we keep the laboratory's audit trail after deletion, so that the laboratory can evidence its activities to regulators and accreditation bodies. The audit trail records who did what and when, with IP address and browser details, but no clinical text. We keep it for 8 years after closure, protected under this DPA, and then delete it. The laboratory may ask us for a copy at any time during that period.

12.4 Backups. Copies in our encrypted backups are deleted automatically as those backups reach the end of their rotation (14 daily, 8 weekly and the 5 most recent pre-release copies). Until then they remain encrypted and protected under this DPA, and are not used except to restore the service after an incident, in which case closed laboratories' data is deleted again.

12.5 We may keep customer personal data for longer only where UK or EU law requires us to, in which case this DPA continues to protect it.

13. International transfers

13.1 Customer personal data is stored in Germany, in the European Economic Area. We will not transfer customer personal data to a country outside the UK and EEA unless an appropriate safeguard applies under Chapter V of the UK GDPR or EU GDPR, such as adequacy regulations or an adequacy decision, the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses. Annex 4 sets out the current position.

13.2 Where the laboratory is in the EEA and Visiopath accesses customer personal data from the UK, the transfer is covered by the European Commission's adequacy decision for the United Kingdom.

14. Records and cooperation

We will keep a record of our processing activities on behalf of the laboratory as required by Article 30(2), and cooperate with any supervisory authority on request.

15. Liability

15.1 Each party's liability under this DPA is subject to the limits in the Terms of service, except where data protection law does not permit such limits.

15.2 Nothing in this DPA limits any rights that data subjects have directly against either party under data protection law, including under Article 82.

16. Term and changes

This DPA stays in force for as long as we process customer personal data, including after the Terms of service end. We may update it to reflect changes in law or in our service. We will give at least 30 days' notice of material changes in the same way as for the Terms of service, and no change will reduce the protection of customer personal data.

17. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where data protection law or the EU Standard Contractual Clauses require another law or forum to apply to a specific transfer.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

Annex 3: Authorised sub-processors

The current version is always on the Sub-processor list.

Stripe and PayPal process donations only. They do not process customer personal data and act as independent controllers for donors' payment data.

Annex 4: International transfers