This Data Processing Agreement sets out how Doxtor processes personal information on behalf of the clinics that use it.

It forms part of the Doxtor Terms of Service and applies to every Customer from 19 November 2026.

1. About this agreement

This Data Processing Agreement (“DPA”) is between:

the Customer, as defined in the Terms; and
ASAI CAPITAL LTD (company number 15585773), 13 Whitchurch Lane, Edgware, England, HA8 6JZ, which operates Doxtor.

It is incorporated into the Terms. By using the Services, the Customer agrees to it.

Where the Customer and Doxtor have signed a separate data processing agreement, that signed agreement applies instead of this one.

Words defined in the Terms have the same meaning here. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and any other data protection law that applies to the processing. “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject” and “Personal Data Breach” have the meanings given in Data Protection Law.

2. Roles

For Personal Data processed through the Services on the Customer’s behalf, including its patients’ records and results:

the Customer is the Controller; and
Doxtor is the Processor.

Doxtor is a Controller for the limited processing it carries out for its own purposes, such as running Customer accounts, billing, security and audit. The Doxtor Privacy Policy describes that processing. This DPA does not apply to it.

The Customer is responsible for having a lawful basis for the processing, including a condition for processing health data, and for giving its patients appropriate privacy information.

3. Instructions

Doxtor processes Customer Personal Data only on the Customer’s documented instructions, unless the law requires otherwise. If the law requires otherwise, Doxtor will tell the Customer before processing, unless the law prohibits that.

The Customer’s instructions are:

the Terms and this DPA;
the Customer’s use and configuration of the Services, including what its Authorised Users do in them; and
any further written instructions the Customer gives that Doxtor agrees are consistent with the Services.

Doxtor will tell the Customer if it believes an instruction infringes Data Protection Law.

Annex 1 describes the processing.

4. Confidentiality

Doxtor ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, under contract or by law.

5. Doxtor staff access to Customer Personal Data

Doxtor staff do not have general access to the Customer’s patient records. The Services keep each clinic’s data separate, and Doxtor’s own console shows clinic-level information such as orders, their tests and their status, without the patient.

The Customer authorises Doxtor staff to access Customer Personal Data only in the following ways.

5.1 Support sessions

To work inside the Customer’s account, a member of Doxtor staff asks the Customer for a support session. The request gives a reason, a duration and whether the access is read-only or read-and-write.

Nothing opens unless someone at the Customer with the right permission approves it.
Access lasts only for the time approved. Either side can end it at any time.
While it lasts, the Customer’s console shows a banner saying who has access and when it ends.
Every page opened and every change made is recorded in the Customer’s activity log and in Doxtor’s audit log.

5.2 Viewing a single order

Some work needs a look at one order quickly, without waiting for a support session. For that, an authorised member of Doxtor staff may view one order as the Customer sees it: the patient’s name, Patient ID and date of birth, the tests ordered, and the report, whether released or not, including any AI explanation the Customer’s plan includes and the report’s PDF.

This access is used only to:

check that a report is correct, for example that the laboratory’s results, reference ranges and explanation are shown properly;
respond to the Customer’s question about that order; or
chase the order’s results with the laboratory, which asks for the patient’s details.

Each view:

is limited to Doxtor staff with full administrative access, who must have entered their password within the previous fifteen minutes;
is for one order at a time, and requires a reason each time;
is read-only, and nothing can be changed through it;
is recorded in the Customer’s activity log, with the reason; in Doxtor’s audit log, under the name of the member of staff; and in the record of who has accessed the patient’s information, which the patient may ask about; and
is not kept: the order has to be opened again, and is recorded again, each time.

Downloading the report’s PDF in this way is recorded in the same places.

5.3 Laboratory deliveries

To investigate a laboratory delivery that was not processed, authorised Doxtor staff may view what the laboratory sent. Patient details in it are hidden unless the member of staff gives a reason, which is recorded.

5.4 Other access

Doxtor staff may also access Customer Personal Data where needed to:

carry out the Customer’s instructions, such as a data export or an erasure the Customer asked for;
investigate or respond to a security incident; or
comply with the law.

Doxtor does not use Customer Personal Data accessed in any of these ways for any other purpose.

6. Security

Doxtor maintains technical and organisational measures appropriate to the risk of the processing, as required by Article 32 of the UK GDPR. They include:

separation of each Customer’s data from every other Customer’s;
role-based access controls, set by the Customer for its own team;
authentication, including two-factor authentication, which Doxtor staff must use;
encryption in transit;
audit logging of actions, and logging of access to patient records;
the controls on Doxtor staff access in section 5;
restricted access to raw laboratory deliveries;
controlled data exports and erasure; and
backup and recovery.

Doxtor may update these measures, provided the overall level of security is not reduced.

7. Sub-processors

The Customer gives Doxtor general authorisation to use sub-processors. They provide:

hosting of the application and its database;
file storage, including report PDFs, and network security and delivery;
sending email and text messages, such as sign-in codes and results notifications, which never include the results themselves; and
writing AI explanations of results, which receive the results and the patient’s age and sex at birth, never their name, date of birth, contact details or any identifier, and only through providers that do not keep or train on the data.

Doxtor keeps a list of its current sub-processors, naming each one, what it does and where it processes Customer Personal Data. The Customer may ask for it at any time at privacy@doxtor.health.

The laboratory that analyses the Customer’s samples receives the patient details needed to run the tests, on the Customer’s instructions. Its role depends on its arrangement with the Customer, and it is not Doxtor’s sub-processor.

Doxtor will:

impose data protection obligations on each sub-processor equivalent to those in this DPA;
give the Customer at least 30 days’ notice before adding or replacing a sub-processor, by email or in the Services, naming it and saying what it will do; and
remain responsible to the Customer for each sub-processor’s performance of its obligations.

The Customer may object to a new sub-processor on reasonable data protection grounds within the notice period. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may end its use of the affected part of the Services.

8. International transfers

Customer Personal Data is stored in the United Kingdom and the European Economic Area.

Some sub-processors may process Customer Personal Data outside the United Kingdom, including in the United States, as the list in section 7 shows. Doxtor will transfer it only where the transfer is permitted by Data Protection Law, for example under UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9. Assisting the Customer

Taking into account the nature of the processing and the information available to it, Doxtor will assist the Customer:

in responding to requests from Data Subjects exercising their rights, including through the functionality in the Services. If a patient contacts Doxtor directly about the Customer’s records, Doxtor will refer the request to the Customer;
with its security obligations;
with data protection impact assessments and prior consultation with the Information Commissioner’s Office, where they relate to the Services; and
in demonstrating its compliance, as set out in section 12.

10. Personal Data Breaches

Doxtor will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will aim to do so the same day.

The notice will include, as far as it is then known:

what happened;
the categories and approximate number of Data Subjects and records concerned;
the likely consequences; and
the measures taken or proposed to deal with it.

Doxtor will provide further information as it becomes available, and will take reasonable steps to contain the breach and limit its effects.

The Customer, as Controller, decides whether to report the breach to the Information Commissioner’s Office and whether to tell the patients affected.

11. Retention, return and deletion

While the Customer uses the Services, Customer Personal Data is kept for the periods set out in the Doxtor Privacy Policy, or for longer where the Customer’s own clinical, legal or regulatory requirements require it.

When the Customer stops using the Services:

the Customer’s access and its patients’ access are disabled, and no new orders can be placed;
within 30 days, Doxtor and the Customer agree whether the Customer Personal Data is exported to the Customer, transferred to a successor the Customer names, kept for the remainder of the applicable clinical retention period, or deleted; and
Doxtor then returns, transfers or deletes it as agreed.

Doxtor may keep Customer Personal Data after that only where the law requires it to. Where it does, this DPA continues to apply to that data.

12. Information and audits

Doxtor will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the UK GDPR.

Doxtor will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints, provided that:

the Customer gives at least 30 days’ written notice;
the audit is no more than once a year, unless required by a regulator or following a Personal Data Breach;
the audit is carried out during business hours, in a way that does not unreasonably disrupt the Services or put other customers’ data at risk;
the auditor is bound by confidentiality; and
the Customer bears its own costs.

Doxtor may first provide documents, records and answers to written questions, where they reasonably satisfy the purpose of the audit.

13. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms, unless Data Protection Law does not allow them.

If there is a conflict between this DPA and the Terms concerning the processing of Personal Data, this DPA takes precedence.

14. Changes to this DPA

Doxtor may update this DPA from time to time, including to reflect changes in Data Protection Law.

Where a change is material, Doxtor will give the Customer reasonable notice before it takes effect.

15. Contact

For questions about this DPA or the processing of Customer Personal Data: privacy@doxtor.health

Annex 1: Details of the processing


Subject matter	Providing the Services: ordering blood tests, managing patients, samples and laboratory workflows, receiving results, producing reports, the patient portal and communications sent for the Customer
Duration	For as long as the Customer uses the Services, and afterwards as set out in section 11
Nature	Collection, recording, storage, organisation, retrieval, display, transmission to the laboratory and to sub-processors, and erasure
Purpose	To provide the Services the Customer has chosen, and to support and secure them
Data Subjects	The Customer’s patients; people the Customer gives portal access for them, such as parents and carers; the Customer’s Authorised Users
Personal Data	Identity details (name, date of birth, sex at birth, Patient ID); contact details; tests ordered, samples and their collection and dispatch; laboratory results; reports and their earlier versions; AI explanations of results; bookings and messages between patients and the Customer; records of who accessed what
Special category data	Data concerning health