This Data Processing Agreement (“DPA”) supplements and forms part of the FieldMedic Terms of Service (the “Agreement”) between:
It applies only to the optional Beacon cloud features. When Beacon is not enabled, FieldMedic transmits no personal data and this DPA does not apply.
Roles. You are the controller of Covered Data (or a processor acting for your own controller). FieldMedic is your processor.
Purpose. Encrypted storage and transmission of your records so they can be entered, backed up, synchronised across your team’s devices and retrieved by you — and nothing else. We perform no analysis or profiling of content, and do not use your data to train any model.
Duration. While Beacon remains configured, and until deletion under clause 8.
Data subjects. Your patients, casualties, expedition participants and course delegates; and your own team members as users.
Personal data. Within encrypted content: names, dates of birth, contact and emergency-contact details, medical histories, clinical observations, treatment and evacuation records. In plaintext operational metadata: anonymous account identifiers, device and team identifiers, timestamps, the names and roles users declare in team access logs, and an account email address where you have given us one.
You shall: (a) ensure you have a lawful basis — and for health data a valid Article 9 condition — for what you record and share; (b) provide privacy information to data subjects; (c) share team join codes and recovery codes only with authorised people and keep them secure — anyone holding a code can decrypt the corresponding data, and we cannot distinguish an authorised holder from an unauthorised one; (d) acknowledge that lost codes cannot be recovered by us and the encrypted cloud data is then unrecoverable (clause 4); and (e) where you need assurance of receiving breach notice, give us a contact address and keep it current (clause 7).
FieldMedic shall: (a) process Covered Data only for the purposes in clause 1 and on your documented instructions, unless required otherwise by law, in which case we will inform you unless prohibited; (b) ensure persons authorised to process Covered Data are bound by confidentiality; (c) implement the measures in Schedule 1; (d) not sell Covered Data, share it for advertising, or process it for any purpose of our own; (e) assist you with data subject requests (clause 6) and with your security, breach-notification and assessment obligations, to the extent the information is available to us; (f) make available the information reasonably necessary to demonstrate compliance (clause 9); and (g) immediately inform you if, in our opinion, an instruction infringes UK GDPR or other applicable law.
Records are encrypted on your devices with keys derived from codes — your team join code or personal recovery code — that never reach FieldMedic or its sub-processors. In consequence:
You should reflect the first two points in your own data-subject-request procedures before relying on Beacon.
You give general authorisation for the sub-processors in Schedule 2. We will give at least 30 days’ notice of changes, by updating Schedule 2 and the version date of this page, and by email to customers who have given us an address. You may object on reasonable data protection grounds; if it cannot be resolved you may stop using Beacon and receive a pro-rata refund of any prepaid period. Sub-processors are bound by obligations no less protective than these, and we remain liable for their performance.
We will promptly — and in any case within 7 days — refer to you any data subject request we can associate with you, and will not respond to the requester except to redirect them. Given clause 4, our assistance takes the form of deleting a team’s or device’s ciphertext on request, the app’s and Portal’s built-in export, rectification and deletion functions, and such plaintext metadata as we actually hold.
We shall notify you without undue delay after becoming aware of a personal data breach affecting your data — where feasible within 48 hours, and in any event within 72 hours — with the information reasonably required for your own assessment and notifications, and take reasonable steps to contain and remediate.
The parties acknowledge that a breach of stored ciphertext alone, without the corresponding codes, does not expose readable personal data — relevant to, but not determinative of, your risk assessment under Articles 33–34.
You can stop processing at any time: leaving a team or turning off backup halts synchronisation immediately.
Request deletion at hello@fieldmedic.app, which is the channel for such requests. We will complete it within 30 days of receipt and confirm by reply. On termination of the Agreement we will delete remaining Covered Data within 90 days.
Return is self-service — Export data in the app, or CSV and print from the Portal. This satisfies the return obligation, because we cannot produce readable content (clause 4) and you already hold the only readable copy.
Residual copies may persist in a sub-processor’s routine backups until those expire automatically; that retention is set by our hosting plan and does not exceed 30 days. Such copies remain encrypted and are not accessed.
No more than once per calendar year, and on 30 days’ written notice, we will make available our current description of technical and organisational measures, confirmation of our upstream DPA with Supabase, and Supabase’s own security certifications and documentation. Request these at hello@fieldmedic.app.
Given our size and the zero-knowledge design, the parties agree this documentary route ordinarily satisfies audit requirements and on-site audits are excluded, save where a supervisory authority requires otherwise or a personal data breach affecting you has occurred. Audits are subject to confidentiality and must not unreasonably disrupt our operations.
Covered Data is stored in the United Kingdom — the Supabase project region
is London (eu-west-2). For a UK customer there is therefore no international
transfer. For an EU customer, transfer to the UK is covered by the European
Commission’s adequacy decision for the United Kingdom.
Where a sub-processor’s supporting services involve transfers outside the UK or EEA, those are covered by the Standard Contractual Clauses and the UK Addendum incorporated in our upstream DPA with Supabase.
Liability under this DPA is subject to the limitations in the Agreement, save that nothing limits liability which cannot be limited by law. This DPA is governed by the law of England and Wales. Where this DPA conflicts with the Terms or the Privacy Policy on a data protection matter, this DPA prevails. If data protection law changes, the parties will negotiate necessary amendments in good faith. Notices to hello@fieldmedic.app.
Not required. This DPA takes effect when you enable Beacon. Complete this only if your own records require a signed instrument — email hello@fieldmedic.app and we will return a countersigned PDF.
A fuller description, including an explicit statement of what is not in place, is available on request under clause 9.
eu-west-2)
· access to record content: ciphertext only, cannot decrypt.
Payment providers (Apple, Google, and Stripe/Onelink for partner web purchases) and the entitlement service (RevenueCat) process purchaser data only. They never receive Covered Data and are therefore not sub-processors under this DPA.
Version 1.0 — September 2026. FieldMedic Ltd, registered in England & Wales, company no. 17375229. Registered with the UK Information Commissioner’s Office under registration C2006592.