Legal
Data Processing Agreement
This Data Processing Agreement forms part of the agreement between the Nature Therapy Hub customer and Nature Therapy Hub where Nature Therapy Hub processes personal data on the customer's behalf.
Last updated: 20 July 2026
This agreement is designed to support responsible data protection and UK GDPR obligations. It should be read with the Terms and Conditions and Privacy Policy.
Parties and roles
The customer is normally the Controller for client information stored in the Practice Hub. Nature Therapy Hub is normally the Processor for that information.
Nature Therapy Hub may act as an independent Controller for account administration, billing, security, support, legal compliance and its own website operations.
Schedule 1: processing details
| Subject matter | Provision of the Nature Therapy Hub Practice Hub, Client Portal, storage, communication and related software services. |
|---|---|
| Duration | For the term of the customer account and any limited post-termination period required for deletion, backups, legal compliance or security. |
| Nature and purpose | Hosting and organising client records, appointments, contracts and signatures, session notes, risk assessments, outdoor locations and routes, GPX files, safety check-ins, resources and documents, invoices, Client Portal access, email notifications, data export, audit and security operations. |
| Categories of data subjects | Therapist clients, prospective clients where entered by the therapist, client emergency contacts, authorised Client Portal users, and therapist staff or authorised practice users where applicable. |
| Types of personal data | Identity and contact information, appointment information, contract information, electronic signatures, financial and invoice information, emergency contact information, uploaded documents, location and route information, safety check-in information, portal access information, audit and technical records. |
| Special-category data | Physical and mental health information, therapy and clinical records, risk and safeguarding information, and other special-category data entered by the Controller. |
Controller instructions
Nature Therapy Hub will process Controller Data only on documented instructions, to provide the contracted service, or as required by UK law. If legally required to process data outside the Controller's instructions, Nature Therapy Hub will inform the Controller unless prohibited by law.
Use of the platform and its configured features forms part of the documented instructions.
Confidentiality
People authorised to process Controller Data must be subject to appropriate confidentiality obligations.
Security
Nature Therapy Hub applies technical and organisational measures including:
- Authentication
- HTTPS/TLS
- Row Level Security
- Access controls
- Private storage
- Signed file links
- Audit logs
- Restricted administration
- Backup and recovery arrangements provided by infrastructure services
- Secure development practices
- Incident response procedures
- Account deletion workflows
No online system can guarantee absolute security or zero data loss.
Sub-processors
The customer gives general written authorisation for Nature Therapy Hub to use sub-processors. Nature Therapy Hub will maintain a current list of sub-processors, impose appropriate data-protection obligations, remain responsible for its processing obligations, give reasonable notice of material new sub-processors and allow reasonable data-protection objections.
| Provider | Service | Likely processing location | Relevant safeguard or transfer mechanism |
|---|---|---|---|
| Supabase | Database, authentication and file storage infrastructure | Depends on the configured Supabase project region | Provider contractual safeguards and applicable transfer mechanisms |
| Vercel | Website and application hosting/deployment infrastructure | Depends on deployment configuration and provider infrastructure | Provider contractual safeguards and applicable transfer mechanisms |
| Resend | Transactional email delivery | Depends on provider infrastructure and message routing | Provider contractual safeguards and applicable transfer mechanisms |
| Stripe | Subscription payment processing, Stripe Checkout, Customer Portal, invoices and receipts | Depends on Stripe processing locations and account configuration | Provider contractual safeguards and applicable transfer mechanisms |
| Vercel Analytics | Optional website and application analytics where analytics consent is accepted | Depends on provider infrastructure | Provider contractual safeguards and applicable transfer mechanisms |
Data-subject rights
Nature Therapy Hub will provide reasonable assistance to help the Controller respond to access, correction, deletion, restriction, objection and portability requests. Therapists can use platform tools such as Data Export, record editing and account deletion where relevant.
Nature Therapy Hub may refer direct client requests to the relevant therapist where the therapist is the Controller.
Breach assistance
Nature Therapy Hub will notify the Controller without undue delay after becoming aware of a confirmed personal-data breach affecting Controller Data. Where available, the notification should include the nature of the breach, categories of affected data, likely consequences, measures taken or proposed and contact information.
DPIAs and regulatory assistance
Nature Therapy Hub will provide reasonable information and assistance for data protection impact assessments, prior consultation with the ICO, security reviews and demonstrating compliance. Assistance may be subject to reasonable limits or charges where requests are excessive or outside normal service provision.
Audits
Nature Therapy Hub will make information reasonably necessary to demonstrate Article 28 compliance available and allow reasonable audits or inspections. Audits require reasonable notice, must protect other customers' confidentiality and platform security, and may use documentary or remote evidence before intrusive inspection where appropriate.
The Controller must ensure audits do not unreasonably disrupt operations.
International transfers
International transfers will only occur under an appropriate lawful safeguard, such as UK adequacy regulations, a UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism.
Deletion or return
At account termination or deletion, the Controller may export data during the available access period. Nature Therapy Hub will delete or return Controller Data in accordance with the service workflow and Controller choice where applicable.
The account deletion workflow uses a 14-day grace period. Therapist-scoped records, files and authentication data are scheduled for deletion. Limited copies in backups may remain temporarily beyond active use, must remain protected and are removed through the normal deletion cycle. Limited records may be retained where UK law requires it.
Controller responsibilities
The Controller confirms that its instructions are lawful, it has an appropriate Article 6 lawful basis, it has an applicable Article 9 condition where required, it provides privacy information to clients, it does not upload unnecessary data, it handles client rights requests, it maintains appropriate professional retention policies, it configures access responsibly and it keeps emergency and contact details accurate.
Liability
Liability is addressed in the main Terms and Conditions. Nothing limits either party's statutory data-protection liability where it cannot legally be limited.
Precedence
If this DPA conflicts with another agreement concerning processing of Controller Data, this DPA takes precedence for that processing issue.
Contact
Questions about this Data Processing Agreement can be sent to [email protected].