UK GDPR Addendum

This Addendum forms part of the RehabPilot Data Processing Agreement for Clinics established in the United Kingdom.

1. Interpretation

References to the GDPR in the DPA are read as including the UK GDPR and the Data Protection Act 2018. “Supervisory authority” includes the UK Information Commissioner’s Office (ICO).

2. Processor obligations

RehabPilot processes Clinic personal data as a processor under UK GDPR Art. 28 on the Clinic’s documented instructions, as set out in the DPA (including Annexes A–D).

3. Transfers

Where the DPA contemplates transfers from the UK, appropriate UK transfer tools (e.g. UK IDTA / Addendum to EU SCCs, or other lawful mechanism) apply in addition to the safeguards described in the DPA.

4. Precedence

If this Addendum conflicts with the DPA for UK Clinics, this Addendum prevails for UK GDPR matters. US Clinics: see the Business Associate Agreement.

Contact: [email protected]