Skip to content

UK GDPR Addendum

Version: 2026-10-28 · Supplement to the RehabPilot DPA

This Addendum forms part of the RehabPilot Data Processing Agreement for Clinics established in the United Kingdom.

1. Interpretation

References to the GDPR in the DPA are read as including the UK GDPR and the Data Protection Act 2018. “Supervisory authority” includes the UK Information Commissioner’s Office (ICO).

2. Processor obligations

RehabPilot processes Clinic personal data as a processor under UK GDPR Art. 28 on the Clinic’s documented instructions, as set out in the DPA (including Annexes A–D).

3. Transfers

Where the DPA contemplates transfers from the UK, appropriate UK transfer tools (e.g. UK IDTA / Addendum to EU SCCs, or other lawful mechanism) apply in addition to the safeguards described in the DPA.

4. Key DPA commitments that apply

The following commitments of the DPA (version 2026-10-28) apply in full to UK Clinics, with references to the GDPR read as references to the UK GDPR:

  • Access only on instruction: RehabPilot accesses content data only on the express, documented request of an authorised Clinic administrator in the individual case, or in an acute security emergency with notice to the Clinic afterwards, and never uses or discloses Clinic or patient data for its own purposes (DPA § 3a).
  • Confidentiality and professional secrecy: RehabPilot acts as a contributing person within the meaning of § 203(3) German Criminal Code (StGB); all persons involved are bound to secrecy in writing and informed of the criminal consequences of a breach (§ 203(4) StGB); this obligation is passed on to sub-processors (DPA § 4). For UK Clinics, the common-law duty of confidentiality is treated in the same way as § 203 StGB.
  • Infrastructure: application hosting (including the web app), databases, key management and email delivery at Amazon Web Services (Frankfurt), media storage and network protection at Cloudflare, each holding a BSI C5 attestation; hosting in Germany/EU. The website rehabpilot.org is hosted by Hetzner Online GmbH in Germany, which does not process and has no access to practice or patient data of the app; the attestations apply to these providers, not to RehabPilot itself (DPA § 5). Media is always encrypted before upload; this cannot be switched off.
  • Sub-processors: each sub-processor is contractually bound to obligations equivalent to the DPA; RehabPilot remains responsible for them; changes are announced at least 14 days in advance with a right to object (DPA § 6).
  • Breach notification: without undue delay and at the latest within 48 hours of becoming aware, with the information available at that time and follow-up without undue delay; emergency suspension of access on reasonable suspicion of an acute security threat, with notice to the Clinic (DPA § 8).
  • Retention: automatic deletion of patient and therapy data 10 years after the patient’s last activity (a different period or exclusion of individual patients on the Clinic’s instructions), of in-app messages after 30 days and of completion records and workout ratings after 180 days; otherwise deletion on the Clinic’s instructions; no automatic deletion at the end of the contract (DPA Annex A, § 8).
  • Audits: information, audits and inspections as set out in DPA § 9.

5. Precedence

If this Addendum conflicts with the DPA for UK Clinics, this Addendum prevails for UK GDPR matters. The United States is not currently served.

Contact: [email protected]