Data Processing Agreement
HeyUsher by Imperador Core · last updated 26 October 2026
This Data Processing Agreement forms part of the Terms of Service between the clinic (the "Controller") and Imperador Core, operator of HeyUsher (the "Processor"), for the purposes of Article 28 UK GDPR / EU GDPR.
1. Subject matter and duration
Processing of patient enquiries received on the Controller's WhatsApp number, for the duration of the subscription (and the trial).
2. Nature and purpose
Receiving, storing, transcribing (voice notes) and answering patient messages with an AI assistant; extracting enquiry details (name, phone, treatment of interest, preferred time) for the Controller's staff; sending reminders and a daily briefing to the Controller's staff.
3. Categories of data and data subjects
Patients and prospective patients of the Controller: WhatsApp number, message content (which may include health-related information the patient chooses to share), name and contact details given in the conversation.
4. Processor obligations
- Process personal data only on the Controller's documented instructions (the configuration of the service).
- Ensure persons authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational measures: TLS encryption in transit, restricted server access, no patient content in administrative dashboards, automatic deletion after 90 days.
- Assist the Controller with data-subject requests and with security incident notifications without undue delay (within 48 hours of becoming aware).
- Delete or return all personal data at the end of the service, on request, within 30 days.
- Make available the information necessary to demonstrate compliance and allow audits on reasonable notice.
5. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Hosting of the service and database | Oracle Cloud Infrastructure (São Paulo, Brazil) |
| Google (Gemini API) | Generating replies and transcribing voice notes | Google Cloud regions (EU/US) |
| Meta Platforms (WhatsApp) | Message delivery | per WhatsApp's terms |
| Cloudflare | Network security and TLS | global edge |
| Lemon Squeezy | Billing (clinic data only, no patient data) | USA / EU |
We will inform the Controller of any intended change of sub-processors, giving the opportunity to object.
6. International transfers
Where data leaves the UK/EEA (hosting in Brazil, AI processing by Google), transfers rely on the UK International Data Transfer Agreement / EU Standard Contractual Clauses incorporated here by reference, plus the technical measures above.
7. Acceptance
By starting a trial or subscription the Controller accepts this agreement. A signed copy can be requested at [email protected].