Data Processing Agreement
Last updated: 5th December 2025
This Data Processing Agreement ("DPA") forms part of and is incorporated into the agreement for the provision of Jump EHR between:
Processor
The Lathbury Group Ltd trading as Jump EHR (Use Jump)
Mayfield House, 256 Banbury Road, Oxford, OX2 7DE
Company number: 15291957
("Jump", "we", "us", or "Processor")
and
The Customer using Jump EHR ("Controller").
This DPA applies where Jump processes Personal Data on behalf of the Controller.
1. Definitions
The terms controller, processor, data subject, personal data, processing and personal data breach have the meanings given in UK GDPR.
Applicable Data Protection Law means UK GDPR, the Data Protection Act 2018 and any laws replacing or supplementing them.
Customer Personal Data means personal data processed by Jump on behalf of the Controller through Jump EHR.
2. Roles of the Parties
2.1
The parties agree that:
- The Controller is the data controller for Customer Personal Data
- Jump acts as a data processor
2.2
Jump acts as a data controller only for:
- Account management data
- Billing data
- System usage analytics
- Direct communications with customer personnel
3. Scope of Processing
3.1 Subject Matter
Provision of the Jump EHR system and related services.
3.2 Nature of Processing
Collection, storage, organisation, retrieval, consultation, use, transmission, and deletion.
3.3 Purpose
To enable the Controller to deliver healthcare services and manage clinical workflows.
3.4 Duration
For the duration of the Agreement and any agreed data retention period.
3.5 Categories of Data Subjects
Patients, service users, healthcare staff, and authorised users.
3.6 Categories of Personal Data
May include:
- Identifiers (name, DOB, contact details)
- Health and clinical data
- Appointment records
- Communications
- Administrative and billing data
Special category data (health data) will be processed.
4. Processor Obligations
Jump shall:
4.1
Process Customer Personal Data only on documented instructions from the Controller, unless required by law.
4.2
Inform the Controller if an instruction appears to breach data protection law.
4.3
Implement appropriate technical and organisational security measures, including:
- Encryption in transit and at rest
- Access controls and RBAC
- Security monitoring and logging
- Regular security testing
- Business continuity measures
4.4
Ensure personnel are subject to confidentiality obligations.
4.5
Assist the Controller, at reasonable request, with:
- Data subject rights requests
- Security and breach obligations
- Data protection impact assessments
4.6
Notify the Controller without undue delay upon becoming aware of a personal data breach affecting Customer Personal Data.
4.7
Delete or return Customer Personal Data upon termination, unless retention is legally required.
4.8
Maintain records demonstrating compliance and allow reasonable audits with prior notice.
5. Controller Obligations
The Controller is responsible for:
- Lawful basis for processing
- Providing required notices to patients
- Accuracy of data
- Managing data subject rights
- Clinical governance decisions
6. Sub-Processors
6.1
The Controller gives general authorisation for Jump to use sub-processors.
6.2
Jump will:
- Ensure sub-processors are bound by equivalent data protection obligations
- Remain responsible for their acts and omissions
6.3
Jump will provide a current list of sub-processors on request.
7. International Transfers
Where Customer Personal Data is transferred outside the UK, Jump will ensure appropriate safeguards such as:
- Standard contractual clauses
- Adequacy regulations
- Recognised transfer mechanisms
8. Security Incidents
Jump will:
- Investigate incidents
- Provide relevant information
- Cooperate with the Controller's response
The Controller is responsible for regulatory and patient notifications.
9. Data Return and Deletion
Upon termination:
- Data export available for 90 days
- Thereafter securely deleted or anonymised
- Backups overwritten in normal cycles
10. Audits
The Controller may audit compliance once per year with reasonable notice, during business hours, without disrupting operations.
11. Liability
Liability under this DPA is subject to the limitations in the main Agreement.
12. Governing Law
England and Wales.
Schedule 1 – Sub-Processors and Integrations
(Forming part of the Jump EHR Data Processing Agreement)
A. Jump Sub-Processors
These organisations process Customer Personal Data on behalf of Jump in order to provide the Jump EHR service. Jump remains responsible for their compliance with data protection obligations.
| Sub-Processor | Service Provided | Data Location | Purpose of Processing |
|---|---|---|---|
| Supabase (on AWS infrastructure) | Database and backend services | UK/EU (London region) | Storage and management of application data |
| Vercel | Application hosting and deployment | UK/EU | Hosting of the Jump EHR web application and related services |
| Firetext | SMS delivery services | UK | Delivery of SMS notifications and patient communications |
| Resend | Email delivery services | EU (Ireland) | Delivery of system and patient communications |
| OpenAI (optional, feature-dependent) | AI processing services | EU/UK depending on configuration | AI-assisted drafting, summarisation, and structuring when enabled by the Customer |
| Sentry | Error monitoring | EU | Application error tracking and system reliability monitoring |
| PostHog (EU hosting) | Product analytics | EU | Aggregated and pseudonymised usage analytics for service improvement |
| Stripe | Payment processing | EU/US | Subscription billing and payment processing relating to Customer organisations only |
Important Notes
- Stripe does not process clinical or patient medical data as part of Jump EHR operations. Stripe processes limited billing and account information relating to Customer organisations and authorised users for subscription payment purposes only.
- OpenAI services are only used when AI functionality is activated by the Customer.
- AI processing does not involve model training using Customer Personal Data.
- PostHog analytics data is pseudonymised and does not include clinical content.
- All sub-processors are bound by contractual data protection obligations consistent with this DPA.
B. Customer-Enabled Integrations (Not Jump Sub-Processors)
Jump EHR allows Customers to connect to third-party systems. When enabled, data may be shared directly between the Customer and the third party. These providers are not sub-processors of Jump.
| Provider Type | Examples | Role |
|---|---|---|
| Document platforms | Microsoft SharePoint, Microsoft Word, Google Drive | Independent controller or processor under their own terms |
| Payment services | Stripe (patient payments) | Independent controller/processor |
| Accounting systems | Xero | Independent controller/processor |
| Laboratory and diagnostics | Scan.com, TDL, and other laboratory integrations | Independent healthcare data controller |
| Other integrations | Additional services chosen by the Customer | Independent third parties |
Integration Responsibilities
- The Customer is responsible for appropriate agreements with these providers.
- Jump provides technical connectivity but does not control third-party processing.
- Enabling an integration constitutes the Customer's instruction to transmit relevant data.
C. Changes to Sub-Processors
Jump may update this list and will notify Customers of material changes. Customers may object on reasonable data protection grounds.
D. International Transfers
Where any sub-processor processes data outside the UK, appropriate safeguards such as standard contractual clauses or adequacy regulations will apply.