Clinic CRM SaaS privacy notice

Controller and processor boundary

For tenant-controlled patient, staff or service-user information entered into the SaaS environment, the tenant organisation is normally the controller unless the signed contract says otherwise. Asclepius Wellbeing Ltd provides and operates the application and will usually act as processor for that tenant-controlled content.

For Asclepius account administration, billing, security, support, supplier governance and direct relationship records, Asclepius Wellbeing Ltd is controller.

What tenants control

Tenant organisations decide what data they ask their users to submit through booking tools, questionnaires, forms, case notes and operational workflows. Tenants are responsible for their own privacy notices, lawful basis, role access decisions, retention rules, clinical or professional governance and data-subject request handling for their controlled records.

What Asclepius provides

Asclepius provides the CRM application, hosting configuration, application security controls, audit features, backup arrangements, support routes and agreed processor assistance. Amazon Web Services provides underlying cloud infrastructure controls; Asclepius remains responsible for the application configuration, access controls, operational monitoring and supplier governance that sit above that infrastructure.

The SaaS route is not hosted through 20i. A tenant may still use the CRM booking or questionnaire tools as part of its own public workflow if that use is agreed, configured and covered by the tenant's privacy and service terms.

Support, rights and complaints

Where a request relates to tenant-controlled patient or service-user data, Asclepius may need to direct the requester to the tenant controller or assist the tenant under the contract. For Asclepius-controlled data-protection matters, contact assurance@prosperhealthcare.co.uk.