Data Processing Agreement

Between VIMA Match Ltd (Processor) and the Therapist (Controller)

Made under Article 28 of the UK GDPR

Version 1.1 · Effective September 2026

This Data Processing Agreement (the "DPA") forms part of, and is incorporated into, the VIMA Terms of Use accepted by the Therapist. It applies where VIMA processes personal data on the Therapist's behalf. Where there is any conflict between this DPA and the Terms of Use in relation to data protection, this DPA prevails.

Parties

(1) VIMA Match Ltd, a company registered in Scotland (company number SC839660), ICO registration C1975810, whose contact address is admin@govima.co (the "Processor" or "VIMA"); and

(2) the Therapist — the individual or organisation that registers for and uses the VIMA platform and accepts these terms (the "Controller" or "Therapist").

Each a "party" and together the "parties".

Background

(A) VIMA operates a practice-management software platform ("VIMA" or the "Platform") that enables therapists and counsellors to record and manage information about their clients ("Clients"), including scheduling, session notes, client forms, uploaded documents, invoicing and payments.

(B) In providing the Platform, VIMA processes personal data — including special-category data concerning health — on behalf of the Therapist. The Therapist is the controller of that Client data and VIMA is the processor.

(C) This DPA sets out the terms on which VIMA processes that personal data, as required by Article 28 of the UK GDPR.

1. Definitions and interpretation

1.1 In this DPA the following terms have the following meanings:

• "UK GDPR" and "Data Protection Laws" mean the UK General Data Protection Regulation and the Data Protection Act 2018, together with all applicable laws relating to the processing of personal data.
• "Controller", "processor", "data subject", "personal data", "special category data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the UK GDPR.
• "Client Personal Data" means the personal data described in Annex A that VIMA processes on the Therapist's behalf under this DPA.
• "Sub-processor" means any third party engaged by VIMA to process Client Personal Data.
• "ICO" means the Information Commissioner's Office.

1.2 The Annexes (A, B and C) form part of this DPA. This DPA takes precedence over any conflicting term in the Terms of Use in respect of data protection.

2. Roles and scope of processing

2.1 The parties agree that, for Client Personal Data, the Therapist is the controller and VIMA is the processor.

2.2 For personal data relating to the Therapist's own account, billing, usage and marketing, VIMA is a controller in its own right, and its processing of that data is governed by VIMA's Privacy Notice rather than this DPA.

2.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex A.

2.4 The Therapist is responsible for establishing a valid lawful basis under Article 6 and, for special-category (health) data, a condition under Article 9 (for example, the Client's explicit consent, or the provision of health/social-care treatment), and for providing Clients with any required privacy information, before entering Client Personal Data into the Platform.

3. VIMA's obligations as processor

VIMA shall:

3.1 Documented instructions — process Client Personal Data only on the Therapist's documented instructions (including as to international transfers), which are set out in this DPA and given through the Platform's ordinary functionality, unless required to do otherwise by law; and if so required, inform the Therapist before processing unless the law prohibits it.

3.2 Notify unlawful instructions — immediately inform the Therapist if, in VIMA's opinion, an instruction infringes Data Protection Laws.

3.3 Confidentiality — ensure that persons authorised to process Client Personal Data (including staff and contractors) are bound by an appropriate duty of confidentiality.

3.4 Security — implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the UK GDPR. The measures in place at the date of this DPA are described in Annex B.

3.5 Sub-processors — comply with clause 4 in respect of engaging Sub-processors.

3.6 Assistance with data-subject rights — taking into account the nature of the processing, assist the Therapist by appropriate technical and organisational measures (insofar as possible) to respond to requests by data subjects to exercise their rights under Chapter III of the UK GDPR (access, rectification, erasure, restriction, portability and objection). Where a Client contacts VIMA directly to exercise a right, VIMA shall (unless legally prohibited) refer the request to the relevant Therapist.

3.7 Assistance with wider obligations — assist the Therapist in ensuring compliance with its obligations under Articles 32 to 36 of the UK GDPR (security of processing, personal-data-breach notification, data protection impact assessments and prior consultation), taking into account the nature of processing and the information available to VIMA.

3.8 Deletion or return — at the Therapist's choice, delete or return all Client Personal Data at the end of the provision of services, and delete existing copies unless UK law requires storage, in accordance with clause 7.

3.9 Audits and information — make available to the Therapist all information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by the Therapist or an auditor it mandates, subject to reasonable notice, confidentiality, and clause 3.10.

3.10 Audit practicalities — VIMA may satisfy an audit request by providing relevant third-party certifications, security-scan results, or a written description of its measures, where these reasonably address the Therapist's enquiry. On-site inspections shall be at the Therapist's cost, during business hours, no more than once per year (except following a personal data breach or at the ICO's direction), and shall not compromise other customers' data.

3.11 Documents, spreadsheets and exports downloaded from the Platform are produced in the Therapist's own browser. No Client Personal Data is sent to any third party in order to generate a PDF, a spreadsheet or an export file.

4. Sub-processors

4.1 The Therapist gives VIMA general written authorisation to engage the Sub-processors listed in Annex C for the processing of Client Personal Data.

4.2 VIMA shall impose on each Sub-processor, by written contract, data-protection obligations that are no less protective than those in this DPA, in particular appropriate security measures. VIMA remains fully liable to the Therapist for the performance of each Sub-processor's obligations.

4.3 VIMA shall inform the Therapist of any intended addition or replacement of a Sub-processor, giving the Therapist a reasonable opportunity to object on reasonable data-protection grounds. If the parties cannot resolve an objection, the Therapist may terminate the affected services.

5. International transfers

5.1 VIMA shall store Client Personal Data primarily in the United Kingdom (London region).

5.2 Where processing by a Sub-processor involves a transfer of Client Personal Data outside the UK, VIMA shall ensure the transfer is subject to appropriate safeguards under the UK GDPR — for example the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or reliance on UK adequacy/'data bridge' regulations where they apply.

6. Personal data breach

6.1 VIMA shall notify the Therapist without undue delay, and in any event where feasible within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data.

6.2 The notification shall, so far as possible, describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it.

6.3 VIMA shall reasonably assist the Therapist in meeting the Therapist's own obligations to notify the ICO (within 72 hours where required) and, where applicable, affected Clients. Responsibility for any such notification rests with the Therapist as controller.

7. Duration, termination and deletion

7.1 This DPA takes effect when the Therapist accepts the Terms of Use and continues while VIMA processes Client Personal Data on the Therapist's behalf.

7.2 On termination or expiry of the services, VIMA shall, at the Therapist's choice made within 30 days, return or delete all Client Personal Data and delete existing copies, unless UK law requires continued storage. VIMA may retain data in routine encrypted backups for a limited period until those backups are overwritten, during which it remains protected under this DPA.

7.3 The Therapist may export its Client Personal Data through the Platform's export functionality before deletion.

8. Liability

8.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Use. Nothing in this DPA limits either party's liability where it cannot lawfully be limited.

8.2 The Therapist is responsible for the lawfulness of the Client Personal Data and instructions it provides, and for obtaining any necessary consents from Clients.

9. General

9.1 Governing law — this DPA is governed by the laws of Scotland and the parties submit to the exclusive jurisdiction of its courts.

9.2 Entire agreement — this DPA, together with the Terms of Use and Privacy Notice, constitutes the entire agreement between the parties in relation to the processing of Client Personal Data.

9.3 Changes — VIMA may update this DPA to reflect changes in Data Protection Laws, guidance, Sub-processors or its services, giving reasonable notice; material changes affecting the Therapist's rights will be notified in advance.

Annex A — Details of the processing

Annex B — Technical and organisational security measures

VIMA maintains the following measures, which it may update provided the level of security is not reduced:

• Encryption of Client Personal Data in transit (TLS) and at rest.
• Data hosted in the United Kingdom (London region).
• Row-Level Security isolating each Therapist's data at the database layer, so one Therapist cannot access another's data (tested and verified).
• Private, non-public file storage for uploaded documents.
• Access controls and authentication, including multi-factor / one-time-code login for Therapist accounts.
• Secret keys and credentials held only in server-side secure storage, never exposed to the browser or committed to source control.
• Regular security scanning of the platform, with remediation of identified issues.
• Automated database backups with point-in-time recovery.
• Confidentiality obligations on personnel and contractors.
• A personal-data-breach response process, including notification to the Therapist (clause 6).

Annex C — Authorised Sub-processors

This list is current as at the date of this DPA and may be updated in accordance with clause 4.

Design and development tooling used to build the Platform has no access to the production database, authentication system or email, and is not a sub-processor.