Data Processing Agreement

In short

• Your clinic decides what patient data to record and why, so it is the data controller. We run Stator for you, so we are your data processor.
• We process the data only on your instructions and only to run Stator, and our staff keep it confidential.
• The database is hosted on a server in Nigeria. Uploaded files and encrypted backups are stored with Cloudflare, and the app's email goes through Resend, both outside Nigeria. Annex C says exactly what leaves Nigeria and how it is protected.
• If a breach affects your data, we tell you within 48 hours.
• When you leave, you get your data back and we delete it.

1. About this agreement

1.1. This Data Processing Agreement ("DPA") is between the clinic that uses Stator ("the clinic") and Stator Health Ltd (RC 9955767), a company registered in Nigeria ("Stator Health", "we", "us").

1.2. It forms part of the Terms of Service and applies whenever we process personal data for the clinic in providing Stator. The clinic accepts it when it accepts the Terms of Service.

1.3. Where this DPA and the Terms of Service differ on personal data, this DPA applies. If the clinic and we sign a separate data processing agreement, the signed one applies where it differs from this page.

1.4. This DPA is written to meet the Nigeria Data Protection Act 2023 ("the Act") and the General Application and Implementation Directive issued under it by the Nigeria Data Protection Commission ("the Directive"), together called "data protection law".

2. Words we use

Words defined in data protection law have the same meaning here. In particular:

• Personal data: any information about an identified or identifiable living person.
• Sensitive personal data: personal data the Act treats as sensitive. Health data, which most of the data in Stator is, is sensitive personal data.
• Data subject: the person the personal data is about, such as a patient.
• Processing: anything done with personal data, such as storing, viewing, changing, sending or deleting it.
• Personal data breach: a breach of security that leads to personal data being destroyed, lost, changed, disclosed or accessed without authority, whether by accident or on purpose.
• Sub-processor: another business we engage to process clinic personal data for us.
• The Commission: the Nigeria Data Protection Commission (NDPC).

3. Roles

3.1. The clinic is the data controller for the personal data it and its users put into Stator. It decides what to record, why, and who at the clinic may see it.

3.2. We are the clinic's data processor. We process clinic personal data only to provide Stator to the clinic.

3.3. For the personal data we collect for our own purposes (such as the name and email of the person who signs the clinic up, and our invoices to the clinic), we are a data controller, and our Privacy Notice applies.

4. What we process, and why

4.1. Subject matter and purpose. Hosting and running Stator for the clinic: storing the clinic's records, showing them to the right users, sending the app's messages, backing them up and supporting the clinic's staff.

4.2. Duration. For as long as the clinic uses Stator, then until return and deletion are complete under section 15.

4.3. Nature of the processing. Storage, hosting, backup, retrieval, display to authorised users, transmission by email, export at the clinic's request, support and troubleshooting, and deletion.

4.4. Data subjects.

• the clinic's patients;
• family members or carers a patient gives access to;
• the clinic's staff users (admins, head physios, physios, front desk and accountants);
• people named in records, such as a patient's contacts or next of kin, and referrers.

4.5. Categories of personal data.

• Identity and contact: names, date of birth, gender, marital status, occupation, phone, email, address, an identification number if the clinic records one, the clinic's own patient number, and a patient's contacts (name, relationship, phone and email).
• Clinical (sensitive): chief complaint, assessments, evaluations, daily notes, reassessments, goals, outcome measures, care plans, exercise programmes, completed intake forms and uploaded documents such as reports and scans.
• Appointments and visits: dates, times, branch, the physio, visit type, home-visit addresses, time in and time out, and signatures captured at home visits.
• Billing: invoices, payments, balances, and HMO or insurance details such as the scheme, member ID, expiry date and claims.
• Patient app: invitations, sign-ins, family access with the record of the patient's consent, records requests, appointment requests and messages to the clinic.
• Staff: name, email, role, branch, sign-in sessions (including the IP address and browser of each session) and the audit trail of what each user did.

4.6. Sensitive personal data. Stator holds health data, and we apply the measures in annex A to all of it.

5. The clinic's instructions

5.1. We process clinic personal data only on the clinic's documented instructions. The instructions are: the Terms of Service and this DPA; the clinic's use of Stator's features and settings; and written requests from the clinic's admin, by email to hello@statorhealth.com.

5.2. If we believe an instruction breaks data protection law, we tell the clinic and need not follow it until it is confirmed or changed.

5.3. If the law requires us to process clinic personal data in a way the clinic hasn't instructed, we tell the clinic before we do so, unless the law forbids telling it.

6. The clinic's responsibilities

The clinic:

• has a lawful basis under data protection law for the personal data it records in Stator, including the stricter conditions for health data;
• gives its patients a privacy notice that explains how their data is used, that a service provider runs its records system, and that some of the data is stored outside Nigeria (annex C);
• records a patient's consent before giving a family member access to the patient app;
• where a patient is a child, obtains the consent of a parent or legal guardian before recording the child's data, where section 31 of the Act requires it, and takes reasonable steps to check the child's age and that consent;
• keeps its staff logins and roles up to date, and locks accounts when people leave;
• meets any registration or other duty that data protection law places on it as a controller, including any that applies to a data controller of major importance;
• gives us only lawful instructions.

7. Confidentiality

7.1. Only people we authorise can reach clinic personal data, and only when they need to in order to provide or support Stator. Each of them is bound by a written duty of confidentiality that continues after they stop working with us.

7.2. Our own admin screens can't open patient records: the database blocks our platform role from patient tables. Our engineers, including Adewumi Studio's people working for us (annex B), can reach the database directly to fix a problem, restore a backup or move data, and they do so only to keep the service running or on the clinic's instructions.

7.3. If a staff member of the clinic asks us for help and shares their screen or a record with us, we use it only to give that help.

8. Security

8.1. We take appropriate technical and organisational measures to protect clinic personal data, taking into account the nature of the data, the risks to patients, and the state of the art. Annex A describes the measures in place today.

8.2. We may change the measures over time, as long as the overall level of protection doesn't go down.

9. Sub-processors

9.1. The clinic gives us general authorisation to engage sub-processors. The current list is on the sub-processors page, which is annex B to this DPA.

9.2. Before we add or replace a sub-processor, we update that page and email the clinic's admin at least 14 days in advance.

9.3. The clinic may object, on reasonable data protection grounds, by emailing us within those 14 days. We will then discuss a solution in good faith. If we can't find one, the clinic may end the affected service without penalty, and we refund any fees paid for the period after the end date.

9.4. We impose on each sub-processor, by written contract, data protection duties that give at least the same protection as this DPA. We remain responsible to the clinic for what our sub-processors do.

9.5. A provider the clinic itself connects to Stator, such as its own email account or its Google Calendar, is the clinic's own provider and is not our sub-processor (section 13.4).

10. Requests from patients and other data subjects

10.1. Patients and other data subjects have rights under the Act, including to be informed, to see their data, to have it corrected or deleted, to restrict or object to its use, and to have it moved.

10.2. The clinic answers these requests, because it is the controller. Stator gives the clinic the means for most of them: staff can correct records, the clinic's admin can export data, and a patient can send a records request to the clinic from the patient app.

10.3. If a request about the clinic's data reaches us, we pass it to the clinic within 2 working days and don't answer it ourselves, except to tell the person that we have passed it on.

10.4. Where the clinic needs our help to answer a request (for example, a copy of uploaded documents or a deletion the app can't do), we provide it within 5 working days of the clinic's written request.

11. Personal data breaches

11.1. If we become aware of a personal data breach affecting clinic personal data, we tell the clinic's admin without undue delay, and in any case within 48 hours of becoming aware of it. This gives the clinic time to meet its own duty to notify the Commission within 72 hours.

11.2. Our notice says, as far as we know at the time: what happened; the categories and approximate number of patients and records affected; the likely consequences; what we have done and propose to do; and who to contact. Where we don't know everything yet, we send what we know and follow up as we learn more.

11.3. We act straight away to contain the breach and limit its effects, and we help the clinic with its notices to the Commission and, where needed, to the patients affected.

11.4. We don't notify the Commission or patients about a breach of clinic data on the clinic's behalf unless the clinic asks us to or the law requires us to.

11.5. We keep a record of every personal data breach affecting clinic personal data, with its facts, effects and the action taken.

12. Helping the clinic comply

We give the clinic reasonable help, at no extra charge, with:

• data protection impact assessments of its use of Stator, and any consultation with the Commission that follows;
• its security obligations, through the measures in annex A;
• information it needs to answer the Commission or patients about how Stator processes their data.

13. Transfers outside Nigeria

13.1. The Stator database, with its live data, is hosted on a server in Nigeria, and the most recent 14 days of encrypted backups are kept on that server.

13.2. Some clinic personal data is transferred outside Nigeria to the sub-processors listed in annex B, as described in annex C: uploaded files and encrypted database backups (Cloudflare), and the email the app sends (Resend).

13.3. We transfer clinic personal data outside Nigeria only as described in annex C, with the safeguards described there, and only under data protection law. We will tell the clinic before we change where clinic personal data goes (section 9.2).

13.4. If the clinic connects an outside account, such as its Google Calendar or its own email account, data goes to that provider on the clinic's instruction, under the clinic's own agreement with it.

14. Information and audits

14.1. We make available to the clinic the information it reasonably needs to show that this DPA is being met, including this DPA, its annexes and our written answers to a security questionnaire, once a year.

14.2. Once a year, the clinic, or an independent auditor it appoints who is bound by confidentiality, may audit our compliance with this DPA, on 30 days' written notice, during working hours, and at the clinic's cost. An audit never gives access to other clinics' data. The clinic may audit more often if the Commission requires it or after a personal data breach affecting its data.

15. Return and deletion

15.1. While the agreement lasts, the clinic's admin can export its data from Stator (Exports, a beta feature) and can ask us for a full copy at any time.

15.2. When the agreement ends, the clinic may ask us, within 30 days, for a full copy of its data, including uploaded files, in a common readable format. We provide it within 14 days of the request.

15.3. 30 days after the end date, or after we deliver the copy if that is later, we delete clinic personal data from the live service and from the file store. Encrypted backups that contain it expire on their normal cycle: within 14 days on the server and within 90 days on Cloudflare R2. We keep only what the law requires us to keep, and confirm the deletion in writing if the clinic asks.

16. Records

We keep a written record of the processing we carry out for the clinic, as data protection law requires of a processor, and show it to the clinic or the Commission on request.

17. Liability

Each side's liability under this DPA is subject to the limits in the Terms of Service, clause 17, except where data protection law doesn't allow it to be limited.

18. Changes

We may update this DPA under clause 21 of the Terms of Service, or sooner where a change in data protection law requires it. We won't reduce the protection it gives clinic personal data without the clinic's agreement.

19. Law and disputes

This DPA is governed by the laws of the Federal Republic of Nigeria, as the Terms of Service are. A dispute about it is settled as clause 23 of the Terms of Service sets out: first by talking, then, if it isn't settled within 30 days, in the courts of Lagos State, which have jurisdiction.

20. Contact

Data protection questions about Stator go to hello@statorhealth.com, with "Privacy" in the subject. We haven't yet appointed a data protection officer; until we do, a director of Stator Health Ltd answers these questions.

Annex A: Security measures

These are the measures in place on 26 October 2026.

Keeping clinics apart

• Every record belongs to one clinic. The database enforces row-level security on each clinic's rows, so a read or change is checked against the clinic the user signed in to, on top of the app's own checks.
• The app connects to the database as a role that can't bypass those checks.
• Our platform admin role is blocked by the database from patient tables.

Access

• Every user signs in with their own login. Passwords are stored only as hashes, never in plain text.
• Each staff user has one role (admin, head physio, physio, front desk or accountant), and the role decides what they see. Physios don't see prices. A home-visit address shows only to the desk, the admin, the head physio and the physio booked for that visit. The accountant role sees only invoices and payments in exports.
• Locking or deactivating a staff account ends all of that person's sessions at once.
• Password reset links expire after one hour. Reset requests are rate limited, and the reset page gives the same answer whether or not an address has an account.
• Patients get into the patient app only by an invitation from the clinic. A family member gets access only with the patient's consent, recorded by the clinic, and the patient can remove them. By default the patient app shows no clinical notes.

Audit trail

• Changes to patients, notes, appointments, invoices, payments, HMO claims, documents and exercise programmes are written to an audit trail with who did it and when. Opening a patient's chart, exporting a PDF and downloading a CSV export are recorded too.
• The app can add to the audit trail but can't change or delete it.

Encryption

• All traffic to the app uses HTTPS, with certificates from Let's Encrypt and HTTP Strict Transport Security.
• The database is backed up every night. Each backup is encrypted with AES-256 as it is written, so an unencrypted copy never rests on disk. The key is not stored with the backups.
• Google Calendar tokens and the passwords of clinic email accounts connected to Stator are stored encrypted (AES-256-GCM).

Infrastructure

• The app, the database and the backup jobs run as separate containers on our server in Nigeria. Only the web server is reachable from the internet; the database and internal services are not.
• The monitoring tools run on the same server and sit behind a password.
• Uploaded files are stored under random identifiers, with no patient name in the file name.

Backups and recovery

• Encrypted backups are kept for 14 days on the server and copied every hour to Cloudflare R2, where they are kept for 90 days.
• We keep a written restore procedure.

People

• Access to the server, the database and the file store is limited to the people who build and run Stator, at Stator Health and at Adewumi Studio, each bound by confidentiality (section 7).

Annex B: Sub-processors

The sub-processors page is annex B. It lists each sub-processor, what it does, where it processes data and what data it receives.

One of them is Adewumi Studio, a software studio in Nigeria. It builds and maintains Stator's software, and its people help us run the service: deployments, server upkeep, backups and restores, and fixing problems. It works in Nigeria, on our instructions, under the confidentiality duty in section 7.

Annex C: Transfers outside Nigeria

Data sent to a provider the clinic connects itself (its own email account, or Google Calendar) goes there on the clinic's instruction, under the clinic's own agreement with that provider (section 13.4).