Harmovi Data Processing Agreement
Version 1 · effective 2026-10-29
1. Roles
You (the professional) are the controller of your clients' personal data. Harmovi is your processor. This agreement applies whenever Harmovi processes that data for you, and takes priority over the terms if they conflict.
2. What we process
| Subject matter and duration | Providing Harmovi to you while your account is open, plus the deletion period in §10 |
| Nature and purpose | Storing, organising, displaying and sending your client records, bookings, payments, reviews and booking emails, as you direct through the app |
| Types of personal data | Names, contact details, birthdays; booking and payment history; reviews and replies; consent records; treatment notes and health information (special category) |
| Data subjects | Your clients and prospective clients, who may include under-18s |
3. Your instructions
We process the data only on your documented instructions; using the app's features and settings, including reviews under the terms, counts as instructions. We don't use your clients' data for our own purposes, for advertising or to train AI models. You instruct us to keep anonymous counts across your account, such as bookings per week, to run and improve Harmovi: counts only, never an individual record. If we think an instruction breaks data protection law, we'll tell you. If the law requires us to process data otherwise, we'll tell you before we do, unless the law forbids it.
4. Confidentiality
Everyone at Harmovi who can access your clients' data is bound by confidentiality, and accesses it only to support you or keep the service running.
5. Security
We keep appropriate technical and organisational measures in place, including encryption in transit, separation between professionals' data, no client data in monitoring tools or AI services, and regular backups. We review them and won't reduce the overall level of protection.
6. Sub-processors
You give general authorisation for the sub-processors at harmovi.com/legal/sub-processors. We'll email you at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can't resolve it, you can close your account. Each sub-processor is bound by terms at least as protective as these, and we remain responsible for them.
7. International transfers
Your clients' data is stored in Western Europe. Where a sub-processor accesses it from outside the UK, a lawful transfer mechanism applies, such as the UK International Data Transfer Agreement or Addendum, or the UK–US data bridge.
8. Your clients' rights
The app lets you view, correct, export and erase a client's data yourself. If a client contacts us directly, we check who is asking, pass the request to you promptly, and don't respond ourselves unless you ask. We help with requests the app can't handle.
9. Breaches
If we become aware of a personal data breach affecting your clients' data, we tell you without undue delay, and in any case within 48 hours: what happened, what data and how many people are affected, the likely consequences, and what we're doing. We help you decide whether to notify the ICO and your clients.
10. End of the agreement
When your account closes, you have 90 days to export your data. Then we delete your clients' data, including from backups, unless the law requires us to keep it. We confirm deletion in writing on request.
11. Audits and help
We give you the information you reasonably need to show you're complying, provide a data protection impact assessment for you to adopt in the app, and help with your own DPIA or an ICO consultation. You may audit us once a year with 30 days' notice, at your cost and by a method we agree, for an account holding real client data, or sooner if a breach makes it urgent.
12. Liability
As set out in the terms, §8, including its £5,000 limit for breaches of our data protection duties.