Data processing agreement

How we handle your clients’ data

Version 1.0, effective 15 October 2026

This agreement is between the practice that uses Atell (the Customer) and GRD Technologies Ltd, trading as Atell, a company registered in Ireland with company number 822223 (Atell, we, us). Our full company details are on the company information page.

Article 28 of the General Data Protection Regulation (GDPR) requires a written agreement whenever one organisation processes personal data on behalf of another. When you use Atell to keep records about your clients, we process that data for you, so this agreement applies.

A practice admin accepts this agreement in the Atell app, under Settings, Organisation, on behalf of the practice. We record who accepted it, when, and which version. You can also ask us for a copy to sign.

1. Who does what

You are the controller. You decide whose information goes into Atell, why, what you write about them, and how long you keep your clinical records.

We are the processor. We process that information only to provide Atell to you, and only on your documented instructions. Using Atell as it is designed, together with this agreement and anything you ask us for in writing, are your instructions. If we believe an instruction would break data protection law, we will tell you and may decline to carry it out.

2. What we will do

• Use your data only to provide Atell to you, as described in Annex 1.
• Never use your clients’ data to train or improve any machine-learning model, never sell it, and never use it for marketing.
• Keep it confidential, and make sure everyone with access to it is bound by confidentiality.
• Protect it with the measures in Annex 2.
• Use other companies (sub-processors) only as set out in section 5.
• Help you respond when someone asks to exercise their data protection rights (section 7).
• Help you meet your own duties on security, breach notification and data protection impact assessments, as far as we reasonably can given what we know.
• Tell you about a personal data breach affecting your data without undue delay, and within 48 hours of becoming aware of it, with the information we have at the time (section 6).
• Delete or return your data when you stop using Atell (section 8).
• Give you the information you need to show that we keep to this agreement, and allow audits (section 9).

3. What you are responsible for

• Having a lawful basis for processing your clients’ information, including their health information, and for recording them.
• Obtaining and recording consent where you rely on it. Atell gives you the tools: consent is recorded for each client and kept as a history that cannot be edited, and Atell will not record or upload a session for a client without recording consent in force.
• Telling your clients how their information is used, in your own privacy notice.
• Deciding how long to keep your clinical records, and who in your practice can use Atell.
• Not typing client details into Atell’s AI drafting feature, which is for describing a report template, not a client (Annex 3).

4. Health information, children and vulnerable adults

Both parties recognise that the data in Atell is health data, a special category under Article 9 of the GDPR, and that it often concerns children or adults who may be vulnerable. It therefore needs a higher standard of care, and the measures in Annex 2 are set with that in mind.

5. Sub-processors

You authorise us to use the sub-processors listed in Annex 3. We will tell you at least 30 days before we add or replace one. If you object on reasonable data protection grounds and we cannot resolve it, you may stop using Atell and we will refund any fees you have paid for the period after you stop.

We require each sub-processor, by contract, to protect your data to the standard in this agreement, and we remain responsible to you for what they do.

Your clients’ data is stored in the European Economic Area. We will not transfer it outside the EEA unless the transfer is protected by a valid mechanism under the GDPR, such as an adequacy decision or the European Commission’s standard contractual clauses.

6. Personal data breaches

If we become aware of a breach affecting your data, we will tell you within 48 hours, by email to your practice admin. We will describe what happened, the data and people likely to be affected, the likely consequences, and what we are doing about it, and keep you updated as we learn more. This is so you can meet your own duty to tell the Data Protection Commission within 72 hours where required.

7. Requests from clients and their families

If a client, parent, guardian or anyone else contacts us directly about their data, we will not answer on your behalf. We will pass the request to you without undue delay and help you respond. You can see, correct and delete a client’s record yourself in Atell. If you need a copy of a client’s data in a portable form, ask us and we will provide it within 30 days.

8. Retention, return and deletion

• Session recordings are deleted automatically. Where the client’s recording consent is in force, a recording is kept for the period on that consent (your practice sets the default, 365 days unless you change it). Where consent was never given, was refused or has been withdrawn, it is deleted 30 days after the session.
• Everything else is kept for as long as you keep it in Atell. Your clinical records are yours to retain or delete.
• When you stop using Atell, you can ask us to return a copy of your data, and we will then delete it. We will delete your data within 30 days of your account ending, unless the law requires us to keep it.
• Backups are kept for at most 35 days, so deleted data is gone from our backups within 35 days of being deleted from Atell.

9. Audits

We will give you the information you reasonably need to show that we keep to this agreement. You may audit our compliance once a year, with 30 days’ notice and at your own cost, in a way that does not give access to other customers’ data. You may audit more often if a supervisory authority requires it or after a breach affecting your data.

10. Our staff

Only people who need access to provide or support Atell can reach your data, and they are bound by confidentiality that continues after they stop working with us. We do not look at client records except to provide the service, to fix a problem you have asked us to fix, or where the law requires it.

11. Changes, term and law

This agreement lasts for as long as we process personal data for you. If we change it in a way that affects your data, we will publish the new version here, tell your practice admin, and ask them to accept it in the app. We will not reduce the protection your data has without your agreement.

Nothing in this agreement limits any liability that cannot be limited by law. This agreement is governed by Irish law, and the Irish courts have jurisdiction.

Annex 1: the processing

Subject matter

Providing Atell, software for speech and language therapy practices

Duration

For as long as you use Atell, plus the deletion period in section 8

Purpose

Keeping client records, case histories and session notes; recording therapy and assessment sessions and analysing them to find where a client attempted each target word; producing reports, letters and invoices; scheduling, and appointment reminders to the therapist; sending home practice links; managing consent

Types of data

Clients’ names, dates of birth, contact and address details, and GP, school and insurer details; case histories, presenting concerns, session notes, goals, scores and assessment results; audio recordings of sessions and their analysis; consent records; reports, letters and documents you upload; appointments and invoices. For your own staff: names, email addresses, professional registration numbers, signature images, and a short voice sample used to tell the therapist’s voice apart from the client’s in recordings

People the data is about

Your clients, children and adults; their parents, guardians and family members; your therapists and staff

Special categories

Yes: health data

Annex 2: how we protect your data

• Hosted in the EU. Atell runs on Microsoft Azure in the European Union. Your data stays there.
• Each therapist sees only their own clients. Colleagues in the same practice cannot see each other’s clients. When a client moves between therapists, a permanent handover record is kept.
• Recordings are private. They are stored in private storage and reached only through signed links that expire after an hour. They are never public.
• Encrypted in transit (HTTPS) and at rest.
• Analysis runs on our own servers. Session recordings are never sent to an outside AI service.
• No recording without consent, enforced by the server, not just the screen.
• Automatic deletion of recordings, by a job that runs every day.
• Signed notes are locked. Later changes are added as amendments, showing who made them and why.
• Passwords are stored only as secure hashes, and sign-in sessions expire.
• Restricted administration. Our administration tools are not reachable from the internet. Access to the servers is limited to named people using individual keys.
• Backups are encrypted, stored in the EU and kept for at most 35 days.

Annex 3: sub-processors

Microsoft Ireland Operations Ltd (Azure)

Hosting, database and file storage, in the EU. Holds all client data

Google Ireland Ltd (Workspace)

Sending email from Atell: account invitations, password resets, appointment reminders to the therapist (which include the client’s name and the session notes), home practice links to the client’s contact email, and letters and reports you choose to send to the client or their parent, a GP, a school or another recipient. Each recipient gets their own email, holding no client details, only a link to the document that expires after 30 days, can be withdrawn by you at any time, and records each time it is opened

Google Ireland Ltd (Gemini API)

Optional AI drafting of report templates. Receives only the description the therapist types, never client records or recordings, and not used by Google to train its models

Stripe Payments Europe Ltd

Billing your Atell subscription. Holds your practice’s billing details only, no client data

Our website, atell.ie, is hosted by Cloudflare, which also provides our domain name service. No client data passes through Cloudflare.

Questions

Email hello@atell.ie.