Data processing terms

These terms apply where Mosaic processes personal data on behalf of a care provider (controller), and satisfy Article 28 of the UK GDPR. A signed data processing agreement will accompany each order form; company details to be confirmed.

• Subject matter: behaviour recording, PBS planning and reporting.
• Data subjects: people supported by the controller (pseudonymised) and its staff.
• Categories: pseudonymised identifiers, health and behaviour data (special category), staff account data.
• Duration: the term of the agreement plus the agreed retention period.

• Process only on documented instructions.
• Ensure staff are bound by confidentiality.
• Apply appropriate technical and organisational security measures (Article 32).
• Engage sub-processors only with prior notice and equivalent contractual terms.
• Help the controller respond to data subject requests and DPIAs.
• Notify the controller without undue delay, and within 24 hours, of a personal data breach.
• Delete or return data at the end of the service, and make available information needed to show compliance, including audits.

Cloud hosting and database, transactional email, and AI model providers. A current list with locations is available to customers on request.