Sinew data processing agreement
UK GDPR Article 28 (and EU GDPR where it applies). Forms part of the Sinew terms of service.
Parties: the agency that installs Sinew (Controller) and PJM Apps Ltd (Processor).
1. Scope
| Item | Detail |
|---|---|
| Subject matter | Providing Sinew: client health scoring, alerts, digests, call summaries and briefs |
| Duration | While Sinew is installed, plus the 30-day deletion period |
| Nature of processing | Reading activity from the Controller's HighLevel sub-accounts; calculating daily totals and scores; storing them; generating AI summaries and briefs; sending emails the Controller sets up |
| Purpose | Helping the Controller keep its clients, as the Controller instructs through Sinew's settings |
| Data subjects | The Controller's staff; the Controller's clients' staff (contact names in the Controller's own CRM, people on recorded calls); the Controller's clients' leads and customers, only transiently |
| Personal data stored | Agency staff names, IDs, roles and chosen alert emails; client contact IDs and names in the Controller's own CRM; call summaries (without patient names or health details) |
| Personal data processed but not stored | Lead and customer contact records, message metadata and appointment metadata (read in memory, reduced to daily counts, then discarded); call transcripts (held encrypted only until summarised, and never more than 24 hours) |
| Special category data | Not stored. A call transcript may incidentally contain health information about a patient; patterned identifiers (emails, phone and ID numbers, dates of birth) are removed before it is sent to Anthropic, it is processed only to produce a summary that excludes health details, then deleted |
2. Processor obligations
The Processor will:
- Process personal data only on the Controller's documented instructions (these terms, the settings the Controller chooses in Sinew, and written instructions), and tell the Controller if it believes an instruction breaks data protection law.
- Ensure everyone processing the data is bound by confidentiality.
- Apply the security measures in Annex A.
- Use sub-processors only as in Section 3.
- Help the Controller answer data subject requests and meet its obligations on security, breach notification, impact assessments and prior consultation, taking into account what the Processor can see.
- Notify the Controller without undue delay and within 48 hours of becoming aware of a personal data breach affecting the Controller's data, with the information then available.
- On uninstall or termination, delete the Controller's data within 30 days, and confirm on request. Daily backups are kept for 7 days, so a deleted record is gone from every backup within 7 days of its deletion. Call transcripts waiting to be summarised are kept in a separate store that is never backed up, so no copy of a transcript outlives its 24 hours.
- Make available the information needed to show compliance, and allow audits by the Controller or its auditor with 30 days' notice, no more than once a year unless a breach or regulator requires.
3. Sub-processors
The Controller authorises the sub-processors listed at https://sinewcsm.web.app/legal/sub-processors.html. The Processor will give at least 30 days' notice of a new sub-processor by email to the account owner; the Controller may object on reasonable data protection grounds, and if no solution is found may end the agreement and receive a refund of prepaid fees for the unused period. The Processor remains responsible for its sub-processors.
4. International transfers
Data is stored in the UK (London). Where a sub-processor processes it outside the UK, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework where the sub-processor is certified (Resend, Sentry), or by the EU Standard Contractual Clauses with the UK Addendum (Anthropic, and Resend as well).
5. US health data
Where the Controller's clients are subject to HIPAA, the parties will agree in writing whether a business associate agreement is needed before call summaries are used for those clients. Call summaries can be switched off per client.
Annex A: security measures
- Location: all stored data in Google Cloud
europe-west2(London). - Encryption: in transit (TLS) and at rest (Google-managed). HighLevel access tokens are additionally envelope-encrypted: AES-256-GCM data keys wrapped by Cloud KMS, with integrity checks on every unwrap.
- Access control: each user signs in through HighLevel's encrypted user context and receives a short-lived session limited to their own agency; the database's security rules allow reads only within that agency and allow no writes from browsers at all.
- Data minimisation: lead and customer data is reduced to daily counts in memory; response schemas drop message text, names and contact details before any processing.
- Least privilege: the smallest set of HighLevel permissions; writes limited in code to notes and tasks in the Controller's own sub-account.
- Integrity of inputs: webhooks verified with HighLevel's Ed25519 signature over the raw request body, with replay protection.
- Logging: structured logs and error reports carry IDs only; no names, emails, message text or transcripts.
- Secrets: held in Google Secret Manager, never in code or logs; automated secret scanning in CI.
- Software supply chain: dependency audit on every change, failing on high or critical issues; new package versions must be at least two weeks old.
- Testing: security rules, encryption, signature checks and data-minimisation rules are covered by automated tests on every change. An independent security review happens before public listing (plan 7.5).
PJM Apps Ltd, registered in Scotland, company number SC893991. Questions: privacy@usesinew.com.