US customers: this DPA does not apply to you. Your data is protected under your StoriiCare agreement and, where applicable, our HIPAA Business Associate Agreement.
This Data Processing Agreement (“DPA”) sets out how we process personal data on behalf of StoriiCare customers outside the United States. It forms part of the customer’s agreement with us and applies without a separate signature.
Key Terms
- Who this DPA covers: Organizations established outside the United States that use StoriiCare under an Agreement. US customers are covered by our Business Associate Agreement. Storii, our consumer life story service, is covered by our privacy policy.
- Controller: The customer named in the Agreement (“Customer”).
- Processor: The entity that signed the Agreement: Lifelinked Ltd, a company registered in Scotland (SC490896), 5 South Charlotte Street, Edinburgh, EH2 4AN; or Storii, Inc., 210 S Ellsworth Ave #317, San Mateo, CA 94401, USA (“we”, “us”, “our”). Both trade as StoriiCare and are wholly owned subsidiaries of Storii Global, Inc., a Delaware corporation.
- Data protection contact: Lifelinked Ltd’s Data Protection Officer: Data Privacy Services, 124 City Road, London, EC1V 2NX, info@dataprivacyservices.co.uk (please reference StoriiCare). For Storii, Inc. and any other privacy questions: privacy@storii.com.
- Services: The StoriiCare care management and electronic health record platform, including Storii Family, and related support, as provided under the Agreement.
- Agreement: The services agreement, order form or terms under which the Customer uses the Services.
- Term: From the start of the Agreement for as long as we process Customer Personal Data.
- Hosting and backups: The region for the Customer’s country listed under “Where your data is hosted”.
- Breach notification: Within 48 hours of us becoming aware of a Personal Data Breach.
- Sub-processor notice: 14 days before a new Sub-processor processes Customer Personal Data.
- Country terms: The Part of the Schedule for the Customer’s country.
- Liability: As limited in the Agreement.
- Governing law: The law that governs the Agreement, unless the Schedule says otherwise.
- Version: Version 1.0, effective 5 November 2026.
Where your data is hosted
We host each Customer’s StoriiCare platform data, including backups, on Amazon Web Services in the region for the Customer’s country, and keep it there. The one exception is AWS US West (N. California), where data is also replicated to AWS US East (N. Virginia) for disaster recovery. Some Sub-processors process limited data in other locations, as shown in Annex 3.
- United Kingdom (England, Scotland, Wales, Northern Ireland): AWS Europe (London). Country terms: Schedule Part A.
- European Economic Area, including Malta and Ireland: AWS Europe (Ireland). Country terms: Schedule Part A.
- Australia: AWS Asia Pacific (Sydney). Country terms: Schedule Part B.
- Canada: AWS Canada (Central). Country terms: Schedule Part C.
- Mexico: AWS US West (N. California), replicated to AWS US East (N. Virginia) for disaster recovery. Country terms: Schedule Part D.
- Malaysia: AWS Asia Pacific (Sydney). Country terms: Schedule Part E.
- Qatar and other Middle East countries: AWS Europe (Frankfurt). Country terms: Schedule Part F (Qatar).
- Any other country: The AWS region we operate that is closest to the Customer, confirmed to the Customer in writing before onboarding. Core terms only.
1. Scope, incorporation and definitions
1.1 Incorporation. This DPA forms part of the Agreement and applies whenever we process Customer Personal Data in providing the Services. It applies without a separate signature. On request, we will provide a countersigned copy.
1.2 Definitions. In this DPA:
- “Applicable Data Protection Law” means all laws on the protection of personal data that apply to the processing under this DPA, including those named in the Schedule.
- “Customer Personal Data” means information about an identified or identifiable individual that is protected under Applicable Data Protection Law and that we process on the Customer’s behalf under the Agreement.
- “Hosting Region” means the region in “Where your data is hosted” that applies to the Customer and the relevant Service.
- “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- “Schedule” means the country terms at the end of this DPA.
- “Sensitive Data” means health data and any other category of Customer Personal Data given special protection under Applicable Data Protection Law.
- “Services” means the StoriiCare platform, including Storii Family, and related support, as described in the Key Terms.
- “Storii Group” means Storii Global, Inc. and its wholly owned subsidiaries Storii, Inc. and Lifelinked Ltd.
- “Sub-processor” means any third party, including a member of the Storii Group, that we engage to process Customer Personal Data.
- “Supervisory Authority” means the data protection regulator with authority over the Customer.
- “Trust Page” means compliance.storii.com, or any successor page.
1.3 Roles. The Customer acts as controller and we act as processor. Where Applicable Data Protection Law uses other terms for these roles (for example organization and service provider, or responsable and encargado), this DPA is read accordingly. If the Customer is itself a processor for another controller, we act as its sub-processor.
1.4 Precedence. Capitalized terms not defined here have the meaning given in the Agreement. On the processing of Customer Personal Data, the Schedule prevails over the body of this DPA, and this DPA prevails over the Agreement.
2. Customer obligations
The Customer is responsible for:
- (a) Lawful basis. Providing all notices and obtaining all consents, permits and legal bases required under Applicable Data Protection Law for us to process Customer Personal Data. This includes any express consent or regulatory permit needed for Sensitive Data.
- (b) Lawful instructions. Ensuring its instructions comply with Applicable Data Protection Law.
- (c) Configuration. Configuring the Services appropriately, including user permissions and family portal access, and deciding which optional features to enable.
- (d) Controller chain. Where the Customer acts as processor for another controller, confirming it is authorized to appoint us and passing on that controller’s instructions.
3. Our obligations
3.1 Instructions. We will process Customer Personal Data only on the Customer’s documented instructions, unless required otherwise by law that applies to us. In that case we will inform the Customer first, unless the law prohibits this. The Agreement, this DPA and the Customer’s configuration and use of the Services are the Customer’s complete instructions. We will promptly tell the Customer if, in our opinion, an instruction infringes Applicable Data Protection Law.
3.2 Confidentiality. We will ensure that everyone authorized to process Customer Personal Data is bound by a contractual or statutory duty of confidentiality, and that access is limited to personnel who need it to provide the Services.
3.3 Individual rights. Taking into account the nature of the processing, we will assist the Customer with appropriate technical and organizational measures in responding to requests from individuals exercising their rights. If we receive a request directly, we will forward it to the Customer and will not respond except on the Customer’s instruction.
3.4 Assistance. Taking into account the nature of the processing and the information available to us, we will reasonably assist the Customer with security, breach notification, impact assessments and consultations with the Supervisory Authority, as required by Applicable Data Protection Law.
3.5 No sale or other use. We will not sell Customer Personal Data or use it for any purpose other than providing the Services.
3.6 Anonymized data and AI. We may use data derived from the Services only where it has been anonymized so that it is no longer Customer Personal Data, and will not attempt to re-identify it. We will not use Customer Personal Data to train artificial intelligence or machine learning models, and will not permit our Sub-processors to do so.
3.7 Compliance information. On request, we will make available the information reasonably necessary to demonstrate our compliance with this DPA.
4. Sub-processors
4.1 Authorization. The Customer gives general written authorization for us to engage the Sub-processors listed in Annex 3 and on the Trust Page, including members of the Storii Group.
4.2 Notice of changes. Customers can subscribe to Sub-processor notifications through the Trust Page or by emailing support@storii.com. We will notify subscribed Customers at least 14 days before a new Sub-processor processes Customer Personal Data.
4.3 Feature-specific Sub-processors. Sub-processors marked “where enabled” process Customer Personal Data only when the Customer enables the related feature. The Customer can avoid such a Sub-processor by not enabling, or disabling, that feature.
4.4 Objections. Where the Schedule gives the Customer a right to object to a new Sub-processor, the Schedule sets out how objections work. Otherwise, a Customer that does not accept a new Sub-processor may stop using the related feature or decline to renew the Agreement.
4.5 Urgent replacement. We may replace a Sub-processor without prior notice where urgently needed for the security or continuity of the Services, and will notify subscribed Customers promptly afterward. Clauses 4.2 to 4.4 then apply.
4.6 Flow-down and liability. We will engage each Sub-processor under a written contract with data protection obligations no less protective than this DPA, including sufficient guarantees of appropriate technical and organizational measures. We remain liable to the Customer for each Sub-processor’s performance of those obligations.
5. Hosting, personnel access and international transfers
5.1 Hosting Region. We store Customer Personal Data in the StoriiCare platform, including its database, file storage and backups, in the Hosting Region, except for the disaster recovery replication described in “Where your data is hosted”. We will not move an existing Customer’s platform data to another region without that Customer’s prior written agreement. The Sub-processors in Annex 3 may process limited Customer Personal Data in the locations and for the purposes shown there.
5.2 Personnel access. Our support, engineering and account management team works from several countries, listed on the Trust Page. Team members access Customer Personal Data only where needed to provide the Services, using the controls in Annex 2, including multi-factor authentication and logging. In the United States, only our Chief Executive Officer and Chief Operating Officer access Customer Personal Data, and only where the Customer requests support that requires it. Team members engaged through employer-of-record or contractor platforms work exclusively under our instructions and controls. Where one of them accesses Customer Personal Data from a country without an adequacy decision, we treat them as a Sub-processor, put the EU Standard Contractual Clauses and the UK International Data Transfer Addendum in place with them, and list their country on the Trust Page (Annex 3).
5.3 Transfers. Any transfer of Customer Personal Data, or remote access to it, from outside the country of the Hosting Region will comply with Applicable Data Protection Law and the Schedule. On request, we will provide a copy of the safeguards relied on, with commercially sensitive terms redacted.
5.4 Government requests. If we receive a legally binding request from a public authority for Customer Personal Data, we will, where legally permitted, promptly notify the Customer, challenge the request where we have reasonable grounds, disclose only the minimum required, and keep a record of the disclosure.
6. Security, breach notification and audits
6.1 Security. We will implement and maintain the technical and organizational measures in Annex 2, which ensure a level of security appropriate to the risk. We may update these measures provided the overall level of protection is not reduced.
6.2 Personal Data Breach. We will notify the Customer without undue delay, and in any event within 48 hours, of becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include, as far as known: the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available and will cooperate with the Customer’s investigation and any notification to the Supervisory Authority or individuals. Notification is not an admission of fault or liability.
6.3 Audit reports. Our compliance with this DPA will ordinarily be demonstrated by our current ISO/IEC 27001:2022 certificate and Statement of Applicability, SOC 2 Type 2 report, Cyber Essentials Plus certificate, and written answers to a reasonable security questionnaire. Reports are available through the Trust Page, subject to confidentiality terms.
6.4 Audits. Where the Customer reasonably requires more, or where required by a Supervisory Authority or following a Personal Data Breach, the Customer or an independent auditor bound by confidentiality may carry out an audit. Audits will take place no more than once a year (except where required by a Supervisory Authority or following a breach), on at least 30 days’ written notice, during normal business hours, and at the Customer’s cost.
7. Deletion, liability, changes to this DPA and general terms
7.1 Return and deletion. On termination or expiry of the Agreement, we will, at the Customer’s choice, return Customer Personal Data in a commonly used format and/or delete it, unless law requires storage. Any archive or retention period in the Agreement applies only where the Customer has not instructed deletion. We will delete Customer Personal Data within 30 days of a written instruction and confirm deletion in writing on request. Backup copies of deleted data are kept for up to 30 days, remain protected under this DPA during that time, and are then permanently deleted.
7.2 Liability. Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent such a limitation is not permitted by Applicable Data Protection Law.
7.3 Changes to this DPA. We may update this DPA by posting a new version at storiicare.com/dpa at least 30 days before it takes effect and notifying Customers by email. A change that materially reduces the protection of Customer Personal Data applies to an existing Customer from its next renewal, unless required sooner by law or a Supervisory Authority. Changes to Sub-processors follow clause 4, and changes to the Hosting Region follow clause 5.1. Previous versions are available on request.
7.4 Signed agreements. Where the Customer and we have signed a data processing agreement, the signed agreement applies instead of this DPA for as long as it remains in force.
7.5 Survival. Any provision of this DPA that by its nature should survive termination of the Agreement will do so.
7.6 Notices. Notices under this DPA may be given by email. Notices to us go to support@storii.com.
7.7 Governing law and disputes. This DPA is governed by the same law as the Agreement, and disputes are resolved under the Agreement’s dispute resolution clause, except where the Schedule or any Standard Contractual Clauses provide otherwise. Nothing in this DPA limits an individual’s rights or the powers of a Supervisory Authority.
Annex 1: Details of processing
- Subject matter: Provision of the StoriiCare care management and electronic health record platform to the Customer’s care services.
- Nature and purpose: Hosting, storage and processing of records to support care planning, medication and medical care management, attendance and scheduling, staff management, notes, assessments and forms, billing and payments, claims and eligibility checks where enabled, family engagement (Storii Family), customer support, notifications, and AI-assisted features where enabled.
- Categories of individuals: Clients, residents and service users; their family members, representatives and emergency contacts; the Customer’s staff, contractors and authorized users; visitors; healthcare practitioners recorded in client files.
- Types of Customer Personal Data: Identification and contact details; demographic data; care plans, notes, assessments and forms; attendance, scheduling and visitor logs; billing and payment data; photos and media uploaded by users; messages; staff records; support call recordings; login, device and usage data.
- Sensitive Data: Health data relating to clients (physical and mental health, medications, vital signs, incidents); may include religious belief or ethnic origin where recorded by the Customer.
- Duration: The term of the Agreement plus any retention period under clause 7.1.
- Frequency: Continuous for the duration of the Agreement.
Annex 2: Security measures
The information security management system of Storii Global, Inc., which covers the StoriiCare platform and the teams that deliver it, is certified to ISO/IEC 27001:2022 (certificate 123269, Prescient Security, valid to 24 May 2029). StoriiCare is also independently assessed under SOC 2 Type 2 and Cyber Essentials Plus. Measures include:
- Encryption: all data encrypted in transit (TLS) and at rest.
- Access control: role-based access on least privilege; multi-factor authentication for staff; quarterly access reviews; customer-configurable permission levels and automatic session timeout.
- Monitoring and logging: AWS GuardDuty, Security Hub, Detective, Inspector, WAF and CloudTrail; an audit trail of user actions visible to the Customer in the Timeline feature.
- Vulnerability management: continuous scanning and annual independent penetration testing.
- Resilience: automated backups to separate locations within the Hosting Region, kept for 30 days, with disaster recovery replication only as described in “Where your data is hosted”; auto-scaling infrastructure.
- People: background checks where lawful, confidentiality obligations, and annual security and data protection training.
- Incident response: a documented incident response plan, tested annually.
- Vendor management: security and data protection due diligence on all Sub-processors.
More detail is available on the Trust Page.
Annex 3: Sub-processors
The current list is maintained on the Trust Page. As of the version date, it is:
Platform services
- Amazon Web Services: Hosting, database and file storage; sending platform emails (Amazon SES). Location: the Customer’s Hosting Region (and disaster recovery region, where applicable); platform emails are sent from Ireland (EU).
- Anthropic: Skye AI assistant, AI care planning, note grammar and translation, where enabled. Location: United States.
- OpenAI: AI model provider for AI features, where enabled. Location: United States.
- ElevenLabs: AI support agent (voice and chat). Location: United States.
- Stripe (Connect): Payment processing for client billing, where enabled. Location: United States.
- Stedi: EDI clearinghouse for claims and eligibility checks with US payers, where enabled. Location: United States.
- Twilio: SMS notifications, where enabled. Location: United States.
- PostHog: Product analytics (user-level usage data). Location: United States.
Support and operations (incidental access to Customer Personal Data)
- Storii Group (Storii Global, Inc., Storii, Inc., Lifelinked Ltd): Support, engineering and account management. Location: countries listed on the Trust Page; in the United States, senior management only (clause 5.2).
- Individual contractors engaged by the Storii Group: Support, engineering and account management, under our instructions and controls (clause 5.2). Location: countries without an adequacy decision, as listed on the Trust Page; details on request.
- Front: Support email and ticketing. Location: United States.
- Zoom: Training and support calls, including screen shares that may show Customer Personal Data. Location: United States.
- Atlassian (Jira): Bug tickets, which may include screenshots or records. Location: United States.
- Slack: Internal communications about support requests. Location: United States.
- Google Workspace (including Google Drive): Email, documents and support call recordings. Location: United States / EU.
- Data Privacy Services (Data Privacy and Data Security Services Ltd): Outsourced Data Protection Officer for Lifelinked Ltd, including advice on Personal Data Breaches and individual rights requests. Location: United Kingdom / Cyprus (EU).
Schedule: Country terms
Part A: United Kingdom and European Economic Area
A1 Scope. This Part applies where the Customer is subject to the UK GDPR and the Data Protection Act 2018, or to Regulation (EU) 2016/679 (the “EU GDPR”) and the national law that supplements it (for example the Data Protection Act, Cap. 586, in Malta).
A2 Article 28. This DPA contains the terms required by Article 28(3) of the UK GDPR and EU GDPR. It is a contract in electronic form under Article 28(9). The Customer’s documented instructions include instructions on international transfers.
A3 Objection to new Sub-processors. The Customer may object in writing to a new Sub-processor within the 14-day notice period in clause 4.2, on reasonable grounds relating to data protection. If it does not object, the Sub-processor is deemed approved. If it objects, we may, at our option: (a) not use the Sub-processor for the Customer’s data; (b) take steps that address the objection; or (c) offer a change to the Services or their configuration that avoids the Sub-processor. If none of these resolves the objection within 30 days, the Customer may terminate only the Services that cannot be provided without that Sub-processor, by written notice. This is the Customer’s sole and exclusive remedy, and no refund of fees is due.
A4 Transfers.
- Transfers from the EEA to Lifelinked Ltd or other Storii Group members in the United Kingdom rely on the European Commission’s adequacy decision for the United Kingdom.
- Transfers outside the UK and EEA, including remote access under clause 5.2, rely on an adequacy decision or on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with the UK International Data Transfer Addendum for UK data, together with any supplementary measures identified in a transfer impact assessment.
- Where the entity in the Agreement is Storii, Inc., the EU Standard Contractual Clauses, Module Two (controller to processor), and the UK Addendum are incorporated into this DPA by reference, with the Customer as data exporter and Storii, Inc. as data importer. In Clause 9, Option 2 applies with the notice period in clause 4.2. In Clause 17, Irish law applies, and in Clause 18 the courts of Ireland. Annexes I and II of those clauses are completed by Annexes 1 and 2 of this DPA.
- Transfers by us to Sub-processors outside the UK and EEA rely on Module Three (processor to processor) or another valid mechanism.
A5 Breach. The 48-hour notice in clause 6.2 is designed to let the Customer meet its 72-hour duty to notify the Supervisory Authority.
Part B: Australia
B1 Laws. Applicable Data Protection Law includes the Privacy Act 1988 (Cth), the Australian Privacy Principles (“APPs”), the Notifiable Data Breaches scheme in Part IIIC of that Act, and any applicable state or territory health records law.
B2 Handling standard. We will handle Customer Personal Data in a way consistent with the APPs, including when it is accessed from outside Australia under clause 5.2 or by Sub-processors. This supports the Customer’s obligations under APP 8.
B3 Breach assessment. In addition to clause 6.2, we will promptly give the Customer the information it reasonably needs to complete, within 30 days, its assessment of whether a suspected breach is an eligible data breach, and to prepare any statement to the OAIC.
Part C: Canada
C1 Laws. Applicable Data Protection Law includes the Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial privacy or health information law.
C2 Roles. The Customer is the organization accountable for Customer Personal Data or, where applicable, the health information custodian. We are its service provider or agent and will use Customer Personal Data only for the purposes for which the Customer could use it.
C3 Comparable protection. We will protect Customer Personal Data to a level comparable to the protection it would receive if it had not been transferred to us.
C4 Foreign access. The Customer acknowledges that Customer Personal Data may be accessed from the locations in clause 5.2 and Annex 3, and may be subject to lawful access by courts, law enforcement and national security authorities in those countries. We will help the Customer explain this to individuals.
C5 Breach. In addition to clause 6.2, we will give the Customer the information it reasonably needs to assess whether a breach creates a real risk of significant harm, to notify the Privacy Commissioner and individuals, and to keep breach records.
C6 Health information custodians. Where the Customer is a health information custodian under provincial law, we will comply with the obligations that law places on the custodian’s agents or electronic service providers.
Part D: Mexico
D1 Laws. Applicable Data Protection Law includes the Federal Law on the Protection of Personal Data Held by Private Parties in force since 21 March 2025 (LFPDPPP) and its regulations.
D2 Roles. The Customer is the responsable and we are the encargado. Communications of Customer Personal Data between us under this DPA are remissions, not transfers, including to our hosting in the United States.
D3 Encargado obligations. We will process Customer Personal Data only on the Customer’s instructions, apply the security measures in Annex 2, keep it confidential, delete it at the end of the relationship under clause 7.1, and not transfer it except as instructed or required by law.
D4 Subcontracting. The Customer authorizes subcontracting to the Sub-processors under clause 4. Each Sub-processor takes on the same obligations as we do.
D5 Customer duties. The Customer is responsible for its privacy notice and for obtaining any express consent required to process Sensitive Data, including health data.
D6 Language. A Spanish version of this DPA is available. If the versions conflict, the English version prevails unless Mexican law requires otherwise.
Part E: Malaysia
E1 Laws. Applicable Data Protection Law includes the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024, and the Commissioner’s guidelines.
E2 Security Principle. We will comply with the Security Principle under the Act in processing Customer Personal Data.
E3 Breach. The 48-hour notice in clause 6.2 is designed to let the Customer notify the Personal Data Protection Commissioner within 72 hours and affected individuals within the required timeframe. We will give all reasonable assistance with those notifications.
E4 Customer duties. The Customer is responsible for notices and consents to individuals, and for confirming that transfers under clause 5 meet the Act’s cross-border transfer rules.
Part F: Qatar
F1 Laws. Applicable Data Protection Law includes Law No. 13 of 2016 on the Protection of Personal Data Privacy (PDPPL) and related guidance.
F2 Processor contract. This DPA is the written contract by which the Customer verifies our compliance as processor. It sets out the nature, purpose and duration of processing, the security measures, and how individuals’ rights are supported.
F3 Special nature data. The Customer is responsible for obtaining any permission required to process personal data of a special nature, including health data.
F4 Breach. We will notify the Customer under clause 6.2 so the Customer can meet its own notification duties.
Version 1.0, effective 5 November 2026
