ISOSTOCK DATA PROCESSING ADDENDUM (DPA)

This Data Processing Addendum (the Addendum) forms part of the agreement between the Service User (the Controller) and Gillett Limited (the Processor), in conjunction with:

Changes to contractual obligations under this Addendum take effect in accordance with the applicable agreement and agreed variation arrangements.

DEFINITIONS

In this Addendum and the associated documents, the following terms have the following meanings:

a) Controller, processor, data subject, personal data, processing and special categories of personal data have the meanings given in the UK General Data Protection Regulation (UK GDPR).

b) Data Protection Law means the UK GDPR, the Data Protection Act 2018 and other applicable UK data protection legislation.

c) Data means personal data processed by the Processor on the Controller's behalf in connection with IsoStock Cloud, including information entered into or generated through the service and copies supplied for configuration or support.

d) Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Data transmitted, stored or otherwise processed.

RELATIONSHIP OF THE PARTIES

The Controller subscribes to IsoStock Cloud and appoints Gillett Limited to process Data on its behalf for the purposes described in this Addendum, the service agreement and the IsoStock Cloud Privacy and Consent Statement. Each party must comply with the obligations that apply to it under Data Protection Law.

The Processor shall process Data only on the Controller's documented instructions, including instructions concerning international transfers, unless required to do otherwise by UK law. The service agreement and this Addendum document the Controller's standing instructions for the Processor to host and process personal data that the Controller or its authorised users enter into IsoStock Cloud, and data generated through their use of the service, for the service purposes described below. The Controller decides what information to enter and how to use and configure the agreed service. If the Controller asks the Processor to carry out a specific action outside routine service operation, such as an export or deletion, the Processor shall act on an authorised instruction that can be recorded. A separate request is not needed for each routine service operation.

Where UK law requires processing outside those instructions, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Law.

The Controller determines the purposes of processing, the information entered into the service, authorised user access and its retention requirements. It is responsible for an appropriate lawful basis and, where applicable, a condition for processing special category personal data and associated legal requirements. Entering information into the service does not by itself establish the individual's consent. The Processor remains responsible for its own obligations under Data Protection Law.

The Processor shall not use Data for its own sales or marketing purposes. Its separate controller activities concerning business contacts and administration are explained in the Company GDPR Statement.

IsoStock Cloud customer service data is hosted in Microsoft Azure UK South, with geo-redundant SQL backups in UK West. Any restricted international transfer, including overseas access constituting such a transfer, shall comply with the Controller's documented instructions and the applicable requirements of Data Protection Law. Where required, the Processor shall ensure an applicable adequacy arrangement, appropriate safeguards and associated assessment, or another lawful transfer mechanism is in place. Information about applicable arrangements will be made available to the Controller on request.

CONFIDENTIALITY OF PROCESSING

The Processor shall ensure that persons authorised to process Data are subject to a contractual duty of confidentiality or an appropriate statutory obligation of confidentiality. Access shall be limited to what is necessary for their authorised responsibilities.

SECURITY

The Processor shall implement appropriate technical and organisational measures under Article 32 of the UK GDPR to protect Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures shall take account of the nature, scope, context and purposes of processing and the risks to individuals, including risks associated with patient-linked health information.

The Processor uses an internal Information Security Management System (ISMS) to manage information security. Taking account of the nature of processing and the information available to it, the Processor shall assist the Controller in meeting its obligations under Article 32.

IsoStock Cloud uses Microsoft Entra ID for user authentication and requires multi-factor authentication. Customer-granted support access to service data is role-based, time-limited and audit logged; the Controller can grant and revoke that access. These arrangements do not remove the Processor's obligation to maintain appropriate security for its authorised administration of the service.

SUBCONTRACTING

The Processor uses Microsoft, as the provider of Microsoft Azure, as its hosting sub-processor. By entering into this Addendum, the Controller specifically authorises that hosting arrangement.

By entering into this Addendum, the Controller gives the Processor general written authorisation to engage additional or replacement sub-processors for IsoStock Cloud. The Processor shall give the Controller advance written notice of an intended addition or replacement, including any proposed move from Microsoft Azure to another hosting provider, and a reasonable opportunity to object before the new sub-processor processes Data. The parties shall address any objection before the proposed sub-processor processes the affected Data.

The Processor shall engage each sub-processor under binding written terms, which may be standard terms accepted electronically, imposing the data protection obligations required by Article 28(3) of the UK GDPR and providing an equivalent level of protection for Data, including sufficient guarantees of appropriate technical and organisational measures. The Processor remains fully liable to the Controller for the performance of the sub-processor's obligations. Details of the sub-processors used for the service shall be made available to the Controller on request.

COOPERATION AND DATA SUBJECTS' RIGHTS

The Processor will, as far as possible given the nature of the service, help the Controller respond to requests from individuals to exercise their data protection rights. This help will include appropriate technical and organisational measures.

The Processor shall provide reasonable and timely assistance with correspondence, enquiries or complaints relating to processing of Data. Where a request, enquiry or complaint concerning the Controller's Data is received directly by the Processor, it shall promptly inform the Controller and provide relevant details, unless prohibited by law. It shall not respond on the Controller's behalf without authorisation, except where required by law.

DATA PROTECTION IMPACT ASSESSMENT

Taking account of the nature of processing and the information available to it, the Processor shall assist the Controller with data protection impact assessments and any required prior consultation with the supervisory authority under Articles 35 and 36 of the UK GDPR.

If the Processor becomes aware that processing is likely to result in a high risk to individuals' rights and freedoms, it shall inform the Controller and provide relevant information and cooperation.

SECURITY INCIDENTS

The Processor shall notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Data. Notification shall not be delayed until the investigation is complete.

The Processor shall provide available information about the nature of the breach, affected categories and approximate numbers of individuals and records where possible, a contact for further information, likely consequences, and measures taken or proposed to address the breach and mitigate its effects. Further information shall be supplied without undue delay as it becomes available.

The Processor shall take appropriate steps to contain and mitigate the breach and assist the Controller in meeting its obligations under Articles 33 and 34 of the UK GDPR. The Controller is responsible for assessing and making any required notifications to the supervisory authority and affected individuals concerning Data it controls.

AUDIT

The Processor shall make available all information necessary to demonstrate compliance with its obligations under Article 28 of the UK GDPR and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

SUMMARY OF DATA PROCESSING

Subject Matter

The subject matter is personal data entered into IsoStock Cloud by the Controller and its authorised users, generated through use of the service, or supplied for configuration and support, relating to the categories of individuals described below.

Duration

Processing continues for the provision of the service and any subsequent period necessary to complete agreed return or deletion and backup expiry, subject to the Controller's instructions and any legal requirement to retain Data.

At the end of services relating to processing, the Processor shall, at the Controller's choice, return or delete all Data and delete existing copies unless UK law requires retention. The parties shall agree practical arrangements for secure return and deletion, including any export required before deletion. Any earlier or more specific obligation under the applicable service agreement remains effective unless validly varied.

The Processor shall delete live service Data as soon as reasonably practicable and within 30 days of receiving an authorised deletion request, or within 30 days of a future deletion date agreed with the Controller. Any earlier contractual deadline continues to apply. Pending deletion cases shall be reviewed through the monthly ISMS review.

Routine SQL backups are retained for up to 35 days. Following deletion of live service Data, existing backup copies remain until they expire under that cycle. Pending expiry, Data awaiting deletion shall be put beyond ordinary use and protected against unauthorised access. If a backup is restored, applicable deletion instructions shall be reapplied before the restored Data is made available for ordinary use.

Support or archive copies remain subject to the same return or deletion obligation; their existence does not authorise indefinite retention. Any separate retention required by UK law shall be limited to that requirement, and the Processor shall inform the Controller unless prohibited by law. The Processor shall provide confirmation of completed deletion on request, identifying any copies still awaiting scheduled backup expiry or legally required retention.

Nature and purpose of processing personal data

Processing enables IsoStock Cloud to manage and report the lifecycle of radioactive materials and associated records for the Controller, including optional patient-linked records where the Controller enters them. It also supports authorised user access, audit trails, service security, hosting, backup, configuration, maintenance, support, return and deletion. The service records, stores, retrieves and updates data entered by authorised users, and generates related reports and audit logs.

Types of Personal Data involved

Data may include authorised user names, work email addresses, roles and permissions; account identifiers, login dates and times, IP addresses and audit activity; optional patient names or identifiers; radionuclide administered and investigation or therapy references linked to a patient where entered; and notes or other references entered by authorised users. The Information Held within IsoStock section of the privacy statement provides further detail.

Patient-linked records may reveal information about an individual's health and are treated as special category personal data where applicable. A patient name or identifier is not required to use the standard service. The standard service does not require diagnoses, clinical indications, clinical results, treatment plans, medical histories or imaging records; the Controller should avoid entering unnecessary clinical detail, including in free-text fields.

Categories of Data Subjects

a) The Controller's employees and other workers who use or administer the service.

b) Patients whose information the Controller chooses to enter, including children where relevant.

c) Students affiliated with the Controller, where their information is entered.

d) Other authorised users or representatives whose information is processed through the service.

SPECIAL CATEGORY DATA AND APPROPRIATE POLICY DOCUMENT (APD)

This section describes the Processor's safeguards when the Controller enters patient-linked information that is special category personal data. The Controller determines the applicable lawful basis and special category condition for its purposes, including whether it must maintain an Appropriate Policy Document under the Data Protection Act 2018. This section does not replace an Appropriate Policy Document that the Controller is required to maintain.

Accountability

The Processor maintains records of its processing activities as required by Article 30 of the UK GDPR and internal data protection and security policies. It assists the Controller with relevant data protection impact assessments under this Addendum.

Principle (a): Lawfulness, Fairness and Transparency

The Controller is responsible for identifying its lawful basis and any applicable special category condition and for giving individuals appropriate privacy information. The Processor handles Data under the Controller's documented instructions for the agreed service and meets its own obligations under Data Protection Law.

Principle (b): Purpose Limitation

The Processor uses the Controller's Data to provide, secure, maintain and support IsoStock Cloud and for other purposes authorised by the Controller or required by UK law. It does not use that Data for its own marketing purposes.

Principle (c): Data Minimisation

The Controller decides whether optional patient identifiers are needed and limits entries, including free-text content, to what is necessary for its purposes. The Processor provides the agreed service and applies appropriate access controls to the Data it processes.

Principle (d): Accuracy

The Controller is responsible for the accuracy of information it enters and can correct records through authorised users, subject to service permissions. The Processor assists with correction where necessary under the service agreement and this Addendum.

Principle (e): Storage Limitation

The Controller sets its retention requirements for information held in the service. At the end of processing, the Processor returns or deletes Data as described above, including the distinct treatment of live records, routine backups and any agreed support or archive copies.

Principle (f): Integrity and Confidentiality

The Processor maintains an ISMS and applies appropriate security measures, including access control, confidentiality obligations and encryption where appropriate, taking account of the risks associated with patient-linked information.

Review of this Policy

The Processor reviews this section at least annually and updates it when the service, processing or applicable legal requirements change.