bloom
Get started

Data Processing Agreement

Last updated: October 2026

This Data Processing Agreement ("Agreement") forms part of the Terms of Service between Bloom Practice Ltd ("Bloom", "Processor", "we", "us") and the Practitioner using the Services ("Controller", "you"). For the purposes of this Agreement, the Practitioner acts as Controller and Bloom acts as Processor.

This Agreement applies whenever Bloom processes Personal Data on behalf of the Controller in connection with the Services. Where this Agreement conflicts with the Terms of Service in relation to the processing of Personal Data, this Agreement shall prevail.

1. Definitions

Unless otherwise defined in this Agreement, terms such as Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach, and Special Category Data have the meanings given in the UK GDPR and the Data Protection Act 2018.

2. Purpose

Bloom provides software to assist practitioners in managing their professional practice, including appointment scheduling, client management, secure record keeping, communications and related administrative functions.

Bloom processes Personal Data solely to provide the Services and in accordance with the documented instructions of the Controller, unless processing is required by applicable law. The Controller’s documented instructions include this Agreement, the Terms of Service, the Controller’s use and configuration of the Services, and any additional written instructions agreed by the parties.

Bloom does not provide therapy, healthcare, safeguarding assessments or clinical advice.

3. Roles of the Parties

The Controller determines the purposes and means of processing Personal Data and remains responsible for complying with all applicable data protection laws. The Controller is responsible for ensuring the lawfulness, fairness and transparency of its processing; identifying an applicable Article 6 lawful basis and, where relevant, an Article 9 condition; providing required privacy information; ensuring that its instructions and Personal Data are accurate and lawful; responding to Data Subject requests; and meeting applicable professional, regulatory and safeguarding obligations.

In respect of Personal Data processed under this Agreement, Bloom acts as Processor on behalf of the Controller.

Nothing in this Agreement transfers ownership or control of Personal Data from the Controller to Bloom.

4. Processing of Personal Data

Bloom shall:

  • process Personal Data only on the documented instructions of the Controller unless otherwise required by law;
  • immediately inform the Controller if, in Bloom’s opinion, an instruction infringes the UK GDPR, the Data Protection Act 2018 or any other applicable data protection law;
  • ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations;
  • implement appropriate technical and organisational measures to protect Personal Data;
  • assist the Controller, taking into account the nature of the processing and the information available to Bloom, in complying with its obligations under Articles 32 to 36 of the UK GDPR, including obligations relating to security, Personal Data Breaches, Data Protection Impact Assessments and prior consultation with the Information Commissioner’s Office where applicable;
  • notify the Controller of Personal Data Breaches in accordance with Section 10; and
  • make available information reasonably necessary to demonstrate compliance with this Agreement.

Bloom shall not:

  • use Personal Data for its own marketing purposes;
  • sell or otherwise commercialise Personal Data;
  • determine the purposes for which Personal Data is processed; or
  • use Client Data, therapy records or identifiable Practitioner Content to train general-purpose artificial intelligence or machine-learning models; or
  • carry out solely automated decision-making that produces legal or similarly significant effects on Data Subjects, unless expressly instructed by the Controller and permitted by applicable Data Protection Law.

5. Security

Bloom shall maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures include, where appropriate:

  • encryption of data in transit;
  • encryption of data at rest;
  • authenticated user access controls;
  • role-based access permissions;
  • logging and monitoring of security events;
  • regular backups;
  • vulnerability management and security updates;
  • secure hosting infrastructure; and
  • procedures for testing and reviewing security controls.

Bloom may update these measures provided the overall level of protection is not materially reduced.

6. Confidentiality

Bloom shall ensure that all personnel authorised to process Personal Data are subject to contractual or statutory duties of confidentiality.

7. Sub-processors

The Controller grants Bloom general written authorisation to appoint Sub-processors where reasonably necessary to provide the Services.

Bloom shall:

  • select Sub-processors providing sufficient guarantees regarding data protection;
  • enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those contained in this Agreement, to the extent applicable to the services performed by that Sub-processor;
  • remain responsible to the Controller for the performance of its Sub-processors in relation to the processing of Personal Data; and
  • maintain an up-to-date list of Sub-processors and make that list available through its website or upon request.

Bloom shall give the Controller at least 14 days' prior notice before appointing a new Sub-processor or replacing an existing Sub-processor, unless a shorter period is reasonably necessary due to an urgent security, legal or operational requirement.

The Controller may object to the proposed change during the notice period on reasonable grounds relating to data protection. The parties shall work in good faith to address the objection. Where the parties cannot resolve the objection and Bloom cannot reasonably provide the Services without the proposed Sub-processor, the Controller may terminate the affected Services before the proposed appointment takes effect.

8. International Transfers

Bloom shall not transfer Personal Data to a country outside the United Kingdom unless the transfer is permitted under applicable Data Protection Law, including through an adequacy regulation or appropriate safeguards.

Where international transfers occur, Bloom shall implement an appropriate lawful transfer mechanism, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, an adequacy regulation, or another legally recognised safeguard.

9. Data Subject Requests

Where Bloom receives a request from a Data Subject relating to Personal Data processed on behalf of the Controller, Bloom shall:

  • notify the Controller without undue delay and, where reasonably practicable, within two business days of receipt;
  • not respond substantively except on the documented instructions of the Controller or where legally required;
  • acknowledge receipt where appropriate, explain that the Controller is responsible for the request, and refer the individual to the Controller; and
  • taking into account the nature of the processing, provide reasonable technical and organisational assistance to enable the Controller to respond within the time limits required by applicable data protection law.

The Controller remains responsible for verifying the identity of the requester, determining the appropriate response, and ensuring that the request is completed within the applicable statutory period.

10. Personal Data Breaches

If Bloom becomes aware of a Personal Data Breach affecting Personal Data processed under this Agreement, Bloom shall notify the Controller without undue delay and, where reasonably practicable, within 24 hours after becoming aware of it.

Bloom shall provide, where available:

  • a description of the nature of the breach;
  • the categories and approximate number of Data Subjects affected;
  • the categories and approximate number of Personal Data records affected;
  • the likely consequences;
  • the measures taken or proposed to contain, investigate and remediate the breach; and
  • a contact point for further information.

Where all information is not available at the time of the initial notification, Bloom may provide it in phases without undue further delay.

Bloom shall take reasonable steps to contain and mitigate the breach, preserve relevant evidence, cooperate with the Controller's investigation, and provide reasonable assistance with any legally required notification to the Information Commissioner's Office or affected Data Subjects.

Bloom shall not notify a regulator, Data Subject, law enforcement authority or other third party about a breach affecting Personal Data processed under this Agreement without first consulting the Controller, unless Bloom is legally required to do so.

11. Return and Deletion of Personal Data

Upon termination of the Services, Bloom shall make Personal Data processed under this Agreement available for export for 60 days, unless a different period is agreed in writing or immediate restriction is required for security or legal reasons.

At the end of that export period, and at the Controller's choice where technically and legally practicable, Bloom shall return the Personal Data or delete it, unless retention is required by law.

For the purposes of this Agreement, deletion may be achieved by permanently erasing the Personal Data or by irreversibly anonymising it so that no individual is identified or identifiable and re-identification is not reasonably possible. Once irreversibly anonymised, the information shall no longer be treated as Personal Data.

Personal Data contained in secure backup systems may remain until deletion through Bloom's ordinary backup rotation, provided that such data is isolated from active use, is not restored except for disaster recovery or business continuity purposes, and remains protected in accordance with this Agreement.

Upon reasonable request, Bloom shall confirm completion of deletion, return or anonymisation.

The Controller acknowledges that it is solely responsible for determining the appropriate retention period for Personal Data and clinical records in accordance with applicable legislation, professional standards and regulatory requirements. Bloom does not determine how long client records should be retained.

12. Audit and Compliance

Bloom shall make available to the Controller all information reasonably necessary to demonstrate compliance with this Agreement and Article 28 of the UK GDPR.

Bloom shall allow for and contribute to audits and inspections conducted by the Controller or an independent auditor mandated by the Controller, subject to the following reasonable safeguards:

  • the Controller shall normally give at least 20 business days' written notice;
  • audits shall normally occur no more than once in any 12-month period, unless required by a competent regulatory authority, following a material Personal Data Breach, or where the Controller has reasonable grounds to suspect material non-compliance;
  • the audit shall be conducted during normal business hours and in a manner that minimises disruption to Bloom's operations;
  • the auditor must be independent, appropriately qualified, not a direct competitor of Bloom, and bound by confidentiality obligations;
  • the audit shall not compromise the security, confidentiality or rights of other customers, personnel or third parties; and
  • the Controller shall bear its own audit costs. Bloom may charge reasonable, documented costs only for exceptional or materially burdensome assistance beyond Bloom’s ordinary compliance obligations, unless the audit identifies a material breach by Bloom, in which case Bloom shall bear its reasonable internal costs of remediation.

Bloom may first satisfy an audit request by providing recent independent audit reports, certifications, security documentation, questionnaires or other relevant evidence where these reasonably address the Controller's request.

Bloom shall promptly inform the Controller if, in Bloom's opinion, an audit instruction infringes applicable data protection law.

13. Liability

Each party shall remain responsible for complying with its respective obligations under applicable data protection legislation and for the acts and omissions of its personnel, agents and authorised representatives.

To the extent permitted by law, each party shall be responsible for losses, claims, damages, regulatory costs and reasonable professional fees arising from its own breach of this Agreement or applicable data protection law.

Where both parties are responsible for the same loss, each party's responsibility shall be allocated according to its contribution to the event giving rise to the loss, subject to any mandatory rights of recovery or contribution under applicable law.

Bloom remains responsible for the performance of its Sub-processors as set out in Section 7.

Any limitation or exclusion of liability in the Terms of Service applies to this Agreement, except to the extent that:

  • liability cannot lawfully be limited or excluded;
  • the liability arises from fraud or fraudulent misrepresentation;
  • the limitation would prejudice a Data Subject's statutory right to compensation; or
  • applicable data protection law provides otherwise.

Nothing in this Agreement requires either party to indemnify the other for regulatory fines or penalties imposed due to the other party's own breach of law.

14. Governing Law

This Agreement is governed by the laws of England and Wales.

The courts of England and Wales shall have exclusive jurisdiction over any dispute arising under or in connection with this Agreement.

Schedule 1. Details of Processing

Subject Matter:

Provision of Bloom's practice management platform.

Duration:

For the duration of the Controller's use of the Services together with any applicable retention period.

Nature of Processing:

Collection, recording, organisation, storage, encryption, retrieval, transmission, hosting, deletion and other processing necessary to provide the Services.

Purpose of Processing:

To provide, maintain, secure, and support the Bloom platform and enable the Controller to manage their professional practice through the Services.

Categories of Data Subjects:

  • Practitioner personnel and authorised users, only where their Personal Data is processed on behalf of the Controller rather than by Bloom for its own purposes;
  • clients;
  • prospective clients;
  • children and young people receiving services from the Controller, where applicable;
  • emergency contacts.

Categories of Personal Data:

Personal Data processed through the Services may include:

  • names;
  • postal addresses;
  • email addresses;
  • telephone numbers;
  • dates of birth;
  • appointment information;
  • communications;
  • invoices and payment records;
  • signed agreements and consent forms;
  • uploaded documents;
  • authorised-user information processed on behalf of the Controller, excluding account, billing, security and support data processed by Bloom as Controller;
  • emergency contact details;
  • clinical records; and
  • any other Personal Data uploaded by the Controller.

Special Category Data:

Depending on how the Controller uses the Services, Bloom may process Special Category Data on behalf of the Controller, including information concerning an individual's physical or mental health, clinical records, therapy records, assessments, safeguarding information, treatment history and other information falling within Article 9 of the UK GDPR.

Where the Controller provides services to children or young people, such Special Category Data may also relate to individuals under the age of 18.

The Controller remains solely responsible for determining the lawful basis for processing, satisfying any conditions under Article 9 UK GDPR, and complying with all legal, professional and safeguarding obligations relating to the processing of Personal Data, including the Personal Data of children and young people.

Bloom processes such data solely on the documented instructions of the Controller for the purpose of providing the Services and does not determine the purposes or means of processing.