Clinic Data Processing Agreement
Scribbletastic · Expressions Creative Studio · Version 1.1 · October 2026
In short
- ✓Your trust, clinic or charity is the data controller. I am the data processor.
- ✓You do not create client records in the app. A child is linked to you by their parent or their teacher, and only then can you see anything.
- ✓I never collect health records, NHS numbers, dates of birth or referral details.
- ✓Nothing is ever sold, shared or used for advertising or profiling.
- ✓Artwork and session data are private and encrypted. The parent or teacher controls deletion.
- ✓I will sign a countersigned DPA on request. Just email me.
1. Parties to This Agreement
Data processor: Expressions Creative Studio, operating Scribbletastic.
Contact: expressionscreativestudio@gmail.com
Data controller: the subscribing trust, clinic, service or charity, represented by the member of staff who created the Scribbletastic account.
By using Scribbletastic in a clinical or care setting, your organisation confirms it has the authority to enter into this agreement on behalf of the organisation.
2. How a Client Reaches Your Dashboard
A clinician cannot create, search for or add a client in Scribbletastic. This is deliberate, so nobody can browse for a child they have not been given.
A child's work appears in your dashboard only when:
- a parent or guardian enters your Therapist ID in their own Parent Dashboard, or
- a teacher adds your Therapist ID to one of their classes
Until one of those happens, you see nothing at all. A teacher can remove your ID from a class at any time. A parent or guardian can ask me to remove their link, and I will do so within 5 working days.
3. What Data Is Processed
Clinician and staff accounts:
- Email address and name (needed to sign in)
- Your Therapist ID, which you share with parents or teachers
- If your organisation asks to be invoiced: the organisation name, contact name and email address, an optional staff headcount, and any notes added
Linked children and clients:
- A first name or nickname, as typed when a drawing is saved, or as a teacher entered it in a class list
- Drawings (image file and stroke recording)
- The feeling chosen after drawing, the prompt used, and how long the drawing took
- Mood check-ins and any short note a child typed
- Any note or reward you choose to leave on a piece of work
Not collected: no NHS numbers, dates of birth, addresses, diagnoses, care plans, referral details, photographs or device identifiers.
Where a child uses Scribbletastic through their family, the account and its email address belong to their parent or guardian, not to the child.
4. Purpose of Processing
Data is processed only to provide the Scribbletastic service to your organisation:
- letting a linked child draw, check in on how they feel, and replay their own artwork
- letting you see drawings, sessions and wellbeing patterns for children genuinely linked to you
- letting you leave a short note or reward, and export a PDF summary for a linked child
No child or client data is ever used for advertising, profiling or research.
Please note: Scribbletastic is a creative expression tool. It is not a clinical records system and is not a medical device. It does not store diagnoses, care plans or referral information, and it is not a substitute for your own clinical records.
5. Your Organisation's Responsibilities
As data controller, your organisation is responsible for:
- having a lawful basis for viewing a child's creative and wellbeing data
- sharing your Therapist ID only with parents, guardians or teachers who are entitled to give you that access
- keeping your own clinical records separately, as Scribbletastic does not hold them
- telling Expressions Creative Studio promptly about any suspected data breach
Important: clinicians cannot delete a linked child's drawings from the dashboard. Deletion is controlled by the parent or guardian who owns the child's account, or by the teacher for class data. If you need something removed, ask them, or contact me and I will action it.
6. My Responsibilities as Processor
Expressions Creative Studio commits to:
- processing your organisation's data only on your documented instructions
- keeping strong technical and organisational security measures in place
- not moving data outside the EEA without equivalent safeguards
- helping you respond to requests from clients, parents or guardians
- deleting or returning all data when the service ends
- telling you about any personal data breach within 72 hours
7. Data Retention and Deletion
Data is kept while your organisation's subscription is active.
A parent, guardian or teacher can delete a drawing at any time from their own dashboard. The drawing comes out of the app immediately.
When a subscription is cancelled or an account closed, all associated data is deleted within 30 days. One honest limit: saved artwork images and drawing recordings are held as files in storage, and I have no way to delete those files, so the stored files stay even after the drawing is gone from the app.
8. Companies That Help Me Run the App
I use the following companies to deliver the service:
| Company | What they do | Location |
|---|---|---|
| Hosting provider | App hosting, database and sign in | EU / EEA |
| Stripe | Payment processing (staff accounts only) | EU / USA, under standard contract clauses |
No child or client data goes to Stripe. Stripe only handles staff billing information.
Need a countersigned DPA?
Most trusts, clinics and charities need a formally countersigned DPA for procurement. I am happy to provide one. Email me with your organisation name and I will return a signed copy within 5 working days.
Request a Signed DPAThis agreement is governed by the laws of England and Wales.
A data processing agreement that meets UK GDPR Article 28.