.png)
Data Processing Agreement (DPA)
Last updated: 20/01/2026
This Data Processing Agreement (“DPA”) forms part of the Therapist (Provider) Platform Agreement between Pillow Ltd (“Pillow”) and the Provider.
1. Roles of the Parties
For the purposes of the UK GDPR and EU GDPR:
Pillow acts as a Data Controller
Providers act as independent Data Controllers in relation to their clients, and as Data Processors when processing personal data via the Pillow platform
2. Scope of Processing
Pillow may process the following categories of data:
-
Provider identification and credentials
-
Public profile information
-
Availability and booking data
-
Client contact and booking details
-
Limited health-related information for matching purposes (with explicit consent)
Processing is limited to:
-
Platform operation
-
Matching and booking
-
Payment facilitation
-
Platform improvement (in anonymised or pseudonymised form)
3. Provider Obligations
Providers agree to:
Process personal data lawfully, fairly, and securely
Use personal data only for legitimate professional purposes
Implement appropriate technical and organisational security measures
Notify Pillow without undue delay of any data breach affecting platform data
4. Confidentiality
Providers must ensure that any person authorised to process personal data is bound by confidentiality obligations.
5. Sub-processors
Pillow uses trusted third-party service providers (e.g. hosting, payment processors) to operate the platform. Pillow remains responsible for ensuring appropriate safeguards are in place.
6. Data Subject Rights
Providers must cooperate with Pillow in responding to data subject requests, including access, correction, or deletion requests, where platform data is involved.
7. Data Retention & Deletion
Upon termination of the Provider’s account, personal data will be deleted or anonymised unless retention is required by law.
8. Governing Law
This DPA is governed by the laws of England and Wales, in line with the Platform Agreement.
Contact: 📩 team@pillowmentalhealth.com