Data processing agreement

Pursuant to Art. 28 GDPR, between the submitting veterinary practice (controller) and Equipixel Veterinary Teleradiology (processor).

1. Subject matter and duration

The processor provides teleradiology reporting services to the controller through the portal at https://portal.equipixel.com, for the duration of the business relationship.

2. Nature, scope and purpose

Case data submitted by the controller is processed for the purpose of producing radiology reports and invoicing the service provided.

3. Types of data and categories of data subjects

Data: imaging data including DICOM header fields, patient (animal) name, species, breed, age, sex, owner's name, history and clinical question, name and contact details of the referring veterinarian, practice address and billing details.

Data subjects: practice staff and owners, referring veterinarians, and animal owners whose names appear in the submitted data.

4. Obligations of the processor

1. Processing only on documented instructions from the controller.
2. Confidentiality undertakings from everyone with access.
3. The technical and organisational measures set out in Annex 1.
4. Assistance with data subject requests and with Art. 33 and 34 notifications.
5. Notification of personal data breaches without undue delay.
6. Deletion or return of the data at the end of the agreement, at the controller's choice, subject to statutory retention obligations.
7. Evidence of compliance on request.

5. Sub-processors

The controller consents to the following sub-processors:

Changes or additions are announced four weeks in advance; the controller may object.

6. Place of processing

Processing takes place in the European Union. Where a sub-processor processes data in a third country, this is based on an adequacy decision or standard contractual clauses.

7. Scientific use of anonymised images

The controller permits the processor to anonymise the images submitted and to use the anonymised images for teaching, research, professional presentations and scientific publications.

Anonymisation removes from the image and its metadata the names of patient, owner and practice, the referring vet, case and study numbers, acquisition dates and device identifiers. Only clinically necessary details are kept, such as species, breed, age group, sex, anatomical region and modality. Where this leaves no means of identifying a person, the data no longer fall within the GDPR and the processor acts in that respect on its own responsibility rather than as a processor.

The controller may object to this use at any time, informally by email. From that point onwards no further images from the controller are used for these purposes. Objecting is free of charge and has no bearing on the scope of the service, turnaround time or fee. Publications already issued are unaffected. The controller's practice is not named unless it expressly asks for this.

Annex 1 — Technical and organisational measures (Art. 32 GDPR)

Signatures

Last updated: 28 Sep 2026