Coagen · 14 October 2026
COAGEN DATA PROTECTION ADDENDUM
Last Updated: 14 October 2026
This Data Protection Addendum (the DPA) forms part of the Agreement between Coagen Limited (Coagen) and the Customer under the Coagen Master Terms of Service (the Terms). It applies whenever Coagen processes Customer Personal Data on the Customer's behalf in providing the Hosted Services. Terms defined in the Terms have the same meaning in this DPA.
This DPA applies to every Customer as part of the Terms. A Customer that needs a signed copy may ask Coagen for one, and an Order Form may set different terms for its subject matter.
1. Definitions
In this DPA:
Anonymisation Standard means the standard Coagen maintains for creating Anonymised Data, which Coagen makes available to the Customer on request.
Customer Personal Data means personal data in Project Data, Practice Data, Customer Materials or Workflow Content that Coagen processes on the Customer's behalf in providing the Hosted Services. It excludes personal data that Coagen processes as a controller: Account Data, Usage Data, and Practice Data for Coagen's own use under Section 7.11 of the Terms.
Data Protection Law means the UK GDPR and the Data Protection Act 2018, the EU GDPR, and any other data-protection law that applies to the processing of Customer Personal Data under the Agreement, each as amended.
EU GDPR means Regulation (EU) 2016/679.
EU SCCs means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Personal Data.
Restricted Transfer means a transfer of Customer Personal Data that Data Protection Law allows only with an approved transfer mechanism.
Subprocessor means a third party that Coagen engages to process Customer Personal Data.
UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
UK GDPR means the EU GDPR as it forms part of the law of the United Kingdom.
Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in Data Protection Law.
2. Roles and Scope
2.1 Roles. The Customer is the controller of Customer Personal Data, or a processor acting for its own controller, and Coagen is its processor or subprocessor. Where the Customer is a processor, it confirms that its controller has authorised its instructions and Coagen's appointment.
2.2 Coagen's own uses. Coagen is a controller, not a processor, for Account Data and Usage Data and for its own use of Practice Data under Section 7.11 of the Terms, which the Privacy Notice describes. This DPA's processor terms do not apply to those uses, but Coagen protects that data with the measures in Annex 2. An Order Form may switch off Coagen's use of Practice Data for a Project.
2.3 Anonymised Data. Unless an Order Form switches it off for a Project, the Customer instructs Coagen to create Anonymised Data from Customer Personal Data under Section 7.12 of the Terms, in accordance with the Anonymisation Standard. Coagen creates Anonymised Data as the Customer's processor, only from text and structured data and never from audio or video recordings. Coagen keeps it separately from Customer Personal Data, with no means of linking it back, and will not attempt to re-identify it. Once created, Anonymised Data is not Customer Personal Data.
2.4 Details. Annex 1 sets out the subject matter, duration, nature and purpose of the processing, and the types of personal data and data subjects.
3. The Customer's Responsibilities
3.1 Lawful instructions. The Customer is responsible for the lawfulness of the processing it instructs, including a lawful basis, any condition needed for special-category data such as health information, and the notices and consents needed, including to record participants, study partners and Users (Section 8.8 of the Terms).
3.2 Its own use. The Customer is responsible for its use of the Hosted Services and of Outputs, for how it configures access, retention and sharing in its Projects, and for the security of its accounts and devices (Section 8.6 of the Terms).
4. Coagen's Obligations as Processor
4.1 Instructions. Coagen processes Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise, in which case Coagen will tell the Customer before processing unless the law prohibits it. The Agreement, the Customer's configuration of the Hosted Services and any further written instructions that Coagen agrees to are the Customer's complete instructions. Coagen will tell the Customer if it believes an instruction infringes Data Protection Law.
4.2 Confidentiality. Coagen ensures that the people it authorises to process Customer Personal Data are bound by confidentiality and have access only as their role needs.
4.3 Security. Coagen implements and maintains the technical and organisational measures in Annex 2. Coagen may update them, provided that the overall level of protection does not decrease.
4.4 Assistance. Taking into account the nature of the processing and the information available to it, Coagen assists the Customer, by appropriate technical and organisational measures where possible, in responding to data subjects exercising their rights, and with security, breach notification, data protection impact assessments and prior consultation with supervisory authorities. Coagen may charge reasonable costs for assistance beyond what the Hosted Services' own features provide.
4.5 Requests from data subjects. If Coagen receives a request from a data subject about Customer Personal Data, it will refer the data subject to the Customer or tell the Customer, and will not respond itself except on the Customer's instructions or as the law requires.
5. Subprocessors
5.1 Authorisation. The Customer gives Coagen general authorisation to engage Subprocessors. Coagen makes its current list of Subprocessors, with the category of service each provides and where each processes Customer Personal Data, available to the Customer in the Hosted Services and on request. Annex 3 is that list at the date of this DPA.
5.2 Changes. Coagen will tell the Customer of an intended new Subprocessor at least 30 days before it starts processing Customer Personal Data, by email to the Customer's account owner or in the Hosted Services. The Customer may object on reasonable data-protection grounds within that period, and Coagen will work with it in good faith to find a solution. If none is found, the Customer may stop using the affected part of the Hosted Services and end the relevant Order Form, and Coagen will refund any unused purchased Credits for it.
5.3 Flow-down. Coagen imposes data-protection obligations on each Subprocessor by written contract that are no less protective than this DPA, to the extent they apply to the service the Subprocessor provides, and remains responsible to the Customer for each Subprocessor's performance.
6. Personal Data Breaches
6.1 Notice. Coagen will tell the Customer of a Personal Data Breach without undue delay, and in any event within 48 hours, after becoming aware of it.
6.2 Information. As it becomes available, Coagen will give the Customer the information it reasonably needs to meet its own obligations, including the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.
6.3 Response. Coagen will take reasonable steps to contain, investigate and mitigate the breach. Telling the Customer of a breach is not an admission of fault.
7. Retention, Deletion and Return
7.1 Retention. Coagen keeps and deletes Customer Personal Data as set out in Section 7.10 of the Terms: for the life of the Project and 12 months after it is archived, and for no more than 10 years after the Project was created, unless an Order Form sets a different period.
7.2 Export, deletion and return. The Customer may export the Customer Personal Data that it can access in the Hosted Services, as Section 7.9 of the Terms describes. The Project Owner's documented instructions on return and deletion are those in Sections 7.9, 7.10 and 14.6 of the Terms: its own copy holds what Section 7.9 describes, the rest of a Project's Customer Personal Data is returned to the Workspace that collected it through that Workspace's export, and all of it is then deleted under Section 7.10. The Project Owner may instruct Coagen to delete a Project's data earlier, unless the law requires Coagen to keep it. Coagen records each deletion in the Project's audit trail, and will confirm deletion in writing on request.
7.3 Backups. Deleted Customer Personal Data may remain in Coagen's database backups for up to 35 days, until they expire in the ordinary cycle, and stays protected under this DPA until then. Backup copies of recordings and files are deleted at the same time as the originals.
8. Audits and Information
8.1 Information. Coagen makes available the information reasonably necessary to show that it meets this DPA, including its security documentation and answers to a reasonable security questionnaire once a year.
8.2 Audits. If that information is not enough to show compliance, or a supervisory authority requires it, the Customer may audit Coagen's compliance with this DPA, itself or through an independent auditor bound by confidentiality. An audit may take place once in any 12 months, on at least 30 days' notice, during business hours, without disrupting the Hosted Services or accessing other customers' data, and at the Customer's own cost. Where Coagen holds an independent audit report or certification covering the relevant controls, the Customer will rely on it first.
9. International Transfers
9.1 Where. Coagen and its Subprocessors store and process Customer Personal Data in the United States and Europe, and some processing takes place in other countries. Annex 3 says where each Subprocessor processes it.
9.2 Transfers to Coagen. Coagen is established in the United Kingdom. Where the Customer's transfer of Customer Personal Data to Coagen is a Restricted Transfer, the EU SCCs (Module 2, or Module 3 where the Customer is a processor) apply and are incorporated into this DPA with the options in Annex 4, and, for transfers under the UK GDPR, as varied by the UK Addendum.
9.3 Onward transfers. Where Coagen makes a Restricted Transfer to a Subprocessor, Coagen puts in place a transfer mechanism that Data Protection Law recognises, such as the EU SCCs, the UK International Data Transfer Agreement or UK Addendum, or the Subprocessor's certification under the EU-US Data Privacy Framework and its UK Extension, with supplementary measures where needed.
9.4 Assessments. On request, Coagen will give the Customer the information it reasonably needs for a transfer impact assessment.
10. General
10.1 Liability. Each party's liability under this DPA is subject to the limits and exclusions in Section 15 of the Terms, except where Data Protection Law or the EU SCCs do not allow it.
10.2 Precedence. If this DPA conflicts with the Terms on its subject matter, this DPA prevails. If it conflicts with the EU SCCs, the EU SCCs prevail.
10.3 Duration. This DPA lasts as long as Coagen processes Customer Personal Data, and its obligations continue until that data is deleted or returned.
10.4 Changes. Coagen may update this DPA as Section 2.4 of the Terms allows, and to reflect changes in Data Protection Law, provided that an update does not materially reduce the protection of Customer Personal Data.
10.5 Law and disputes. This DPA is governed by the laws of England and Wales, and disputes under it are resolved as set out in Section 18 of the Terms. The UK Addendum is governed by the laws of England and Wales, and disputes under it are subject to the courts of England and Wales. The EU SCCs are governed by the law, and disputes under them are subject to the courts, set out in Annex 4.
Annex 1 · Details of the Processing
| Item | Details |
|---|---|
| Subject matter and duration | The provision of the Hosted Services under the Agreement, for its term and the retention period in Section 7 |
| Nature and purpose | Hosting, recording, transcribing, analysing, reviewing, displaying and storing Project Data and Practice Data, so that Users can train and qualify raters; conduct, record and score assessments, including, where a Project enables it, assessments administered by an AI interviewer; review how assessments were administered and scored; and oversee study quality. Creating Anonymised Data under Section 2.3. Support and security |
| Data subjects | Study participants and their study partners; Users, such as raters, site staff, reviewers, and sponsor and contract research organisation staff; and people who appear in materials the Customer uploads |
| Personal data | Audio recordings of assessment sessions; transcripts; scores, ratings, notes and other assessment data; study identifiers, and visit and scheduling information; Users' names, roles and activity in a Project; and practice recordings, transcripts, scores and feedback |
| Special-category data | Health information about participants, in recordings, transcripts and assessment data, as the Customer's Projects require |
| Frequency | Continuous, while the Customer uses the Hosted Services |
| Retention | As set out in Section 7 |
Annex 2 · Technical and Organisational Measures
| Measure | Description |
|---|---|
| Access control | Every request is checked on Coagen's servers, and Users access only the Workspaces, Projects and records their roles allow. Each Workspace sees only the records it collected; a Project's owner sees other participating Workspaces only as totals |
| Authentication | Passwords are stored as salted hashes. Sign-in is rate-limited, and password-reset links expire and work once |
| Encryption | Customer Personal Data is encrypted in transit and at rest |
| Audit trail | Changes to access, roles and assessment data are recorded with who made them and when, and acceptance of the Terms is recorded |
| Backups and recovery | Database point-in-time recovery over the previous 7 days, and database snapshots kept for up to 35 days; recordings and files copied to a separate backup store; a tested restore |
| Monitoring and incidents | Failures alert named staff, with documented responses, and a process handles Personal Data Breaches (Section 6) |
| Staff access | Named staff accounts, with access limited to what support needs, staff actions recorded, and staff bound by confidentiality |
| Separation | Each Customer's data is kept apart by Workspace and Project in the Hosted Services |
| Subprocessors | Chosen for their security, and bound by written terms (Section 5) |
| AI providers | Used only on terms under which they do not use Customer Personal Data to train their own models |
| Minimisation | Anonymised Data is created only as Section 2.3 describes, and identifiers are removed from Practice Data before Coagen uses it to develop its services |
Annex 3 · Subprocessors
Coagen's current list of Subprocessors is provided to Customers in the Hosted Services and on request.
Annex 4 · EU SCC Options
| Clause | Option |
|---|---|
| Clause 7 (docking) | Included |
| Clause 9 (subprocessors) | Option 2, general written authorisation, with the notice period in Section 5.2 |
| Clause 11 (redress) | The optional language is not used |
| Clause 13 (supervision) | The supervisory authority of the Customer's establishment in the European Union, or of its representative |
| Clause 17 (governing law) | The law of Ireland |
| Clause 18 (courts) | The courts of Ireland |
| Annexes I to III | Annexes 1 to 3 of this DPA |