Legal

Data Processing Agreement

Last updated: 18 October 2026 · Nosht Limited

This Data Processing Agreement ("DPA") is entered into between Nosht Limited (Company No. 17061341, registered office Danvers Road, Oxford, OX4) ("Nosht", "Processor", "we", "us") and the subscribing dental practice or individual clinician ("Subscriber", "Controller", "you"). It forms part of the Terms of Service and should be read alongside our Privacy Policy.

Which Data Does This DPA Cover?

Nosht processes different categories of data in different legal capacities. This DPA applies to Customer Personal Data (defined below): Clinical Notes Data, Referral Data (the referral tracker), Practice Compliance Data (Staff Compliance and significant events), and Patient Leaflet Delivery Data (patient email addresses and mobile numbers processed on your instruction via the Send Leaflet feature) — in each case, you are the Data Controller and Nosht processes the data strictly on your instructions.

The following data categories are not governed by this DPA. For those categories, Nosht acts as an independent Data Controller and processing is governed by our Privacy Policy:

Subscriber account data — your name, email address, GDC number, practice name, clinician role, and account preferences. Nosht determines the purposes and means of processing this data to operate and manage your account.
Billing and payment data — payment method details and transaction records. These are processed by Nosht (as Controller) and Stripe (as an independent Controller) to fulfil your subscription.
Usage analytics and product telemetry — aggregated data about how you interact with the Nosht application. Nosht processes this data as Controller to improve the service.
Bulletproof Mode documentation completeness scores — where Nosht generates and stores documentation completeness scores derived from your note activity, Nosht acts as Controller for that derived data.
Customer support communications — emails, chat messages, and support tickets you send to Nosht. Nosht processes this data as Controller to provide support and improve the service.

1. Definitions

In this DPA, unless the context requires otherwise:

"Data Protection Laws" means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended or replaced from time to time.
"Personal Data", "Data Controller", "Data Processor", "Data Subject", "Processing", "Personal Data Breach", and "Supervisory Authority" have the meanings given to them in the Data Protection Laws.
"Clinical Notes Data" means any structured clinical note content, template selections, free-text clinical entries, and associated metadata entered or generated by you (or members of your dental team acting under your direction) via the Nosht application in the course of documenting patient care, to the extent that such content constitutes Personal Data. For the avoidance of doubt, Nosht's application is designed so that patient identifiers (names, NHS numbers, dates of birth, contact details) need not be entered; however, if you choose to include such identifiers within note content, that content falls within the scope of this DPA.
"Referral Data" means the content of the referral tracker: patient reference, referral reason, clinical and outcome summaries, reminder notes, and the name of the clinician or organisation a patient is referred to, entered by you via the Nosht Application.
"Practice Compliance Data" means the records entered by you via the Staff Compliance feature about your dental team members and staff: GDC number, indemnity provider, DBS evidence-seen date, Hepatitis B evidence-seen status, CPD and training records, and significant-event (incident) records including descriptions and staff involved.
"Customer Personal Data" means, collectively, Clinical Notes Data, Referral Data, Practice Compliance Data, and Patient Leaflet Delivery Data.
"Sub-Processor" means any third party appointed by Nosht to process Customer Personal Data on behalf of the Controller.
"UK IDTA" means the UK International Data Transfer Agreement issued by the ICO under section 119A of the Data Protection Act 2018, as updated or replaced from time to time.
"Nosht Application" means the Nosht clinical note drafting software, including the NoteWriter, template engine, and associated Supabase-hosted infrastructure.

2. Scope and Roles

This DPA governs Nosht's Processing of Customer Personal Data: (a) Clinical Notes Data, (b) Referral Data, (c) Practice Compliance Data, and (d) Patient Leaflet Delivery Data (patient email addresses and mobile numbers processed on your instruction via the Send Leaflet feature). In every case, you, the Subscriber, are the Data Controller. You determine the purposes and means of documenting patient care, tracking referrals, recording your team's compliance records, and sending patient communications; Nosht processes that data solely on your documented instructions.

Nosht's role as Processor is limited to:

Storing Customer Personal Data in Supabase's London region (AWS eu-west-2, United Kingdom) while you have an active subscription.
Transmitting Customer Personal Data via encrypted channels to enable your use of the Nosht Application.
Carrying out any other Processing of Customer Personal Data expressly instructed by you in writing.

Nothing in this DPA makes Nosht a Data Controller of Clinical Notes Data. Nosht will not use Clinical Notes Data (note content) for its own purposes, including product training or marketing, without your prior written consent. Nosht may use aggregated, de-identified usage metadata — such as which template was used, completion timestamps, AI-assist flags, and Bulletproof Mode documentation completeness scores — to operate, secure and improve the Service, including generating the practice-level compliance analytics described in our Privacy Policy. Nosht acts as an independent Data Controller for this aggregated metadata and will never use Clinical Notes Data content for these purposes.

Note on template structure: Nosht provides pre-built clinical note templates that define available fields, dropdown options, and section structures. These templates are designed to reflect established UK clinical documentation standards (including FGDP(UK)/CGDent and GDC record- keeping guidance). While Nosht determines the structure of its templates (a non- essential means of Processing), the Controller retains full control over which templates are used, which fields are completed, and what clinical content is entered. The template structure does not alter Nosht's role as Processor of the Clinical Notes Data entered by the Controller.

3. Controller Instructions

Nosht shall process Customer Personal Data only on your documented instructions. Your use of the Nosht Application constitutes documented instructions for the Processing described in Schedule 1. Any instruction requiring Processing outside the scope of Schedule 1 must be given in writing to hello@nosht.io.

If Nosht is required by applicable law to process Customer Personal Data in a manner that conflicts with your instructions, Nosht will notify you before doing so unless that law prohibits notification on grounds of public interest. If Nosht reasonably believes that an instruction infringes Data Protection Laws, Nosht will inform you promptly.

4. Processor Obligations (UK GDPR Article 28)

In accordance with UK GDPR Article 28(3), Nosht shall:

Process Customer Personal Data only on your documented instructions, except where required to do so by applicable law.
Ensure that all persons authorised to access Customer Personal Data have committed to confidentiality obligations or are subject to an appropriate statutory duty of confidentiality. An authorised Nosht administrator can email a stored note to the account holder's own address; each such access is logged. Only when you have asked Nosht for support, a Nosht superadmin can open a read-only view of your account: it cannot change, send, export or delete Customer Personal Data, ends after 15 minutes at most, and its start, end and reason are logged. Ending it signs your account out on every device. Nosht does not notify you of each such session.
Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures described on our Security & Data Protection page (encryption in transit using TLS 1.2+, encryption at rest, role-based access controls, and regular security assessments).
Not engage a Sub-Processor without your prior written authorisation. General authorisation is granted for the Sub-Processors listed in Section 5 of this DPA. Nosht will notify you of any intended addition or replacement of Sub-Processors — by email to the account owner and by posting the change at nosht.io/security#sub-processors — and give you 30 days to object before the change takes effect. If you raise a reasonable objection to a new Sub-Processor and we are unable to provide the Service without that Sub-Processor, either party may terminate this DPA and the associated subscription on 30 days' notice, and Nosht will refund any prepaid fees for the unused portion of the subscription period.
Ensure that each Sub-Processor is subject to data protection obligations equivalent to those in this DPA, by way of a written contract. Nosht remains fully liable to you for the performance of each Sub-Processor's obligations.
Assist you in fulfilling your obligations to respond to Data Subject rights requests (including rights of access, rectification, erasure, restriction, and portability) in relation to Customer Personal Data, insofar as this is possible given the nature of the Processing.
Assist you in ensuring compliance with your obligations under UK GDPR Articles 32–36, including security of Processing, breach notification, data protection impact assessments (DPIAs), and prior consultation with the ICO.
At your election, securely delete or return all Customer Personal Data that is not subject to a statutory retention obligation within 30 days of termination of your subscription, and confirm deletion or return in writing. By exception: completed clinical notes and associated audit evidence are not deleted on termination but are instead de-identified — your account identity (user_id) is removed, and the structured patient-identifier fields captured by the optional Referral Letter template (patient name, date of birth, NHS number, address, contact details, and email address) are scrubbed from note content; clinicians are instructed not to enter patient-identifying information into other note fields, but any other clinical free text that was entered is retained as part of the dento-legal record and is not guaranteed to be redacted — and retained by Nosht for the GDC/NHS dental-records statutory retention period, as permitted by UK GDPR Article 17(3)(b) and (e). Nosht will provide written confirmation identifying the categories of data deleted and those retained under the statutory exemption.
Make available to you all information reasonably necessary to demonstrate compliance with UK GDPR Article 28 obligations, and allow for and contribute to audits or inspections conducted by you or an independent auditor appointed by you, subject to reasonable notice and Nosht's right to recover reasonable costs for audit assistance.

5. Sub-Processors

By accepting this DPA, you grant general written authorisation for Nosht to engage the following Sub-Processors in connection with the Processing of Customer Personal Data. Each provider's role and the data they process are described below. Stripe does not process clinical note content or patient contact details.

Sub-Processor	Role re Customer Personal Data	Processing Location	Transfer Safeguard
Supabase, Inc.	Database hosting and authentication. Customer Personal Data is stored in Supabase's London region (AWS eu-west-2).	United Kingdom (London)	UK IDTA / SCCs
Netlify, Inc.	Web application hosting and serverless API functions. Netlify may transiently process API request payloads during function execution, including clinical note text (when a note is completed and when the optional AI features are used) and patient contact details submitted via the Send Leaflet feature; data is not persistently stored by Netlify.	United States (global CDN edge)	UK IDTA / SCCs
Resend, Inc.	Email delivery of patient information leaflets on the Controller's instruction (Send Leaflet), of the link a user emails to their own account address (Send Note by Email), and of a stored note an authorised Nosht administrator emails to the account holder's own address, solely for delivery. A leaflet email carries the patient's email address and the leaflet title, which indicates the treatment topic, but no patient names or clinical record data. A Send Note by Email message carries the template name, the date and a link, not the note text: Nosht keeps a copy of the note in its own database for up to 24 hours, which only that user can open, after signing in, until it expires. A note emailed by an administrator contains the note text, which for a Referral Letter includes patient identifiers.	United States	UK IDTA / SCCs
Twilio, Inc.	SMS delivery of patient information leaflets on the Controller's instruction via the Send Leaflet feature. Twilio processes the patient mobile number and message body solely for delivery; no patient names or clinical record data are included.	United States	UK IDTA / SCCs
Anthropic, PBC	AI inference for Nosht's three optional, clinician-reviewed AI features. The AI shorthand pre-fill and the mobile quick note (typed) transmit the Controller's clinician shorthand; the Bulletproof Mode completeness check transmits the composed clinical note text the clinician has written, for an advisory review of documentation completeness. Text only is transmitted (no audio), and the content is designed to exclude patient identifiers. Under Nosht's data-processing arrangement with Anthropic, inputs and outputs are not used to train Anthropic's models. Under Anthropic's standard commercial API terms, inputs and outputs may be retained for a limited period (up to 30 days) for trust, safety and abuse-monitoring purposes and are then deleted, except where Anthropic is required to retain them for longer to meet legal or safety obligations; they are not used for any other purpose. The Nosht system prompt is configured to disregard patient names, dates of birth, and NHS numbers if encountered, and a UI advisory reminds clinicians not to include patient identifiers.	United States	UK IDTA / SCCs (no-training; limited retention per Anthropic's commercial terms)
Functional Software, Inc. (Sentry)	Application error and performance monitoring on signed-in routes, including the NoteWriter. Receives diagnostic error context; the signed-in user ID is attached only where analytics consent has been given. Session replay is a separate choice in the cookie banner and is never recorded on the NoteWriter or other clinical pages (including the dashboard, practice, recall, clinical tool, administration and emailed-note pages) or on patient leaflets. Where it runs, all text is masked and media is blocked. Reports are scrubbed of emails, names and IP addresses; Nosht does not intentionally send Clinical Notes Data.	European Union (Sentry EU region, Germany)	UK IDTA / SCCs

Nosht also uses optional, consent-gated analytics providers (PostHog and Microsoft Clarity) that do not process Clinical Notes Data; they are listed, with their locations, on the Security page.

Sub-Processor agreements

Nosht maintains Data Processing Agreements with each Sub-Processor listed above. Supabase's standard DPA (incorporating SCCs) governs database hosting. Netlify's DPA governs serverless function execution. Anthropic's commercial API terms (incorporating a no-training data-processing position, with inputs and outputs retained only for a limited period for trust-and-safety purposes, and SCCs / the UK IDTA) govern AI inference. Copies of these agreements are available upon reasonable written request to hello@nosht.io.

Anthropic, PBC — AI inference (Nosht AI)

Nosht offers three optional, clinician-reviewed AI features. The AI shorthand pre-fill and the mobile quick note (typed) transmit the clinician shorthand you type; the Bulletproof Mode completeness check transmits the composed clinical note text you have written, which is returned with an advisory review of documentation completeness. Text only is transmitted (no audio), and the content is designed to exclude patient identifiers. An automated check blocks text that appears to contain patient identifiers, but it cannot catch everything, so clinicians are told not to type patient names or other identifiers into these features. Anthropic acts as Sub-Processor for this data on Nosht's instructions. Under Nosht's data-processing arrangement with Anthropic, inputs and outputs are not used to train Anthropic's models. Under Anthropic's standard commercial API terms, inputs and outputs may be retained for a limited period (up to 30 days) for trust, safety and abuse-monitoring purposes and are then deleted, except where Anthropic is required to retain them for longer to meet legal or safety obligations; they are not used for any other purpose. Transfers are governed by the UK IDTA and Standard Contractual Clauses. The Nosht system prompt is configured to disregard patient names, dates of birth, and NHS numbers; the user interface reminds clinicians not to include patient identifiers. Processing location: United States.

Resend, Inc. — email delivery

Where you use the Send Leaflet feature to deliver patient information leaflets by email, the patient email address and the leaflet email content (which includes the leaflet title, and so indicates the treatment topic) are transmitted to Resend, Inc. solely for delivery purposes. Resend acts as Sub-Processor for this data on Nosht's instructions. Resend is bound by a Data Processing Agreement incorporating SCCs for transfers outside the UK/EEA. Processing location: United States.

Twilio, Inc. — SMS delivery

Where you use the Send Leaflet feature to deliver patient information leaflets by SMS, the patient mobile number and message body are transmitted to Twilio, Inc. solely for delivery purposes. Twilio acts as Sub-Processor for this data on Nosht's instructions. Twilio is bound by a Data Processing Agreement incorporating SCCs for transfers outside the UK/EEA. Processing location: United States.

Note: Stripe is not a Sub-Processor under this DPA

Stripe processes your billing and payment information as an independent Data Controller (and, where acting on Nosht's instructions for account management, as a Processor of Subscriber account data). Stripe does not process Clinical Notes Data. Stripe's data processing is governed by Nosht's Privacy Policy and Stripe's own privacy documentation.

6. International Data Transfers

Customer Personal Data is stored in the United Kingdom, in Supabase's London region (AWS eu-west-2). Where Customer Personal Data is transferred to Sub-Processors located outside the UK or EU (including Netlify's US-based infrastructure, Resend and Twilio for Send Leaflet delivery, and Anthropic's US-based AI inference for Nosht AI), Nosht ensures appropriate safeguards are in place in accordance with UK GDPR Article 46:

The UK Extension to the EU-US Data Privacy Framework, where the recipient is certified.
Otherwise, the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), incorporated into our agreements with the relevant Sub-Processor.
Supplementary technical measures including TLS 1.2+ encryption in transit and AES-256 encryption at rest, minimising risk during any international transfer.

7. Personal Data Breach Notification

Nosht shall notify you without undue delay and in any event within 24 hours of becoming aware, to the extent feasible given the information then available, of a Personal Data Breach affecting Customer Personal Data. Initial notification will be made to the email address registered on your Nosht account. The notification shall include, to the extent then known:

A description of the nature of the breach, including the categories and approximate number of Data Subjects and records of Customer Personal Data affected.
The name and contact details of Nosht's data protection contact from whom further information can be obtained (hello@nosht.io).
A description of the likely consequences of the breach.
A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

Where not all required information is available within 24 hours, Nosht will provide the available information and supplement it as further details become known. You remain responsible as Data Controller for assessing whether the breach must be reported to the ICO and/or affected Data Subjects.

8. Your Obligations as Data Controller

You acknowledge and agree that, as Data Controller of Customer Personal Data, you are responsible for:

Ensuring you have a lawful basis for processing any Customer Personal Data that constitutes Personal Data, including patient clinical information and, for Practice Compliance Data, your staff's special category and criminal-offence data.
Providing patients with fair processing information (privacy notices) in accordance with UK GDPR Articles 13 and 14, and providing your staff with fair processing information about Practice Compliance Data.
Ensuring your use of Nosht complies with NHS contractual requirements, GDC Standards, and any other regulatory obligations applicable to your practice.
Not inputting into Nosht any data that you are not authorised to process, or any data in excess of what is necessary for the clinical documentation, referral-tracking or staff-compliance purpose.
Promptly notifying Nosht in writing if you believe any instruction you have given to Nosht would cause Nosht to infringe Data Protection Laws.

9. Duration and Termination

This DPA remains in force for the duration of Nosht's Processing of Customer Personal Data on your behalf. Upon termination or expiry of your Nosht subscription:

Nosht shall cease Processing Customer Personal Data except as strictly necessary to comply with legal obligations.
Draft and incomplete notes are deleted automatically after 90 days with no edit, whether or not your account remains open; on account closure, Nosht additionally deletes any remaining drafts, account preferences, and other account-scoped data immediately, and in any event within 30 days. At your written request submitted within 60 days of account closure, Nosht shall return or confirm deletion of such account-scoped data and provide written confirmation.
Completed clinical notes and their associated audit evidence are not deleted on account closure. Instead, they are de-identified — your account identity (user_id) is removed, and the structured patient-identifier fields captured by the optional Referral Letter template (patient name, date of birth, NHS number, address, contact details, and email address) are scrubbed from note content; clinicians are instructed not to enter patient-identifying information into other note fields, but any other clinical free text that was entered is retained as part of the dento-legal record and is not guaranteed to be redacted — and retained by Nosht for the GDC/NHS dental-records statutory retention period (a minimum of 11 years for adults, or until the patient's 25th birthday for children), as permitted by UK GDPR Article 17(3)(b) and (e). Nosht will confirm in writing that this de-identification has taken place.
Nosht may additionally retain system metadata (note timestamps, template identifiers, audit-trail records) for the minimum period required by applicable law, including the GDC/NHS dental-records retention period for metadata associated with completed notes.

10. General

Governing law: This DPA is governed by the laws of England and Wales. Each party submits to the exclusive jurisdiction of the courts of England and Wales.
Precedence: In the event of a conflict between this DPA and the Terms of Service regarding the Processing of Customer Personal Data, including liability for Customer Personal Data, this DPA shall prevail.
Entire agreement: This DPA (including Schedule 1) constitutes the entire agreement between the parties regarding Nosht's Processing of Customer Personal Data as Processor, and supersedes all prior arrangements on that subject.
Amendments: Nosht may update this DPA to reflect changes in Data Protection Laws or the Nosht Application. We will provide at least 30 days' notice of material changes. Continued use of Nosht after the notice period constitutes acceptance of the updated DPA.
Severability: If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

Schedule 1: Details of Processing (UK GDPR Article 28(3))

Subject matter of Processing

The provision of the Nosht application, through which the Controller's dental team create structured clinical notes using pre-built and custom templates, track referrals, and record staff compliance information. Processing involves storing, retrieving, and transmitting Customer Personal Data as entered by the Controller's authorised users.

Purpose of Processing

To enable the Controller's dental team to draft, store, and retrieve structured clinical notes for patient care documentation; to track referrals made to other clinicians or organisations; and to record the Controller's team members' regulatory and training compliance. Nosht has no independent purpose in processing Customer Personal Data.

Nature of Processing

Collection (entry via the Nosht Application), storage (Supabase database, London region), retrieval, display, and transmission (to the Controller's authorised users via encrypted connection). Nosht does not undertake automated decision- making or profiling using Customer Personal Data.

Categories of Data Subjects

Patients of the Controller's dental practice whose details are entered via the Referral Letter template, Send Leaflet, the referral tracker, reminders, the child-exam guardian-name field, or in free-text clinical note content; and the parents or guardians of child patients, whose names are entered in the child-exam guardian-name field. The Controller determines what patient information, if any, is entered. Also: the Controller's dental team members and staff, to the extent the Controller enters their details into the Staff Compliance feature or records them in a significant-event (incident) entry; and clinicians or organisations named as referral recipients in the Controller's referral tracker.

Categories of Personal Data

Clinical note content as entered by the Controller's authorised users: clinical findings and observations, treatment descriptions, and free-text clinical entries (health data); and, where the Controller uses the relevant feature, patient name, date of birth, NHS number, postal address, telephone number, email address, and GP name (Referral Letter template); the patient's email address or mobile number (Send Leaflet); patient initials or short references (referral tracker, reminders); and the name of a child patient's parent or guardian (child-exam guardian-name field); and, in the Referral Tracker, patient initials, referral and reminder dates and optional short free-text notes. The Controller determines the specific data entered and is responsible for ensuring that only necessary data is included. Referral tracker: patient reference, referral reason, clinical and outcome summaries, and the referral recipient's name. Significant events: incident descriptions and the staff members involved. Staff Compliance (where the Controller uses it): a team member's GDC number and expiry, professional indemnity provider and expiry, CPD and training records, the date DBS evidence was last seen (not a certificate number), and whether evidence of Hepatitis B immunity was seen (yes/no, not the clinical result).

Special category data

Clinical dental notes may constitute health data, which is special category data under UK GDPR Article 9. The Controller is responsible for identifying and applying an appropriate Article 9 condition for processing such data. Nosht processes this data solely as Processor on the Controller's instructions and applies security measures commensurate with the sensitivity of health data. The Hepatitis B evidence-seen flag recorded in Staff Compliance is also special category health data, of the staff member concerned, which the Controller processes as employer under Article 9(2)(b) UK GDPR and Schedule 1, paragraph 1 of the Data Protection Act 2018 (employment, social security and social protection); Nosht processes it solely as Processor on the Controller's instructions. The DBS evidence-seen date is data relating to criminal offences under UK GDPR Article 10, which the Controller processes as employer under Schedule 1, paragraph 1 of the Data Protection Act 2018. A departed team member's Staff Compliance record is deleted 12 months after they leave the practice.

Duration of Processing

For the duration of the Controller's active Nosht subscription. Draft and incomplete notes are deleted automatically after 90 days with no edit, whether or not the account stays open. Following account closure: any remaining drafts and other account-scoped data are deleted immediately and in any event within 30 days; completed clinical notes are de-identified (account identity removed; six structured Referral Letter patient-identifier fields scrubbed) and retained for the GDC/NHS dental-records statutory period, as permitted by UK GDPR Article 17(3)(b) and (e). See Section 9 of this DPA for full details.

Patient Leaflet Delivery Data: the patient's email address or mobile number is passed to Resend (email) or Twilio (SMS) to deliver the leaflet. Nosht keeps only a keyed, one-way code of it for 30 days, to stop repeat sends, and then deletes it. The delivery log keeps the leaflet, date and method until the Controller asks us to delete it or closes the account.

Technical and organisational security measures

TLS 1.2+ encryption in transit; AES-256 encryption at rest (Supabase); row-level security restricting database access to the authenticated account holder; role-based access controls within Nosht; regular dependency and security patching; access logging; and contractual security obligations imposed on all Sub-Processors. Full details are available on our Security & Data Protection page.

Data Protection Contact

Nosht's designated data protection contact point is reachable at the address below. Nosht has not appointed a Data Protection Officer (DPO), as it is not required to do so under UK GDPR Article 37. If you require a countersigned copy of this DPA for your practice's data governance records (for example, to satisfy a CQC inspection or NHS Data Security and Protection Toolkit requirement), or if you have questions about Nosht's data processing practices, please contact us.

If you wish to submit a Subject Access Request or data deletion request in relation to Customer Personal Data, please contact us at the address below, identifying the specific data and the nature of your request.

hello@nosht.io

Changes to this document

18 October 2026

These changes take effect on 17 November 2026.

Schedule 1 now covers referral, staff and parent or guardian data.
The sub-processor list and international transfer wording are updated.
We set out what our email provider handles when you email a note (a link, with a copy of the note kept for 24 hours) or an administrator emails one, and how long a leaflet link lasts.
We describe read-only support access to your account.
Session replay is a separate choice and is never recorded on clinical pages.