Data Sharing Agreement

Last updated DRAFT — May 2026.

This page is a draft scaffold.Final wording will be confirmed by Parallel's legal team before the Service goes live with external clients. Please contact help@stratasoftware.net if you need a signed copy of the Data Sharing Agreement applicable to your organisation.

1. Purpose

This Data Sharing Agreement ("DSA") governs the sharing of personal data between you (an NHS Integrated Care Board or Strata Authorised User, "Customer") and Parallel Data Intelligence Limited ("Parallel", "we") in connection with the Strata Neighbourhood AI service (the "Service").

The Service is a planning and returns tool. It is distinct from the Strata ICS Strategy Atlas, a separate NHS England product. To ground its AI suggestions and exports, the Service draws on a mix of openly available reference data and restricted estate information made available via the Strata ICS Strategy Atlas. Where the Service incorporates Strata ICS Strategy Atlas-derived content owned by NHS England and Integrated Care Boards, the Customer's use of that content is additionally subject to NHS England's terms of use, as flowed down through Sections 12 and 13 of this DSA.

2. Roles

Controller — the Customer, in respect of workspace data (templates, schemes, uploaded documents) processed via the Service.
Processor— Parallel Data Intelligence Limited, processing the data on the Customer's behalf per documented instructions in the Strata Enterprise Licence.
Sub-processor — Anthropic (AI inference), Microsoft Azure (hosting + storage), and our SMTP delivery provider for invitation/reset emails. Full list available on request.
Upstream data provider— NHS England, in respect of the Strata ICS Strategy Atlas datasets incorporated into the Service. NHS England is the owner of that data and the Customer's use of it is subject to the obligations restated in Sections 12 and 13.

3. Data shared under this DSA

Identifying data of Authorised Users (name, email, ICB assignment).
Workspace data created by Authorised Users — scheme records, uploaded strategy documents, AI-generated drafts.
Openly available reference data used to ground AI suggestions and exports — the Indices of Multiple Deprivation (IMD), GP registered patient data, the Estates Returns Information Collection (ERIC), and the names and locations of NHS services. This is not personal data and is freely available for re-use, subject to its respective source licences.
Restricted estate reference data drawn from the Strata ICS Strategy Atlas — estate-level information that is not included in ERIC (for example condition grading, utilisation, backlog maintenance costs and other site-level attributes). This data is owned by Integrated Care Boards and NHS England, and is licensed for internal management information and planning purposes only — not freely available for public re-use. Customers acknowledge that AI suggestions, summaries, draft schemes and exported returns that incorporate this restricted data inherit the use restrictions in Section 12.

Special-category personal data is not in scope of this DSA. The Service is not designed to receive patient-level clinical data and Customers agree not to upload such data through any of its surfaces.

4. Lawful basis

Processing is on the basis of:

Contract (UK GDPR Art. 6(1)(b)) — for processing necessary to deliver the Service.
Legitimate interest (Art. 6(1)(f)) — for security monitoring, audit logging, and fraud prevention.

5. Processing instructions

Parallel will process Customer Data only:

To provide the Strata Neighbourhood AI service per the Enterprise Licence.
To respond to support requests from Authorised Users.
To comply with legal obligations or court orders.

Parallel will not use Customer Data to train AI models, build derived products, or for any other purpose without the Customer's written consent.

6. Security measures

TLS 1.2+ in transit; AES-256 at rest.
UK-based Azure infrastructure for primary storage; Anthropic processing under SCCs.
Role-based access scoped to ICB. Admin users have cross-ICB access but are subject to audit logging.
Authentication: 12+ character password policy, rate-limited login (5 attempts per 5 minutes per IP), 8-hour sliding session, JWT invalidation on role change or password reset.
All significant actions (sign-in, role change, scheme edit, AI accept) recorded in an audit log retained for 12 months.

7. Sub-processor changes

We will notify the Customer of any new sub-processor or material change to existing sub-processors at least 30 days before the change takes effect. The Customer may object to a new sub-processor; if a satisfactory alternative cannot be agreed, the Customer may terminate the affected portion of the Service.

8. Personal data breach and wrongful release

We will notify the Customer's designated data-protection contact without undue delay (and within 24 hours where practicable) of becoming aware of a personal data breach affecting Customer Data, providing the information needed for the Customer to meet their notification obligations to the ICO and affected data subjects.

The Customer must also notify Parallel without undue delay of any accidental or wrongful release of Strata ICS Strategy Atlas-derived content (including AI suggestions, summaries, draft schemes or exported returns) outside the permitted scope set out in Section 12. Parallel will escalate such incidents to NHS England as the upstream data owner. Wrongful release may lead to NHS England investigation and may affect the Customer's continued access to Strata ICS Strategy Atlas data through the Service.

9. Data subject rights

We will assist the Customer with responding to data-subject requests (access, rectification, erasure, restriction, portability, objection). Direct subject requests received by Parallel will be referred to the Customer for handling.

10. Termination and return of data

On termination of the Strata Enterprise Licence, the Customer may request a backup of all Customer Data within 10 working days. Parallel will deliver the backup within 30 days, then delete the data from active systems. Backups for disaster-recovery purposes are retained for up to 90 days before final deletion.

11. Audits

Parallel will provide reasonable assistance for the Customer's data-protection audits, on no more than once per year and at the Customer's expense, with reasonable notice and without disrupting normal business operations.

12. Permitted use of Strata ICS Strategy Atlas data

The Service incorporates restricted estate reference data from the Strata ICS Strategy Atlas (a separate NHS England product), owned by NHS England and Integrated Care Boards. The Customer and its Authorised Users agree the following restrictions apply to all content produced through the Service that incorporates this restricted data — including AI suggestions, summaries, draft schemes, exported returns and any reports or downloads.

These restrictions do not apply to outputs that draw solely from openly available reference data (see Section 3).

12.1 Permitted use

The Customer may:

Use this content for internal management information and data quality assurance only, to support the day-to-day management, operation and planning of the Customer's organisation.
Share it within the Customer's organisation, and with the Department of Health and Social Care, NHS England, NHS Improvement and the Care Quality Commission, provided the content carries the markings set out in Section 13.
Run, download, print or export individual reports, summaries and returns produced by the Service for the purposes above.

12.2 Conditions of use

The Customer must:

Present the content with full understanding of its shortcomings and limitations, including limitations of the underlying datasets and of AI-generated suggestions.
Reproduce the content accurately, without amendment, alteration or selective omission that could mislead.
Ensure user access requests and onward data visibility levels are made in line with the Customer's ICS-agreed approach.
Comply with the Data Protection Act 2018, UK GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

12.3 Prohibited use

The Customer must not:

Release Strata ICS Strategy Atlas-derived content into the public domain, including in press releases, public statements, social media or marketing material.
Use it to promote organisational performance — favourably or unfavourably — in any external communication.
Use it for the principal purpose of advertising or promoting any product or service.
Share it with non-NHS third parties, except for time-limited engagement (no more than three months) with a named supplier or partner directly supporting the Customer's planning work, with prior written notice to Parallel.
Use it in any misleading manner.

13. Attribution and restricted marking

When the Customer shares Strata ICS Strategy Atlas-derived content outside the immediate authoring team — including with the NHS regulatory bodies listed in Section 12.1 — the content must be accompanied by:

Restricted-use marking: "Restricted: for internal management information purposes only, in line with the Strata ICS Strategy Atlas system terms and conditions."

Exported returns produced by the Service for direct submission back to NHS England as part of a planning return are exempt from the restricted-use marking, since the submission target is itself the upstream data owner. Source acknowledgement should still be retained.

14. Governing law

This DSA is governed by the law of England and Wales and is subject to the exclusive jurisdiction of the English courts.

Need a signed copy?

Email help@stratasoftware.net with your organisation's name and the contact details of your DPO or data-protection lead, and we'll send a countersignable PDF.