Data Processing Agreement

The clinic is the controller. ClinTouch is the processor, acting only on the clinic's documented instructions.

Subject matter: provision of clinic management software. Duration: the term of the subscription. Categories of data subject: patients and clinic staff. Categories of data: identity, contact, health data (GDPR Art. 9 special category), appointment and administrative data.

We process personal data only on documented instructions from the clinic, including on transfers to a third country.

Everyone we authorise to process personal data is bound by confidentiality.

We implement the technical and organisational measures described in the Privacy Policy, including role-based access control, application-layer encryption of direct identifiers, and append-only audit logging.

We assist the clinic in responding to data-subject requests, and in meeting its obligations on security, breach notification and impact assessments.

We notify the clinic without undue delay after becoming aware of a personal data breach.

At the clinic's choice, we delete or return all personal data at the end of the service, unless retention is required by law.

We make available the information needed to demonstrate compliance and allow for audits.

We use sub-processors for hosting, database services, transactional email and file storage. A current list is available on request, and the clinic will be given notice of any intended change with the opportunity to object.

Each sub-processor is bound by terms no less protective than those in this agreement.

Each clinic is assigned a data region. Where personal data is transferred outside that region, the transfer is made under an appropriate safeguard such as Standard Contractual Clauses.

Clinics operating under a data residency requirement should confirm their region setting before going live, and should not assume the default is correct for them.