Data Processing Agreement

1.Roles of the parties

For the personal data that the clinic and its users record in Clinova, the clinic is the controller and Clinova is the processor. Each party complies with the obligations that the applicable data protection law places on it, including Lebanon’s Law No. 81 of 2018 and, where it applies, the GDPR.

The clinic is responsible for the lawfulness of its instructions and for having a legal basis for the processing, including for health data.

2.Subject matter, duration, nature and purpose

• Subject matter: the hosting and processing of the clinic’s data to provide the Service.
• Duration: the term of the Terms of Service, plus the period needed to delete the data afterwards.
• Nature: collection, recording, storage, organisation, retrieval, consultation, transmission, pseudonymisation, processing by AI features at the users’ request, and deletion.
• Purpose: to provide, secure and support the Service for the clinic.

3.Data subjects and categories of data

Data subjects:

• the clinic’s patients and, where the clinic records them, their relatives or legal guardians;
• the clinic’s staff and other users;
• other people the clinic records, such as referring doctors or insurers’ contacts.

Categories of data: identity and contact details; health data (history, diagnoses, medication, allergies, vital signs, notes, documents, images, lab and radiology results, forms and recordings); administrative and financial data (appointments, invoices, insurance); and technical data (logs). Health data is a special category of data, and the clinic is responsible for the legal basis for processing it.

4.Documented instructions

Clinova processes the data only on the clinic’s documented instructions: the Terms of Service, this DPA, and the clinic’s use and configuration of the Service. If the law requires other processing, we inform the clinic before processing, unless the law forbids it. We tell the clinic if, in our opinion, an instruction infringes the law.

5.Confidentiality

Every person authorised to process the data is bound by a duty of confidentiality. Access is limited to what is needed for support, maintenance and security, and patient data is accessed only when necessary to answer the clinic’s request or to fix a problem.

6.Security measures

Clinova applies technical and organisational measures appropriate to the risk, including:

• Encrypted connections between browsers, phones and the server
• Each clinic’s data is kept apart: every request is limited to the signed-in clinic
• Access by role: each person gets the screens and actions their role allows
• An audit log of changes to patients, visits, prescriptions, invoices and user accounts, with who made them and when
• Two-step sign-in with an authenticator app: optional for each person, and the clinic’s administrator can require it for everyone
• Fingerprint or face lock on the doctor app, with sign-in tokens kept in the phone’s secure storage
• Only doctors, nurses and managers can open the clinical AI, never the front desk or the cashier
• Rate limits on every request, and checks that block injection attempts before they reach the data

We review these measures and may improve them over time without lowering the overall level of protection.

7.Sub-processors

The clinic gives a general authorisation to use sub-processors. The current sub-processors are:

• Microsoft Azure: hosting, database, file storage and e-mail;
• Anthropic: AI features (text generation);
• Microsoft Azure OpenAI: AI features (text generation);
• OpenAI: transcription of recordings;
• Google Firebase Cloud Messaging: notifications to the Android app.

We impose on each sub-processor data protection obligations that are no less protective than this DPA, and we remain responsible for their performance. We announce a new sub-processor by updating this page and informing clinic administrators at least 30 days in advance, except in an emergency; the clinic may object on reasonable grounds and, if we cannot resolve the objection, close its account.

Services that the clinic connects itself, such as an SMS or WhatsApp gateway or Google Calendar, are chosen by the clinic and are not our sub-processors.

8.International transfers

Sub-processors may process the data outside Lebanon and outside the European Union. We put in place the safeguards required by the applicable law, such as standard contractual clauses where the GDPR applies.

9.Assistance to the clinic

Taking into account the nature of the processing, we help the clinic to answer requests from data subjects, mainly through the export, correction and deletion features of the Service, and we forward to the clinic any request we receive. We also provide reasonable assistance with data protection impact assessments and consultations with authorities; significant work may be charged.

10.Personal data breaches

We notify the clinic without undue delay after becoming aware of a personal data breach affecting its data, with the information available: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. We cooperate with the clinic, which as controller notifies the authorities and the patients where the law requires it.

11.Deletion or return at the end

At the end of the Service, the clinic can export its data or ask for a complete copy. We then delete the data within the periods described on the Account deletion page, unless the law requires us to keep it, and confirm the deletion on request. Copies in backups expire on their normal schedule.

Read the Account deletion page→

12.Information and audits

We make available the information needed to demonstrate compliance with this DPA, such as this document, the description of our security measures and answers to reasonable questionnaires. Where this is not enough, the clinic, or an independent auditor bound by confidentiality, may carry out an audit on at least 30 days’ notice, no more than once a year unless an authority requires it or after a breach, at the clinic’s cost and without access to other clinics’ data.

13.Liability

Liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service.

14.Order of precedence

In case of conflict between this DPA and the Terms of Service about the processing of personal data, this DPA prevails.