Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of the Terms of Service when you use Careflow to process personal data. Clinic is Controller/Fiduciary; Careflow is Processor/Service Provider for Patient Data and related clinic operational data.

We process personal data only to provide the service, on documented instructions from the clinic (including configuration and use of product features), and as required by law.

Personnel authorized to process personal data are bound by confidentiality obligations.

We implement appropriate technical and organizational measures as described in the Security Policy, including encryption in transit, access controls, and tenant isolation.

You authorize us to engage sub-processors necessary to host and deliver the service (cloud hosting, email, payments, messaging APIs). We remain responsible for their performance under this DPA and will impose appropriate data protection terms.

We will reasonably assist the clinic with data subject requests, security incidents, and data protection assessments, taking into account the nature of processing and information available to us.

We will notify the clinic without undue delay after becoming aware of a personal data breach affecting the clinic's data, and provide information reasonably available to help the clinic meet its obligations.

Upon termination, we will delete or return personal data in accordance with product capabilities and the Data Retention Policy, except where retention is required by law or for secure backups with limited access until expiry.

Upon reasonable written request, and no more than once annually (unless a breach or regulator requires otherwise), we will provide security documentation or other information reasonably necessary to demonstrate compliance, subject to confidentiality.