Data processing agreement (DPA)

Working draft pending legal review. This is a skeleton agreement, not the final document. Items marked “to be completed” will be finalised before signature. For questions, write to privacy@clinesto.ro.

1. Parties

• Controller: the clinic or practice that has subscribed to Clinesto (the “Controller”), as identified in the account and on the invoice.
• Processor: [Company name], company number [Company number], trade register number [Trade register number], registered address [Registered address] (“Clinesto”).

This agreement supplements the Terms of service. In case of conflict regarding personal data, this agreement prevails.

2. Subject matter and duration

Clinesto processes personal data on behalf of the Controller to provide the Clinesto app (app.clinesto.ro).

This agreement applies for the duration of the subscription and until the data is deleted or returned, as set out in section 10.

3. Nature and purpose of processing

Processing consists of hosting, storing, organising, displaying, transmitting and deleting data, for the purpose of:

• scheduling and patient management;
• keeping medical and administrative records;
• invoicing;
• communicating with patients by email, SMS or WhatsApp;
• AI-assisted features, such as drafting documents.

Details are set out in Annex A.

4. Categories of data subjects and data

Data subjects:

• the Controller’s patients and, where applicable, their legal representatives;
• the Controller’s staff (clinicians, reception, admin);
• contact persons of the Controller and its partners.

Categories of data:

• identification and contact data;
• administrative and billing data;
• appointment and communication data;
• health data (special categories, Art. 9 GDPR), entered by the Controller;
• technical account usage data (access and audit logs).

5. Controller’s instructions

Clinesto processes data only on the Controller’s documented instructions. This agreement, the account configuration and the use of the app constitute the Controller’s instructions.

Clinesto informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or other applicable law.

6. Confidentiality and security

• Persons authorised to process the data have committed to confidentiality or are under a statutory duty of confidentiality.
• Clinesto applies the technical and organisational measures required by Art. 32 GDPR, described in Annex B.
• Clinesto may update these measures without lowering the overall level of protection.

7. Sub-processors

• The Controller gives prior general authorisation for the use of the sub-processors listed in Annex C.
• Clinesto informs the Controller at least 30 days before adding or replacing a sub-processor.
• The Controller may object, on reasonable grounds, within that period. If the parties cannot find a solution, the Controller may terminate the affected service without penalty.
• Clinesto imposes on each sub-processor data protection obligations equivalent to those in this agreement and remains liable to the Controller for them.

8. Assistance to the Controller

Taking into account the nature of the processing, Clinesto assists the Controller:

• in responding to data subject requests (access, rectification, erasure, restriction, portability, objection), mainly through the app’s features; Clinesto forwards to the Controller any request it receives directly, without answering on its behalf;
• in carrying out data protection impact assessments (DPIA) and in prior consultation with the supervisory authority;
• in meeting its obligations on security of processing.

9. Personal data breaches

Clinesto notifies the Controller without undue delay after becoming aware of a personal data breach, with a target of no more than 48 hours.

The notification includes, as far as available: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. Information may be provided in phases.

Notification to the supervisory authority and to data subjects remains the Controller’s responsibility.

10. Deletion or return of data

At the end of the service, the Controller can export all data free of charge, in a structured format.

Clinesto keeps the data for 30 days after termination, for export, and then deletes it, including copies, unless the law requires it to be retained. Backups are deleted at the end of the rotation cycle described in Annex B.

11. Audits

Clinesto makes available to the Controller the information needed to demonstrate compliance with Art. 28 GDPR.

The Controller may carry out an audit, directly or through an independent auditor bound by confidentiality, with at least 30 days’ prior notice, at most once a year, except after a security breach or at the request of an authority. The Controller bears the cost of the audit.

12. International transfers

By default, data is hosted in the European Union and is not transferred outside the European Economic Area.

Any future transfer will take place only after prior notice to the Controller, under section 7, and with the safeguards required by Chapter V GDPR.

13. Governing law

This agreement is governed by Romanian law. Disputes are settled by the competent courts of [the registered office of Clinesto], unless mandatory law provides otherwise.

Annex A. Description of processing

Item	Description
Data subjects	Patients, staff, contact persons
Categories of data	Identification, contact, administrative, billing, appointments, communications, health data (Art. 9), technical logs
Operations	Hosting, storage, organisation, display, transmission, export, deletion
Purpose	Providing the Clinesto app to the Controller
Duration	Duration of the subscription plus 30 days, then deletion
Data location	European Union

Annex B. Technical and organisational measures

• Roles and access control: role-based access rights (clinician, reception, admin), principle of least privilege.
• Audit log: recording of access to and changes in sensitive data.
• Encryption: in transit (TLS) and at rest (storage and backups).
• Backups: daily, with periodic restore tests. Retention period: [to be completed].
• Two-factor authentication (2FA): available for all users; [mandatory for admins, to be confirmed].
• EU hosting: data centres located in the European Union.
• Staff confidentiality: written confidentiality commitments and data protection training.
• Vulnerability management: regular security updates, dependency monitoring and priority fixing of critical vulnerabilities.

Annex C. Sub-processors

To be completed. The rows below are placeholders.

Provider	Service	Data location	Transfer safeguards
[Hosting provider, EU region]	Hosting and storage	[to be completed]	[to be completed]
[Email provider]	Sending emails	[to be completed]	[to be completed]
[SMS/WhatsApp provider]	Patient messages	[to be completed]	[to be completed]
[AI model provider, EU endpoint]	AI-assisted features	[to be completed]	[to be completed]