Data Processing Agreement

1. Definitions

1. Terms defined in the Terms of Service have the same meaning in this DPA. "Personal information", "processing", "responsible party", "operator", "data subject", "special personal information" and "security compromise" have the meanings given to them in POPIA.
2. "Sub-processor" means a third party engaged by us to process Practice Data.

2. Scope and roles

1. This DPA applies to Practice Data that we process on behalf of the Practice in providing the Service. The subject matter, duration, nature and purpose of the processing, and the categories of data subjects and personal information, are set out in Annex 1.
2. The Practice is the responsible party and we are its operator. The Practice is responsible for the lawfulness of the processing it instructs, including having a lawful basis for recording special personal information.

3. Processing on instructions

1. We process Practice Data only on the Practice's documented instructions, which consist of the Agreement and the Practice's use of the Service's functions, and only with the Practice's knowledge or authorisation as required by section 20 of POPIA.
2. If the law requires us to process Practice Data other than on the Practice's instructions, we will inform the Practice before doing so, unless the law prohibits it.
3. We will inform the Practice if, in our opinion, an instruction infringes applicable data protection law.

4. Confidentiality

1. We ensure that every person authorised to process Practice Data is bound by an obligation of confidentiality, and accesses Practice Data only to the extent necessary to provide, support or secure the Service. This includes the duty of confidentiality that section 32(2) of POPIA requires of anyone processing information about a person's health.

5. Security

1. We establish and maintain the security measures referred to in section 19 of POPIA, as described in Annex 2, and review them periodically in light of changing risks.

6. Sub-processors

1. The Practice gives general authorisation for us to engage the sub-processors listed in Annex 3 for hosting and database services. Subscription payments are taken by our online reseller, Paddle.com, which collects the Practice's billing details itself as an independent responsible party under its own privacy notice. Paddle is not a sub-processor and receives no Practice Data.
2. We impose on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and remain liable to the Practice for its performance.
3. We will notify the Practice by email at least 30 days before a new sub-processor begins to process Practice Data. If the Practice objects on reasonable data protection grounds and the objection cannot be resolved, the Practice may terminate the Agreement, and we will refund any Fees paid for the period after termination.
4. Email is not used to process Practice Data. We correspond with the Practice by email about its Account only, and we do not send copies of Practice Data by email. The Practice must not send patient information to us by email. If it does, we will deal with the request and then delete that email; we do not keep patient information in our email. Automated emails about the Account, such as password reset links and notices that a password was changed, are sent on our behalf by Resend, Inc. They contain the Account's email address and no Practice Data, so Resend is not a sub-processor.

7. Security compromises

1. We will notify the Practice immediately, and in any event within 72 hours, where there are reasonable grounds to believe that Practice Data has been accessed or acquired by an unauthorised person, as required by section 21(2) of POPIA.
2. The notice will describe, to the extent known: the nature of the compromise; the categories and approximate number of data subjects and records concerned; its likely consequences; and the measures taken or proposed.
3. We will provide reasonable assistance to enable the Practice to meet its obligations to notify the Information Regulator and data subjects under section 22 of POPIA.

8. Assistance

1. Taking into account the nature of the processing, we will assist the Practice in responding to requests from data subjects exercising their rights. The Service allows the Practice to view, correct and delete appointments directly. If a data subject contacts us directly, we will refer the request to the Practice and will not respond to it ourselves unless the Practice instructs us to.
2. Where reasonably required, we will assist the Practice with personal information impact assessments, and with any engagement with the Information Regulator, in relation to the Service.

9. Cross-border transfers

1. The application servers and the primary database that hold Practice Data, including the database's backups, are hosted in Johannesburg, South Africa.
2. The sub-processors listed in Annex 3 are international companies. Their technical logs and support functions may involve processing, or access to Practice Data, outside South Africa. Any such transfer takes place only in accordance with section 72 of POPIA, under each sub-processor's written data processing terms.

10. Return and deletion

1. When the Account ends, we retain Practice Data for 90 days. The Practice can download its appointments as a spreadsheet under Settings at any time, including during those 90 days. The Practice is responsible for keeping any copies it needs to meet its own record-keeping obligations.
2. After 90 days we permanently delete Practice Data, unless the law requires us to retain it. Backup copies are overwritten within a further 30 days.
3. Messages between reception and the practitioner are deleted automatically once the day to which they relate has ended in the Practice's time zone, or earlier when either side clears them. Copies may remain in encrypted database backups until those backups are overwritten, within 30 days. The Practice should record anything it needs to keep in its own patient records.

11. Information and audit

1. We will make available to the Practice the information reasonably necessary to demonstrate compliance with this DPA, and will answer written questions within 30 days.
2. If that information is insufficient, or the Information Regulator requires it, the Practice may conduct an audit at its own cost, on at least 30 days' written notice, during business hours, no more than once in any 12-month period, and subject to appropriate confidentiality undertakings.

12. General

1. This DPA remains in force for as long as we process Practice Data. It is governed by the law that governs the Terms of Service.
2. The limitations of liability in the Terms of Service apply to this DPA, except to the extent that the law does not permit them to apply.

Annex 1: Details of processing

Annex 2: Security measures

1. Encryption of all connections to the Service in transit (HTTPS), and of the connection between the application and the database.
2. Encryption of the database and its backups at rest, by the database provider.
3. Storage of passwords and session tokens only as one-way cryptographic hashes.
4. Temporary lock-out of sign-in after repeated incorrect passwords, and rate limiting of sign-up and booking requests.
5. Logical separation of each Practice's data, enforced by database row-level security in addition to application checks.
6. Public booking pages that expose available times only and never other patients' details.
7. Access to production systems restricted to personnel who require it, and bound by confidentiality.
8. Regular backups, and deletion of an ended Account's data in accordance with clause 10.

Annex 3: Sub-processors