1. Parties and scope
This Data Processing Agreement ("DPA") is between the clinic that uses MaffeiCare Plus (the "Controller") and MaffeiTech Information Technology L.L.C, Dubai, United Arab Emirates (the "Processor", "MaffeiTech"). It forms part of the Terms of Service and applies to all personal data, including health information, that the clinic stores in the Service. Where this DPA and the Terms differ on data protection, this DPA prevails.
2. Details of the processing
Subject matter
- Description
- Hosting and processing the clinic's records so the clinic can run its practice.
Duration
- Description
- For as long as the clinic's account exists, plus up to 90 days after it is closed (see section 8).
Nature
- Description
- Storage, organisation, retrieval, display, transmission (for example reminders the clinic sends by email or WhatsApp), backup and archiving.
Purpose
- Description
- Providing the Service to the clinic, following the clinic's instructions.
Data subjects
- Description
- The clinic's patients and their contacts, and the clinic's staff.
Personal data
- Description
- Identity and contact details (entered by the clinic, or by patients through the clinic's self-registration link), appointments, medical history, clinical notes and charts, prescriptions, photos and documents, treatment plans, invoices and payments, and activity logs.
Special categories
- Description
- Health information.
| Item | Description |
|---|---|
| Subject matter | Hosting and processing the clinic's records so the clinic can run its practice. |
| Duration | For as long as the clinic's account exists, plus up to 90 days after it is closed (see section 8). |
| Nature | Storage, organisation, retrieval, display, transmission (for example reminders the clinic sends by email or WhatsApp), backup and archiving. |
| Purpose | Providing the Service to the clinic, following the clinic's instructions. |
| Data subjects | The clinic's patients and their contacts, and the clinic's staff. |
| Personal data | Identity and contact details (entered by the clinic, or by patients through the clinic's self-registration link), appointments, medical history, clinical notes and charts, prescriptions, photos and documents, treatment plans, invoices and payments, and activity logs. |
| Special categories | Health information. |
3. The clinic's responsibilities
- Have a lawful basis, and any patient consent your law requires, for the information you record and share.
- Inform patients about how their information is used.
- Keep the information accurate and give lawful instructions. Using the Service as designed counts as your instructions.
- Decide who in the clinic has access, and keep access up to date.
4. MaffeiTech's responsibilities
- Process the data only on the clinic's documented instructions, unless the law requires otherwise (in which case we tell the clinic first, where allowed).
- Ensure that our staff who can access the data are bound by confidentiality, and that their access is limited and recorded.
- Apply the security measures described on our Security page and keep them up to date.
- Help the clinic answer patients' requests to exercise their rights, and with any data-protection assessment the clinic must carry out.
- Notify the clinic without undue delay — and in any case within 72 hours of becoming aware — of a personal-data breach affecting its data, with the information the clinic needs to meet its own obligations.
- Never sell the data or use it for our own purposes.
5. Sub-processors
The clinic authorises us to use the service providers listed on our Service providers page. We hold each of them to data-protection obligations no weaker than this DPA, and we remain responsible for them.
We will give at least 30 days' notice before adding a new sub-processor that will process clinic data. If the clinic objects on reasonable data-protection grounds and we cannot resolve the objection, the clinic may close its account and will be refunded any prepaid fees for the unused period.
6. International transfers
The data is hosted in the European Union. Some sub-processors process data in other countries, including the United States. We transfer data only where the transfer is protected by our contracts with those providers and as permitted by the law that applies to the clinic.
7. Records are kept, not erased
Health and financial records are evidence. During the account, the Service does not let the clinic erase patient, clinical or financial records and never deletes them automatically. The clinic can archive items it no longer wants to see; archived items remain stored and recorded in the activity log.
8. End of the service
When the clinic's account is closed or its subscription ends without renewal, the clinic can ask for a copy of its data within 90 days. After that MaffeiTech deletes the clinic's data, unless the law requires us to keep it, and confirms the deletion in writing on request. Deleted data can remain in encrypted backups until those backups expire.
9. Information and audits
On request we provide the information the clinic reasonably needs to show compliance with this DPA. Where that is not enough, the clinic may carry out an audit, at its own cost, with at least 30 days' notice, during business hours, in a way that does not affect other clinics' data or the security of the Service.
10. Liability and governing law
Liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow them. This DPA is governed by the same law and dispute process as the Terms of Service.