Data processing agreement

1. Parties and conclusion

The agreement is concluded between the clinic registered in Odonto Flow (“the clinic”, the controller) and Tymofii Shevchenko, trabalhador independente, NIF 309697107, R. Tenente Coronel Jorge Vargas Mogo 3DT, 8375-129 São Bartolomeu de Messines (Silves, Faro), Portugal (“we”, the processor).

If the agreement with the clinic passes to a new provider (terms of use, section 16), this agreement passes with it: the new provider becomes the processor on the same terms, and the clinic is informed in advance.

The agreement is part of the terms of use. The clinic accepts it at sign-up; it applies for as long as we process the clinic’s data. A signed copy can be requested at privacy@odontoflow.io.

2. Subject matter

We process the personal data that the clinic enters into the service only to provide the service to it: storing it, showing it to the clinic’s staff, sending messages to patients on its instructions, making backups and helping with support. Details are in Annex 1.

3. The clinic’s instructions

We process data only on the clinic’s documented instructions. The instructions are the terms of use, this agreement and the actions of the clinic’s staff in the service (enter, change, send, delete).
If the law requires us to process data otherwise, we will inform the clinic in advance, unless the law prohibits it.
If, in our opinion, an instruction infringes the GDPR, we will tell the clinic.

4. The clinic’s obligations

The clinic is responsible for the lawfulness of processing: the legal basis (including for health data — Art. 9 GDPR), informing patients, consent to WhatsApp messages, data accuracy, retention periods for medical records and the access of its staff.

5. Confidentiality

Only staff who need it to run the service have access to the clinic’s data. All of them are bound by confidentiality.

Support access — only with the clinic’s permission. Without permission, support does not enter the clinic’s account. The clinic’s owner can turn on “Support access” in the settings for 7 days and turn it off earlier. While access is on, a support employee can enter the account on behalf of a clinic user — via a one-time link, for a limited time; every entry is recorded in a log (who, as whom, when), and the clinic sees this log. After 7 days access closes by itself. The service’s admin panel shows the log of sent messages (number, text, status) — to support delivery. Patient cards are not shown in the admin panel.

6. Security

We take the technical and organisational measures of Art. 32 GDPR — listed in Annex 2 — and develop them together with the service without lowering the overall level of protection.

7. Sub-processors

The clinic gives general authorisation to engage the sub-processors in Annex 3.
We will notify the clinic’s owner by e-mail of a new or replaced sub-processor at least 30 days in advance. The clinic may object on reasonable grounds; if no agreement is reached, it may terminate the agreement and get a refund for the unused paid period.
We have an agreement with each sub-processor with data protection obligations no lower than these. We are liable to the clinic for its work.

8. Transfers outside the EEA

The clinic’s data is stored in the EU (Germany and Finland). If a sub-processor transfers data outside the EEA, this is only allowed under a European Commission adequacy decision or on EU standard contractual clauses with supplementary measures.

9. Assisting the clinic

Patient requests (access, rectification, erasure, restriction, portability): if a request comes to us, we pass it to the clinic and do not answer the patient ourselves. Tools in the service: the patient card can be printed or saved as a complete PDF (export), and the patient can be deleted permanently (“Delete forever”: card, visits, messages, files).
We help the clinic with security measures, data protection impact assessments (DPIA) and consultations with the supervisory authority — insofar as they concern the service.

10. Incidents

We notify the clinic’s owner of a breach or other security incident affecting the clinic’s data without undue delay — no later than 72 hours after we become aware of it: what happened, which data and how many records are affected, what we have done and what we recommend. Notifying the supervisory authority and patients, where needed, is the clinic’s duty; we help.

11. End of the agreement

After the subscription ends, the clinic’s data is kept for 12 months (so that the clinic can return), then deleted completely, including files. Earlier at the clinic’s request.
Before deletion, the clinic can get its data back (Art. 28(3)(g) GDPR): the owner exports all the clinic’s data — CSV and an archive of files — in the account, including after the subscription ends, or on request to support within 30 days (terms of use, section 7). A single patient card can be printed or saved as PDF.
Data disappears from backups as they are renewed — within 30 days.
We keep longer only what the law requires — for example, payment documents (Paddle keeps them too).

12. Audits

At the clinic’s request we provide the information needed to demonstrate compliance with this agreement — a description of measures, answers to security questionnaires. The clinic or its auditor may carry out an on-site audit no more than once a year, with 30 days’ notice, at their own expense and under a confidentiality obligation.

13. Liability and precedence

The parties’ liability follows the terms of use and the GDPR (Art. 82). If this agreement conflicts with the terms of use on data protection matters, this agreement prevails.

Annex 1. Description of processing


Data subjects	the clinic’s patients; the clinic’s staff (users of the service)
Categories of data	patients: first name, last name, date of birth, sex, phone, address, notes, visits, procedures, amounts, files (X-rays, photos, documents), consent to WhatsApp messages and its date, message texts and statuses; staff: name, e-mail, role, actions in the service
Special categories	health data: medical alerts (allergies, contraindications, chronic conditions, medication), tooth chart, treatment history, X-rays
Processing operations	storage, display to the clinic’s staff, search and sorting, sending messages to patients via WhatsApp on the clinic’s instructions, backup, deletion
Purpose	providing the service to the clinic
Duration	while the subscription is active, then 12 months of storage and deletion

Annex 2. Security measures

encrypted connections (HTTPS); passwords only as hashes; payment system keys stored encrypted;
each clinic’s data is isolated from the others, and the isolation is verified by automated tests;
role-based access within a clinic (owner, administrator, doctor; a doctor sees their own visits and visits without a doctor);
patient files are not publicly accessible: they are served through temporary signed links;
servers in the EU; the database and internal services are not exposed to the internet; the firewall allows only HTTPS and SSH;
backups: daily, to separate storage in the EU (not on the same server); backups are encrypted on the server and stored in another data centre, and restoring from them is tested automatically once a month;
automatic installation of security updates on the servers;
round-the-clock monitoring of service availability and of backup delivery — with failure alerts;
the users’ activity log, the support entry log and the log of actions in the admin panel;
server access only for responsible staff, by SSH keys, without password sign-in; sign-in attempts to the admin panel are limited;
two-factor sign-in to the hosting, domain, e-mail and payment accounts.

Annex 3. Sub-processors

Who	Why	Where
Hetzner Online GmbH	servers, database, file storage, backups	Germany and Finland
mailbox.org (Heinlein Hosting GmbH)	service e-mails to the clinic’s staff (no patient data in e-mails)	Germany

WhatsApp is not a sub-processor but the clinic’s own service. The clinic connects its WhatsApp account and accepts Meta’s terms itself; we have no agreement with Meta. On the clinic’s instructions we pass the patient’s number and the message text to its account, after which they are processed by Meta (WhatsApp Ireland Ltd) under its own terms as the clinic’s provider. The connection is as a linked device, not through the official WhatsApp Business Platform (terms of use, section 9).

Paddle is not a sub-processor: it receives no patient data and processes the clinic’s payment data as an independent controller.

Firebase Cloud Messaging (Google, push notifications in the apps) will appear in this list when push is turned on — with notice under section 7.