Data Processing Addendum

This Data Processing Addendum (“DPA”) is entered into between Expand-IT Inc., which operates the platform “The Clinic” (“Processor”) and the customer identified in the applicable Order Form or online sign-up (“Controller”). It forms part of the Terms of Service or Master Subscription Agreement (the “Agreement”) between the parties and governs processing of Personal Data in connection with the Services.

Capitalized terms not defined here have the meanings given in the Agreement or in applicable Data Protection Law. For this DPA:

• Data Protection Law means the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial health-privacy legislation, including Ontario’s Personal Health Information Protection Act, 2004 (PHIPA); and, where applicable to a given Controller, the EU General Data Protection Regulation (Regulation 2016/679), the UK GDPR, and other laws governing the processing of Personal Data.
• Personal Data means data relating to an identified or identifiable natural person processed by Processor on behalf of Controller under the Agreement.
• Subprocessor means any third party engaged by Processor to process Personal Data in the course of providing the Services.

The subject matter of the processing is the provision of the Services as described in the Agreement. The duration of processing is the term of the Agreement, plus any period reasonably required for return or deletion of Personal Data. The nature and purpose of processing is the provision of the Services. The types of Personal Data processed are the account and contact details of Controller’s personnel, and the patient identifiers, clinical records, appointment data, and billing and claims data entered into the Services by or on behalf of Controller. The categories of data subjects are Controller’s personnel and Controller’s patients.

The Processor will:

• Process Personal Data only on documented instructions from Controller, including those given through the use of the Services, and as required by law;
• Ensure that personnel authorized to process Personal Data are bound by confidentiality obligations;
• Implement and maintain the technical and organizational measures described in the Security Measures section of this DPA;
• Assist Controller in responding to data-subject requests and fulfilling its obligations under Articles 32 to 36 GDPR and equivalent provisions of other Data Protection Law;
• Make available information necessary to demonstrate compliance with this DPA.

Controller provides general authorization for Processor to engage Subprocessors, subject to the following: (i) Processor maintains a current list of Subprocessors available at the-clinic.net/security/subprocessors; (ii) Processor will provide at least thirty (30) days’ notice of any intended addition or replacement of a Subprocessor; (iii) each Subprocessor is bound by written terms no less protective than this DPA; and (iv) Controller may object to a new Subprocessor on reasonable data-protection grounds, in which case the parties will work in good faith to resolve the objection.

Personal Data is hosted in the European Union. Processor does not currently offer per-region data residency, and Personal Data processed for clinics in Canada is therefore processed outside Canada, subject to the accountability and comparable-protection requirements of PIPEDA. The subprocessor list at /security/subprocessors names each provider and the region in which it operates. Where Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated by reference, with Module Two (Controller to Processor) or Module Three (Processor to Processor) applying as appropriate, and the UK International Data Transfer Addendum applies to transfers originating in the UK.

Processor maintains an information-security program whose controls are mapped to ISO/IEC 27001 Annex A and to the SOC 2 Trust Services Criteria. Processor is not certified under either framework and does not represent otherwise. Controls include:

• Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256);
• Per-tenant logical isolation enforced in the application layer and independently by database row-level security;
• Per-clinic data-encryption keys, wrapped at rest;
• Append-only audit logging enforced by database constraint, covering access to Personal Data;
• Role-based access controls within the Services, with two-factor authentication that Controller’s administrators may require;
• A secure software-development lifecycle, including code review, automated dependency and secret scanning, static analysis, and automated tenant-isolation tests on every change;
• Documented incident-response, backup and restore procedures.

Taking into account the nature of the processing, Processor will assist Controller by appropriate technical and organizational measures in fulfilling Controller’s obligation to respond to requests for exercising data-subject rights under Data Protection Law. Where Processor receives a request directly from a data subject, it will forward the request to Controller without undue delay and will not respond substantively unless directed to do so.

Processor will notify Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Controller’s Personal Data. The notification will include, to the extent known, a description of the nature of the breach, affected categories and approximate numbers of data subjects and records, likely consequences, and measures taken or proposed to address the breach and mitigate its effects.

Processor will make available to Controller, on request, a written description of its information-security program, and will respond to a reasonable security questionnaire no more than once in any twelve (12)-month period. Where Processor obtains a third-party audit report or certification, Processor will make the then-current report available to Controller on the same terms. Controller may request an additional audit no more than once in any twelve (12)-month period (unless required by a regulator), on thirty (30) days’ notice, during business hours, subject to reasonable confidentiality obligations and without disrupting Processor’s operations. Audit costs are borne by Controller, except where the audit reveals material non-compliance.

On termination of the Agreement, Processor will, at Controller’s election, return or delete all Personal Data, and will delete existing copies within ninety (90) days, except where retention is required by applicable law. Backups containing Personal Data are purged as they age out of the backup retention cycle, which may extend beyond the ninety (90) day period. Where a Business Associate Agreement applies, Protected Health Information is returned or destroyed within sixty (60) days as provided there.

Each party’s liability under this DPA is subject to the limitations of liability set out in the Agreement. The parties agree that any reference to the liability of a party in this DPA means aggregate liability of all entities within that party’s group.

In the event of a conflict between this DPA and the Agreement, this DPA controls with respect to the processing of Personal Data. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control.

Data-protection notices and requests under this DPA should be sent to dpo@the-clinic.net.