Data Processing Agreement

Subject matter, roles and duration

Customer is the controller of the data of its patients, clients, professionals and users. JIVSoft S.A. acts as processor and processes such data solely to provide the service.

The processing continues for the term of the Customer Agreement and, thereafter, for the time necessary to return or delete the data in accordance with Section 9.

Data and data subjects

• Data subjects: patients and their representatives, Customer’s clients, professionals, staff and account users.
• Identification and contact data: names, identity document, date of birth, sex, address, telephone number and email address.
• Health data (special or sensitive category): medical history, reasons for consultation, vital signs, diagnoses, treatments, prescriptions, certificates, images and clinical files.
• Administrative and financial data: appointments, invoices, payments and tax data.
• Processing operations: recording, organization, storage, consultation, document generation, sending of communications activated by Customer, backup, export and deletion.

Customer instructions

We process the data only in accordance with Customer’s documented instructions. This Agreement, the account configuration and the use of the service’s features constitute those instructions.

We do not use the data for our own purposes or for advertising purposes, or to train artificial intelligence models, and we do not sell or transfer it. If we believe that an instruction is contrary to law, we will inform Customer.

If the law requires us to carry out different processing, we will inform Customer beforehand, unless prohibited by law.

Confidentiality and personnel

Only personnel who need access to the data in order to provide the service or support may access it, subject to a duty of confidentiality and with access logged. Support that requires viewing account data is provided at Customer’s request.

Security measures

• Encryption of communications between the browser and the service.
• Passwords stored using irreversible hashing, screen lock and session control.
• Logical isolation of each account and access control based on roles and permissions defined by Customer.
• Logging of access and of security-relevant activity.
• Backups and recovery procedures.
• Vulnerability management, updates and separation of environments.
• Periodic review of these measures in light of the risk, the state of the art and the nature of the data.

Sub-processors

Customer grants general authorization for the engagement of sub-processors. Each sub-processor is contractually bound to data protection measures equivalent to those in this Agreement, and we remain liable to Customer for its performance.

We will give at least 15 days’ prior notice of the addition or replacement of sub-processors. Customer may object on reasonable data protection grounds; if we cannot find an alternative, Customer may terminate the affected service and receive a refund of amounts paid for the unused period.

Current categories of sub-processors: cloud infrastructure and storage (Amazon Web Services); transactional email; WhatsApp messaging (Twilio and Meta), only if Customer activates such messages; real-time notifications (Pusher); payment processing (Payphone or another gateway selected by Customer), only for payment data; artificial intelligence (OpenAI), only when a user uses an AI assistance feature and solely with the text that user submits; and tax authorities, when Customer issues electronic tax documents.

Assistance to Customer

We will assist Customer, through the service’s features or through support, in responding to requests from data subjects (access, rectification, erasure, objection, portability and any other rights granted by applicable law). If a data subject contacts us directly, we will direct the data subject to Customer and notify Customer.

We will also reasonably cooperate in data protection impact assessments and prior consultations with the authority where they relate to the service.

Security breaches

If we confirm a security breach affecting Customer data, we will notify Customer without undue delay and, in any event, within 48 hours after confirmation, at the registered email address.

The notification will include, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed. We will supplement the information as we obtain it.

Notifying the authority and the data subjects is the responsibility of Customer as controller, with our assistance, within the time periods set by applicable law. Notification of a breach does not constitute an admission of fault.

Return and deletion

While the account is active or suspended, Customer may export its information. Upon termination of the Agreement, we retain it for 90 days so that Customer may request a copy; thereafter, we delete it from active systems and from backups in their ordinary rotation cycles, except for anything the law requires us to retain.

Medical record retention obligations rest with Customer: Customer must export and safeguard the information for the period required by applicable law, even if it stops using the service.

Audit

We will make available to Customer the information reasonably necessary to demonstrate compliance with this Agreement, including by responding to security questionnaires once per year at no cost.

Additional on-site or technical audits will be agreed in writing with at least 30 days’ notice, during business hours, without access to other customers’ data, subject to confidentiality and at Customer’s expense, unless the audit is conducted by a competent authority or there is a confirmed breach.

International transfers

Data may be hosted and processed outside Customer’s country. By accepting this Agreement, Customer authorizes such transfers to the sub-processors listed, and we undertake to ensure that each transfer is subject to appropriate contractual safeguards under applicable law.

Where the law of Customer’s country imposes additional requirements (standard contractual clauses, authorization by the authority, consent of the data subject or prior notice), the country-specific Terms describe how they are met. Obtaining consent from or informing data subjects where required by law is Customer’s responsibility.

Liability

Liability arising under this Agreement is subject to the limitations of the Customer Agreement, except to the extent that applicable data protection law declares otherwise on a non-waivable basis.