Clinic Data Processing Agreement

Controlled Pilot Acceptance

For Controlled Pilot / Private Beta participants, the DPA becomes effective when the participating Doctor/clinic affirmatively accepts the identified DPA version/date during pilot onboarding. Generic account creation alone is not sufficient controlled-pilot DPA acceptance.

Minimum pilot acceptance: review Clinic DPA v1.2 / revised 2026-09-30, then send or reply from the registered CloudClinic email address to cloudclinic.ph@gmail.com with an explicit statement accepting the current CloudClinic Clinic DPA and identifying the DPA version/date accepted. CloudClinic retains the email record as the pilot audit evidence.

No wet signature or countersignature is required by default. A countersigned copy remains available on request for the Clinic's own compliance records by emailing cloudclinic.ph@gmail.com.

Parties and Roles

Data Controller / Personal Information Controller for clinic Patient clinical-care data: the participating Clinic/Doctor.

Data Processor / Personal Information Processor for clinic-controlled Patient clinical data: CloudClinic.

The Clinic decides the purposes and manner of processing Patient clinical-care data. CloudClinic processes that data on behalf of and under the instructions of the Clinic. CloudClinic may separately act as controller/PIC for its own platform, account, security, support, and operational relationship data as described in the Privacy Policy. This role wording remains subject to formal legal/privacy review.

Scope of Processing

CloudClinic processes clinic-controlled Patient personal information, Patient clinical information, generated medical documents, audit records, and related clinic workflow data to provide the CloudClinic clinical documentation and workflow platform. CloudClinic may separately process Doctor/staff platform account, security, support, and operational relationship data as controller/PIC for its own platform relationship, as described in the Privacy Policy.

Sub-Processors

Sub-processor	Role	Location / safeguard
Supabase	Database, authentication, storage	AWS Mumbai, India / Supabase DPA
Resend	Transactional email delivery	United States / Resend DPA
Netlify	Static website hosting and serverless functions	United States / Netlify DPA

Retention and Data Subject Rights

CloudClinic's adopted operational policy is 15 years for Patient medical records, generated clinical documents, and audit logs unless a longer legal/regulatory obligation or active dispute requires longer. Doctor and staff account data is retained for the duration of subscription plus 1 year; session and system logs are retained for 90 days.

The Clinic remains responsible for data subject rights requests for clinic-controlled Patient clinical-care data. CloudClinic cooperates by providing exports and applying soft-delete, redaction, or deletion workflows where lawful and supported.

Reference Copy

This page summarizes the current standard DPA template for pilot review. The canonical repository copy is docs/CLINIC-DPA-TEMPLATE.md.