Data Processing Agreement

1. Parties and roles

• The Clinic (the customer named in Annex I) is the controller of the personal data of its clients and staff that it enters into the service. It decides which data to record, for what purpose and for how long, and it informs its clients about the processing.
• ФОП Димо Анна Ігорівна, м. Миколаїв, вул. Галини Петрової, 5, Ukraine ("AGATA") is the processor: it provides the software and processes the Clinic's data only on the Clinic's documented instructions, as described in this agreement. AGATA does not use these data for its own purposes and does not share them with other clinics.

For the accounts of the Clinic's staff (registration, sign-in, subscription and support requests) AGATA is an independent controller; that processing is described in the Privacy Notice.

2. International transfer and Standard Contractual Clauses

AGATA is established in Ukraine, a country not covered by an EU adequacy decision. Remote access to the data from Ukraine is a transfer under Chapter V of the GDPR. The parties therefore incorporate by reference the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor), with the Clinic as data exporter and AGATA as data importer. Annexes I–III of this agreement are the Annexes to those Clauses. In case of conflict between this agreement and the Clauses, the Clauses prevail.

• Clause 7 (docking clause): applies.
• Clause 9 (sub-processors): Option 2, general written authorisation; notice of changes at least 30 days in advance (section 6 below).
• Clause 11 (redress): the optional independent dispute-resolution body is not selected.
• Clause 13 and Annex I.C (supervisory authority): the authority of the Member State in which the Clinic is established; for Hungary — the National Authority for Data Protection and Freedom of Information (NAIH).
• Clause 17 (governing law) and Clause 18 (forum): the law and the courts of the Member State in which the Clinic is established, unless Annex I states otherwise.

3. Subject matter, duration, nature and purpose

• Subject matter. Processing of personal data of the Clinic's clients, prospective clients and staff that the Clinic records in AGATA CRM.
• Duration. For as long as the Clinic's subscription is active, plus the retention period in section 8.
• Nature. Hosting, storage, display to authorised staff, export, sending of notifications the Clinic has configured, and the AI-assisted features the Clinic has switched on. Details of each operation are in Annex I.B.
• Purpose. Providing the CRM service under the Terms of Use. No other purpose.

4. Instructions

The Clinic's instructions are this agreement, the Terms of Use, and the settings the Clinic's authorised users choose in the application (for example which messaging channels are connected, whether AI features are enabled, which reminders are sent). AGATA informs the Clinic without delay if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

5. AGATA's obligations as processor (Article 28(3))

• 5.1 Documented instructions. AGATA processes the data only on the Clinic's documented instructions, including with regard to transfers, unless required to do so by law; in that case AGATA informs the Clinic before processing, unless the law prohibits it.
• 5.2 Confidentiality. Every person on AGATA's side with access to the data is bound by confidentiality. AGATA's staff access a clinic's data only for technical support at the Clinic's request or to fix a fault.
• 5.3 Security. AGATA implements the technical and organisational measures in Annex II and keeps them under review.
• 5.4 Sub-processors. Only those listed in Annex III, under the conditions in section 6.
• 5.5 Data subject rights. AGATA assists the Clinic in answering requests from data subjects: it provides the data it holds, and corrects or deletes records on the Clinic's instruction, within 30 days of the request.
• 5.6 Security incidents. On becoming aware of a personal data breach affecting the Clinic's data, AGATA notifies the Clinic without undue delay and in any event within 72 hours, describing what happened, which data were affected and what AGATA is doing. The Clinic, as controller, decides on notification of the supervisory authority and of data subjects (Articles 33–34).
• 5.7 Assistance. Taking into account the nature of the processing and the information available to it, AGATA assists the Clinic with its obligations under Articles 32–36 (security, breach notification, data protection impact assessment, prior consultation).
• 5.8 Deletion and return. See section 8.
• 5.9 Information and audits. AGATA makes available the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the Clinic or an auditor mandated by it, on reasonable notice and no more than once a year unless a supervisory authority requires otherwise or a breach has occurred.

6. Sub-processors

The Clinic gives general authorisation for the sub-processors in Annex III. AGATA informs the Clinic of any intended addition or replacement at least 30 days in advance, in the application or by email. The Clinic may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Clinic may terminate the subscription for the affected service. AGATA imposes on each sub-processor data protection obligations equivalent to those in this agreement and remains liable to the Clinic for the sub-processor's performance.

7. The Clinic's obligations as controller

• to have a lawful basis for every category of data it records, including a condition under Article 9(2) for health data (medical record, health questionnaire, before/after photographs);
• to inform its clients about the processing, including the use of a processor in Ukraine and the safeguards in section 2;
• to give access to the application only to its own authorised staff, to keep their credentials confidential and to remove access when a person leaves;
• to send messages (SMS, messengers) only where it has the right to do so.

8. Term, return and deletion of data

• The Clinic can export all of its data from the application at any time (Settings → Data).
• After the subscription ends, AGATA keeps the data for at least 90 days so that the Clinic can export them, and deletes them on the Clinic's written request. Where the Clinic makes no request, AGATA deletes the data after it has verified that no legal obligation requires their retention.
• Records deleted in the application disappear from the interface immediately; a technical trace remains in the database until final erasure, which AGATA performs on written request within 30 days. Backup copies are overwritten on schedule.

9. Liability, governing law, order of precedence

Liability between the parties is governed by the Terms of Use, without prejudice to Article 82 GDPR and to the liability provisions of the Standard Contractual Clauses. This agreement and the Clauses are governed by the law of the Member State chosen in Annex I. For the processing covered here, this agreement prevails over the Terms of Use, and the Clauses prevail over this agreement.

Annex I — Description of the processing

A. List of parties

• Data exporter (controller): the Clinic — name, registered address, registration number, contact person and email, signature and date — to be completed at signature.
• Data importer (processor): ФОП Димо Анна Ігорівна, м. Миколаїв, вул. Галини Петрової, 5, Ukraine; contact for data protection matters: crmagata@gmail.com.

B. Description of the transfer

• Categories of data subjects: the Clinic's clients and prospective clients (including people who book online or write to the Clinic's connected messengers), and the Clinic's staff.
• Categories of personal data: identification and contact data (name, phone, email, date of birth where recorded); appointment history and the services received; payments recorded by the Clinic (amount, method, date — never card numbers); consents signed; conversations from messengers the Clinic connected (Telegram, Instagram Direct) and leads from Meta lead forms; notes and photographs the Clinic uploads.
• Sensitive data: data concerning health that the Clinic records — medical record, health questionnaire, before/after photographs. Safeguards: field-level encryption of contact data and of the free-text medical fields with a key specific to each clinic; isolation of clinics at database level; role-based access; the measures in Annex II.
• Frequency: continuous, for the duration of the subscription.
• Nature of the processing: hosting and storage; display to the Clinic's authorised users; export at the Clinic's request; queuing and sending of the reminders and messages the Clinic configured; AI-assisted analysis and replies only where the Clinic enables them (the AI provider receives the text needed for the reply and does not train on it under its business terms).
• Purpose: provision of the CRM service to the Clinic.
• Retention: for the duration of the subscription and at least 90 days after it ends; final erasure on request (section 8).
• Onward transfers to sub-processors: as listed in Annex III, for the purposes and durations stated there.

C. Competent supervisory authority: the authority of the Member State in which the Clinic is established (Hungary: NAIH, Budapest).

Annex II — Technical and organisational measures

• encryption in transit (HTTPS) for every connection;
• encryption at field level, in the database itself, of client phone and email and of the free-text fields of the medical record, with a separate key per clinic — a copy of the database without the key does not reveal them; contact data in unprocessed leads and in the waiting list are not yet covered, and encryption is being extended to them in stages;
• isolation of clinics at database level (row-level security): one clinic cannot read another clinic's data;
• role-based access within the clinic: owner, manager, administrator and specialist see different scopes of data; page-level permission checks;
• audit log of sensitive operations — adding and removing staff, changing roles and permissions, deleting a client record, editing a financial transaction — recording who did it and when;
• files kept in private object storage and opened only through short-lived signed links;
• daily backups to object storage, overwritten on schedule; restore procedure tested periodically;
• staff authentication through a dedicated identity provider with support for passkeys; session cookies; no shared accounts;
• AGATA staff access limited to support at the Clinic's request or fault resolution; confidentiality obligations for everyone with access.

Annex III — Sub-processors

• Vercel Inc. (USA) — application hosting;
• Neon Inc. (USA) — database;
• Clerk Inc. (USA) — authentication of the Clinic's staff, session cookies;
• Cloudflare Inc. (USA) — file and photo storage (R2);
• Anthropic PBC (USA) — AI features, only where the Clinic enables them;
• Meta Platforms — Instagram Direct messages and lead forms, only where the Clinic connects them;
• Telegram — message delivery, only where the Clinic connects it;
• TurboSMS or AlphaSMS (Ukraine) — SMS sending, where the Clinic uses them with its own account; phone number and message text are transferred;
• WayForPay, LiqPay or monobank (Ukraine) — online prepayments for bookings, where the Clinic enables them; card data are entered on the payment provider's side and never reach AGATA.

Providers in the USA process data under their own data processing terms and transfer mechanisms (Clause 9 of the Clauses applies to these onward transfers). Questions about this agreement: crmagata@gmail.com.