Data Processing Agreement (DPA)

Clinic (Controller) ↔ DentOrd (Processor).

This DPA governs processing of patient data and related categories the Clinic enters into DentOrd.

Subject: processing of personal and health data to provide the DentOrd SaaS service.

Duration: while the Clinic has an active account or while retention/deletion obligations after termination continue.

Hosting, storage, in-app display, email delivery (reminders/transactional), backup and related technical operations needed for the service.

Identity and contact data, health data and documents entered by the Clinic, appointments, invoices and related admin records.

Clinic patients and Clinic employees/users whose data is processed in the service.

The Processor processes patient data solely to provide DentOrd to the Clinic and on the Controller’s documented instructions (including in-app configuration).

The Processor does not use patient data to train public third-party AI models without an explicit contractual basis and Controller approval.

Obligations include: staff confidentiality, appropriate technical and organisational measures, assistance with data-subject rights, and engagement of sub-processors under equivalent protections.

Current sub-processors include: Supabase, Vercel, Resend, Sentry, PostHog (no patient names in analytics), and Stripe once billing starts.

Material sub-processor changes will be notified to the Controller within a reasonable time, with a right to object under applicable law.

Default processing is in the EU. If a transfer outside the EEA is ever required, appropriate mechanisms (e.g. SCCs) will be used where legally necessary.

The Processor will reasonably assist the Controller in responding to data-subject requests (access, rectification, erasure, portability) via in-app tools and support.

In case of a personal-data breach, the Processor will notify the Controller without undue delay — indicative 72 hours from awareness — with information available at that time.

After termination, the Controller may export data within the stated window. The Processor then deletes or anonymises Clinic data, except where law requires longer retention.

The Controller may, at reasonable intervals, under NDA and prior notice, request information or an audit relevant to the Processor’s compliance with this DPA.

This DPA is deemed accepted when the Clinic owner checks acceptance of Terms + Privacy at signup. No additional signature is required for v1 unless parties agree otherwise.

Questions: support@dentord.com.