Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("Agreement") is between the healthcare professional who holds a DocCy account (the "Professional"), who is the controller of the booking data described in Annex I, and ROLANZ LTD, registration number HE444248, Ephesus 9, 5280 Paralimni, Famagusta, Cyprus ("DocCy"), which processes it as the Professional's processor.

It forms part of the Terms of Use and is accepted together with them at sign-up. It meets Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Where it conflicts with the Terms on personal data, this Agreement prevails. For everything else DocCy does as a controller, such as running professional accounts and the public directory, our Privacy notice applies.

2. Processing on the Professional's instructions

DocCy processes booking data only on the Professional's documented instructions. These are this Agreement, the Terms, and the Professional's use and settings of the Service (for example accepting a request, proposing a time, marking attendance or writing a visit note). DocCy tells the Professional at once if it believes an instruction breaks the law.

On these instructions, DocCy sends patients the emails about their appointment, including one invitation to review an attended visit. DocCy's only use of booking data for its own purposes is to count bookings in anonymous statistics, from which no patient can be identified. DocCy never sells booking data, uses it for marketing, or shows it publicly.

If the law requires DocCy to process booking data in another way, DocCy will tell the Professional first, unless the law forbids it.

3. Confidentiality

Only DocCy's founders can access booking data, and only as far as needed to run and support the Service. They are bound by confidentiality. They do not open visit notes unless the Professional asks them to, for example to solve a problem, or the law requires it.

4. Security

DocCy keeps the technical and organisational measures in Annex II, which meet Article 32 GDPR, and improves them as risks and technology change.

5. Sub-processors

The Professional gives DocCy general authorisation to use the sub-processors in Annex III. DocCy will email the Professional at least 30 days before adding or replacing one. The Professional may object on reasonable data protection grounds; if we cannot resolve the objection, the Professional may stop using online booking and close the account.

Each sub-processor is bound by a written contract with data protection duties at least as protective as this Agreement. DocCy remains responsible to the Professional for them.

6. Transfers outside the EU

Booking data is stored in the European Union (Stockholm, Sweden). Where a sub-processor processes it outside the European Economic Area, the transfer is covered by the EU-U.S. Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

7. Helping with data subject requests

If a patient or other data subject asks DocCy to exercise their rights about booking data, DocCy passes the request to the Professional without undue delay and does not answer it without the Professional's instruction. DocCy helps the Professional answer such requests, mainly through the Service itself (for example by showing, correcting or cancelling appointments) and otherwise on request.

8. Helping with security, breaches and impact assessments

Taking into account the nature of the processing and the information available to it, DocCy helps the Professional meet their duties under Articles 32 to 36 GDPR: security of processing, notifying personal data breaches, data protection impact assessments and prior consultation with the Commissioner for Personal Data Protection.

9. Personal data breaches

DocCy notifies the Professional of a personal data breach affecting booking data without undue delay, and in any case within 48 hours of becoming aware of it, by email to the address on the account. The notice says, as far as known: what happened, the categories and approximate number of patients and records concerned, the likely consequences, and what DocCy has done or proposes to do. Information not yet known follows as soon as it is.

The Professional, as controller, decides whether to notify the Commissioner and the patients affected; DocCy helps.

10. Deleting or returning data at the end

When the Professional closes the account, DocCy will, at the Professional's choice, delete or return the booking data (as a common file format) within 30 days, and then delete the remaining copies, unless EU or Cyprus law requires DocCy to keep them. Copies in backups are overwritten in the normal backup cycle and are not used in the meantime. Anonymous statistics are not personal data and are kept.

11. Information and audits

DocCy makes available to the Professional the information needed to show it meets this Agreement, and answers reasonable written questions about it. The Professional, or an independent auditor bound by confidentiality, may audit DocCy's compliance once a year on 30 days' written notice, or at any time after a breach, during business hours and at the Professional's cost, without access to other professionals' data. Audits of sub-processors rely on their own certifications and reports.

12. Duration, liability and changes

This Agreement lasts as long as DocCy processes booking data for the Professional. The limitation of liability in the Terms applies to it, except where the GDPR does not allow a limit.

DocCy may update this Agreement to follow the law or changes in the Service, and will email the Professional at least 30 days before a material change. Questions: [email protected].

Annex I: description of the processing

Data subjects

Patients who request or are given an appointment with the Professional through DocCy, and the people they book for, such as their children.

Personal data

• Name, email address, mobile number, gender, date of birth, whether the patient is new to the Professional, and the reason for the visit;
• the appointment: professional, clinic, date and time, whether it is in person or by video (and, for a video visit, its meeting link), its status, times proposed, cancellations and their reasons, and attendance;
• visit notes the Professional writes;
• the patient's review of an attended visit, while it is linked to the appointment.

Special categories

Data concerning health: a request to a named specialist, its reason and visit notes may reveal it. The Professional relies on Article 9(2)(h) and 9(3) GDPR, as a professional bound by professional secrecy.

Nature and purpose

Receiving, storing, showing and sending appointment requests and appointments, sending the related emails, and keeping attendance and visit notes, so that the Professional can arrange and give the care patients ask for. When the Professional asks, DocCy also enters the appointments of their existing diary from photos they send (agenda transfer), keeping only each visit's time and the patient's name, and deletes the photos once it is entered.

Duration

While the Professional keeps the data in the Service, and until it is deleted or returned under section 10. Requests never confirmed by the patient by email are deleted about a day after their confirmation link expires.

Annex II: security measures

• Encryption of all traffic in transit (HTTPS/TLS) and of stored data at rest by the database provider.
• Access controls so that each Professional sees and changes only their own appointments and notes; the links emailed to patients are stored only as hashes.
• Administrative access limited to the two founders, with two-factor authentication on the database and hosting accounts.
• Bot checks and rate limits on public forms; sign-in records to detect misuse.
• Automatic database backups by the database provider.
• Data stored in the European Union.
• A written procedure for handling breaches and data subject requests.

Annex III: sub-processors