Data Processing Agreement

Parties

This Data Processing Agreement (“DPA”) is entered into between DentaFlow(“Processor”) and the Clinic Customer (“Controller”) who uses our Services. This DPA forms part of and is incorporated into the Terms of Service.

Definitions

• Controller — the Clinic Customer who determines the purposes and means of processing personal data.
• Processor — DentaFlow, which processes personal data on behalf of the Controller.
• Personal Data — any information relating to an identified or identifiable natural person.
• Sub-Processor — a third party engaged by the Processor to assist in processing personal data.
• GDPR — the General Data Protection Regulation (EU) 2016/679.

Roles and Scope

The Controller is the data controller for End User personal data collected through the chatbot widget on their website. The Processor processes this data on the Controller's behalf, strictly on the Controller's documented instructions, to provide the Services.

The nature and purpose of processing is: providing an AI-powered chatbot that answers patient questions, captures leads, and manages appointment requests for dental clinics.

The types of personal data processed include: names, phone numbers, email addresses, conversation content, and appointment request details of End Users.

Processor Obligations

The Processor shall:

• Process Personal Data only on the Controller's documented instructions, including with regard to transfers of Personal Data to a third country;
• Ensure that personnel authorized to process Personal Data are bound by confidentiality obligations;
• Implement appropriate technical and organizational security measures (see “Security Measures” below);
• Assist the Controller in responding to Data Subject Rights requests;
• Notify the Controller without undue delay (and in any case within 72 hours) of becoming aware of a Personal Data Breach;
• At the Controller's choice, delete or return all Personal Data after the end of the Services, unless retention is required by law;
• Make available all information necessary to demonstrate compliance with this DPA.

Customer Obligations

The Controller shall:

• Ensure they have a lawful basis for collecting and processing End User Personal Data through the chatbot widget;
• Provide appropriate privacy notices to End Users, including informing them that their data will be processed by DentaFlow as a sub-processor;
• Respond to End User Data Subject Rights requests within the timeframes required by applicable law;
• Not provide the Processor with any special category data (health data, etc.) unless explicitly agreed in writing.

Sub-Processors

The Controller grants general authorization for the Processor to engage sub-processors. The current list of sub-processors is available at our Sub-Processors page. The Processor shall notify the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object.

Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subjects' requests to exercise their rights (access, rectification, erasure, portability, restriction, objection). The Controller may use the Privacy Requests feature in the dashboard to fulfill end-user requests.

Security Measures

The Processor implements the following technical and organizational measures:

• Encryption in transit (TLS) and at rest (database-level);
• Row-Level Security (RLS) policies isolating each clinic's data;
• Role-based access controls and least-privilege principle for staff access;
• Audit logging of data access, exports, and modifications;
• Regular security reviews and dependency updates;
• Session management with device tracking and concurrent session limits.

Breach Notification

The Processor shall notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach. The notification shall describe the nature of the breach, the likely consequences, and the measures taken or proposed to address it and mitigate its possible adverse effects.

Data Deletion on Termination

Upon termination of the Services, the Processor shall, at the Controller's choice, delete or return all Personal Data processed on the Controller's behalf, and delete existing copies, unless retention is required by applicable law. The Controller may use the Privacy Center to initiate account deletion at any time.

Audit Rights

The Controller has the right to audit the Processor's compliance with this DPA, subject to reasonable notice and confidentiality obligations. The Processor shall contribute to the audit in accordance with its obligations under applicable law.

International Transfers

Where Personal Data is transferred outside the European Economic Area, the Processor shall ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or reliance on an adequacy decision.

Contact

For questions about this DPA, please contact us at support@dentaflow.chat.