Data Processing Agreement

Parties and Definitions

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller: The clinic or healthcare professional ("you", "Controller") who has subscribed to Klinica and processes personal data of their patients.
• Data Processor: Klinica SAS / Klinica (operator of the klinica.space platform), acting as the processor of personal data on behalf of the Controller.

For the purpose of this DPA, the following definitions apply:

• "Personal Data" — Any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
• "Processing" — Any operation performed on personal data, including storage, retrieval, use, disclosure, or erasure.
• "Data Subject" — Patients, employees, or any natural person whose personal data is processed through the Klinica platform.
• "Services" — The clinic management platform, online booking system, patient management, and scheduling tools provided by Klinica.

Subject Matter and Duration

Klinica processes personal data solely to provide the contracted Services to the Controller. The categories of data processed include:

• Patient identifiers (name, date of birth, contact details)
• Appointment and scheduling data
• Medical notes and clinical records entered by the Controller
• Authentication credentials (hashed passwords) of clinic staff
• Billing contact information (name, email) — payment details are not stored and are handled exclusively by Paddle.com (our payment processor)

The DPA is effective for the duration of your active subscription to Klinica. Upon termination, data retention and deletion obligations as described in Article 10 apply.

Obligations of Klinica (Processor)

As your data processor, Klinica commits to:

1. Process personal data only on documented instructions from the Controller (i.e., using the platform as intended).
2. Ensure that all personnel with access to personal data are bound by confidentiality obligations.
3. Implement and maintain appropriate technical and organizational security measures (see Article 6).
4. Assist the Controller in fulfilling obligations regarding data subject rights (Article 7).
5. Delete or return all personal data upon termination of services (Article 10).
6. Provide all information necessary to demonstrate compliance with Article 28 GDPR obligations.
7. Notify the Controller without undue delay upon becoming aware of a personal data breach (Article 8).
8. Not transfer personal data to third parties except authorized sub-processors listed in Article 5.

Obligations of the Data Controller

By using Klinica, you as the Data Controller confirm that:

1. You have a lawful basis for processing your patients' personal data (e.g., consent, legitimate interest, or legal obligation under applicable healthcare law).
2. You will provide a privacy notice to data subjects (your patients) that discloses the use of Klinica as a data processor.
3. You are responsible for the accuracy and lawfulness of the personal data you enter into the platform.
4. You will promptly inform Klinica of any changes to processing instructions that may affect our compliance obligations.
5. You are responsible for configuring appropriate access controls for your clinic staff.

Sub-Processors

Klinica uses the following authorized sub-processors. All sub-processors are required to meet equivalent data protection standards:

You will be notified at least 14 days in advance of any changes to the sub-processor list. You have the right to object to the addition of new sub-processors.

Technical & Organizational Security Measures

Klinica implements the following technical and organizational measures (TOMs) in accordance with Article 32 GDPR to ensure an appropriate level of security:

Data Subject Rights

Klinica will assist the Controller in responding to data subject requests under Articles 15–22 GDPR, including:

• Right of Access (Art. 15): Patients may request access to their personal data held in Klinica.
• Right to Rectification (Art. 16): Inaccurate data may be corrected.
• Right to Erasure (Art. 17): Data may be deleted upon request, subject to legal retention obligations applicable to healthcare records.
• Right to Portability (Art. 20): Patient data can be exported in structured, machine-readable formats.
• Right to Object (Art. 21): Data subjects may object to certain processing activities.

As the Controller, you remain the primary point of contact for data subject requests. Klinica will support you technically in fulfilling these obligations.

Data Breach Notification

In the event of a personal data breach, Klinica will:

1. Notify the affected Controller within 72 hours of becoming aware of the breach, without undue delay.
2. Provide details including: the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed to address the breach.
3. Cooperate fully with the Controller's obligations to notify the competent supervisory authority under Article 33 GDPR.

Notifications will be sent to the email address associated with your Klinica account.

International Data Transfers

Personal data is primarily stored and processed within the European Union (Germany). In cases where sub-processors are based outside the EEA (such as certain payment processors), appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission.
• Adequacy decisions where applicable.
• Binding Corporate Rules where relevant.

Data Deletion and Return

Upon termination of your Klinica subscription:

1. You have 30 days from the termination date to export your data in full.
2. After this 30-day window, all personal data associated with your clinic will be permanently deleted from our systems, including backups.
3. Klinica will provide a written confirmation of deletion upon request.
4. Certain anonymized or aggregated statistical data (which cannot be used to identify any individual) may be retained for platform improvement purposes.

Liability and Indemnification

Each party is responsible for ensuring their own compliance with applicable data protection laws. In the event of a data protection violation:

• If the violation is attributable to the Controller's instructions or failure to comply with their obligations, the Controller bears the associated liability.
• If the violation is attributable to Klinica's failure to fulfil its obligations as Processor, Klinica bears the associated liability.
• Klinica's maximum liability is limited to the total fees paid by the Controller in the 12 months preceding the event giving rise to the claim.

Contact and Data Protection Officer

For any questions related to this DPA, data protection, or to exercise your rights, please contact:

We aim to respond to all data protection enquiries within 5 business days.