Data processing agreement — Enamel PRO

1. Roles and purpose

The clinic is the controller of its patients’ personal data. Enamel PRO is the processor and processes it only to provide the contracted service and on the clinic’s documented instructions.

2. Enamel PRO’s obligations

Process data only on the clinic’s instructions and not use it for other purposes or disclose it to third parties, except where required by law.

Ensure that persons authorized to process the data are bound by confidentiality.

Apply reasonable security measures: encrypted connection, permissions by role, backups and access logging.

3. Sub-processors and international transfers

The clinic authorizes the use of infrastructure providers (hosting on Amazon Web Services, Ireland region) and email delivery providers. Enamel PRO requires equivalent safeguards from its providers and will give notice of material changes.

4. Data subjects’ rights and incidents

Enamel PRO assists the clinic in handling data subjects’ requests for access, rectification, update, deletion and objection.

If it becomes aware of a security breach affecting the data, it will notify the clinic without undue delay.

5. End of the service

When the service ends, Enamel PRO will delete the clinic’s data after a reasonable notice period, unless a rule requires keeping it. Delivery of the data is governed by the Terms of service and does not limit data subjects’ rights or the clinic’s legal obligations.