Data Processing Agreement and GDPR compliance charter.

The Customer is the controller (and veri sorumlusu under KVKK) of personal data it submits to or collects through ClinicSuite (“Customer Data”). ClinicSuite is the processor (veri işleyen). Where the Customer is itself a processor — for example an agency acting for partner clinics — ClinicSuite acts as its sub-processor and this DPA applies accordingly.

This DPA applies for as long as ClinicSuite processes Customer Data and prevails over any conflicting term in the main agreement on matters of data protection. Where the EU Standard Contractual Clauses apply, they prevail over this DPA.

• As between the parties, the Customer owns all Customer Data, including patient records, treatment plans, images, recordings, deposit ledgers and attribution data.
• ClinicSuite acquires no rights in Customer Data other than the limited right to process it to provide, secure and support the service as instructed.
• ClinicSuite will not sell Customer Data, use it for its own marketing, combine it with other customers' data, or use it to train AI models made available to other customers.
• ClinicSuite may produce aggregated statistics that cannot identify any individual or Customer, for example platform-wide median response times.
• The Customer can export all Customer Data at any time in machine-readable formats (CSV, JSON, original image and audio files) without additional charge.

• Process Customer Data only on the Customer's documented instructions — this DPA, the agreement and configuration made in the product — and inform the Customer if an instruction appears to infringe data protection law.
• Ensure everyone authorised to process Customer Data is bound by confidentiality.
• Implement the security measures in section 7 and Annex II.
• Assist the Customer with data subject requests, data protection impact assessments and prior consultations, taking into account the nature of processing.
• Notify the Customer of personal data breaches without undue delay, and in any event within 48 hours of becoming aware, so the Customer can meet its 72-hour regulatory deadline.
• Make available all information necessary to demonstrate compliance with Article 28 GDPR and KVKK Article 12.

The Customer gives general authorisation for ClinicSuite to engage sub-processors. Each sub-processor is bound by written terms providing at least the same level of protection as this DPA, and ClinicSuite remains fully liable for their performance.

The full named list is available to customers in the workspace settings and on request from [email protected]. ClinicSuite gives at least 30 days' notice of a new sub-processor; the Customer may object on reasonable data protection grounds, and if the objection cannot be resolved, terminate the affected service with a pro-rated refund.

Customer Data is stored in the EU. Where it is transferred outside the EEA, UK or Türkiye — including when a clinic in one jurisdiction serves patients from another — the following mechanisms apply and are incorporated by reference:

Supplementary measures include encryption with keys held in EU-based KMS, pseudonymisation of data sent to analytics and AI providers, and a documented process for challenging and minimising government access requests.

• Encryption at rest — AES-256 for databases, object storage, backups and call recordings, with keys managed and rotated in a dedicated KMS.
• Encryption in transit — TLS 1.2+ for all external traffic, HSTS on clinicsuite.io, HMAC-SHA256 signed webhooks and mutual TLS between internal services.
• Access control — tenant isolation per Customer, branch- and role-scoped permissions, SSO/SAML, enforced MFA and just-in-time support access approved by the Customer.
• Logging & monitoring — immutable audit logs of access, exports and integration syncs; 24/7 alerting on anomalous access.
• Resilience — encrypted daily backups to a separate EU region, tested restores, and a documented business continuity plan.
• Secure development — code review, dependency and container scanning, and annual independent penetration testing with summaries available under NDA.
• People — background checks where lawful, confidentiality agreements and annual privacy and security training.

On becoming aware of a breach affecting Customer Data, ClinicSuite will notify the Customer's designated contact within 48 hours with the information then available — the nature of the breach, categories and approximate number of data subjects and records, likely consequences and measures taken — and will provide updates as the investigation progresses. ClinicSuite will not notify regulators or data subjects on the Customer's behalf without its instruction unless required by law.

ClinicSuite will make available its current security documentation, penetration test summaries and completed security questionnaires. Where these are not sufficient, the Customer may audit once per year, with 30 days' notice, during business hours and subject to confidentiality, or more often where required by a regulator or after a breach.

Clinic administrators can search, export, correct and erase a patient's data directly in the workspace, and erasure propagates to connected CRMs. Requests sent to ClinicSuite directly are forwarded to the Customer within five business days.

On termination, the Customer has 30 days to export Customer Data. ClinicSuite then deletes Customer Data from production systems within 30 days and from backups within 90 days, unless retention is required by EU, UK or Turkish law, and provides written confirmation of deletion on request.

Each party's liability under this DPA is subject to the limitations in the main agreement, except where such limitation is prohibited by law. This DPA is governed by the law governing the main agreement, save that the Standard Contractual Clauses are governed by the law specified within them. Signed copies can be requested from [email protected] and are counter-signed within two business days.