Data processor

What may a processor do?

If a clinic keeps patient records in cloud software, the software provider processes those records on the clinic's instructions and only to provide the service; it cannot use the data for its own purposes. According to the Board's decision 2020/71, a processor's work is mostly technical, while the controller decides why the data is collected, who it is disclosed to and how long it is kept.

Under Article 12 of KVKK, when data is processed on its behalf, the controller is jointly responsible with the processor for the security measures. The processor, in turn, may not disclose the data unlawfully or use it beyond the purpose of processing, a duty that continues after the work ends. That is why a written contract with the provider, knowing its sub-processors and asking about its security are the clinic's business.

In Klinikbook

SetteTech, which runs Klinikbook, is the processor for patient data in workspaces, under the Data Processing Agreement accepted when a workspace is created. Klinikbook staff cannot look into a workspace unless its owner or an administrator grants time-limited support access, and even then they see the activity log, not patient records. The servers are currently in Germany.