Data Processing Agreement

In short

• Your workspace's data is yours. You decide what is collected and why; we process it only to run Klinikbook for you.
• We protect it: encrypted connections, strict separation between workspaces, two-step sign-in for owners and administrators, an activity log, backups.
• If a security incident affects your data, we tell you without undue delay.
• You can export your data at any time, and we delete it when you leave.
• You are responsible for using Klinikbook lawfully: your notices and consents, your licences and the rules of your country.

Parties and roles

The customer is the person or organisation that owns the workspace (the “Customer”). SETTE TECHNOLOGICAL SOLUTIONS YAZILIM SANAYİ VE TİCARET ANONİM ŞİRKETİ ("SetteTech"), a company established in Türkiye provides Klinikbook. For the personal data the Customer and its team enter into the workspace or collect through it (“Workspace Data”), the Customer is the data controller and SetteTech is its data processor within the meaning of article 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and article 28 of the EU General Data Protection Regulation (GDPR).

For the accounts of the people who sign in to Klinikbook and for its website, SetteTech is a separate data controller; the Privacy Policy describes that processing.

What is processed

The subject of the processing is providing Klinikbook to the Customer, for as long as the workspace exists and the deletion period after it.

• Data subjects: the Customer's patients and enquirers and the people who accompany them, the Customer's team members and partners, and anyone else the Customer records.
• Data: identity and contact details, messages, appointments and travel details, quotes and payment records (never card numbers), documents and photographs, and the health information the Customer chooses to collect, which is a special category of personal data.
• Processing: storing, organising, displaying, sending the messages the Customer asks for, backing up and deleting.

Your instructions

SetteTech processes Workspace Data only on the Customer's documented instructions: this agreement, the Customer's use and configuration of Klinikbook, and written instructions consistent with them. SetteTech does not use Workspace Data for its own purposes, does not sell it and does not contact the Customer's patients on its own account.

If SetteTech believes an instruction breaks the law, it tells the Customer and may hold that instruction until it is clarified. If a law requires SetteTech to process Workspace Data in another way, it tells the Customer first, unless that law forbids it.

The Customer's responsibilities

• having a lawful basis for the data it puts into Klinikbook, and giving its patients the notices and asking for the consents its law requires — Klinikbook offers templates and records consents, but the Customer decides;
• holding the licences and authorisations its activity requires, and following the health, advertising and communication rules of its country;
• giving its team the access it needs and no more, and keeping sign-in details secret;
• not storing data whose law requires an agreement Klinikbook has not signed — for example protected health information under the US HIPAA without a business associate agreement — and not using Klinikbook to keep clinical records.

Confidentiality

Everyone at SetteTech who may come into contact with Workspace Data is bound by confidentiality. Klinikbook's staff have no access to a workspace's patient records through the platform; if support ever needs to look inside a workspace, it does so only with the permission of its owner or an administrator, for a limited time and purpose, and on the record.

Security

SetteTech takes technical and organisational measures appropriate to the risks of health data (KVKK article 12, GDPR article 32), among them:

• encryption of every connection (TLS);
• separation of each workspace's data in the application and in the database itself;
• strong passwords, two-step sign-in (required for owners and administrators), session control and protection against password guessing;
• permission-based roles inside each workspace and an activity log of significant actions;
• regular backups, monitoring of the service and timely security updates;
• access to the production systems only for authorised staff, with personal keys, and recorded.

Sub-processors

The Customer authorises SetteTech to use the following sub-processors:

SetteTech binds each sub-processor by contract to data-protection obligations no weaker than this agreement's and remains responsible for them. It announces a new or replacement sub-processor to workspace owners by e-mail at least 30 days in advance; a Customer that objects on reasonable data-protection grounds can end its subscription before the change takes effect and is refunded any prepaid period it has not used.

• Contabo (Germany) — hosting of the application, the database and the files;
• Cloudflare — network and protection: connections to the platform pass through its servers, which are located worldwide, including in the United States;
• Hostinger — delivery of e-mail sent by the platform.

Requests from the people concerned

When a patient or another person exercises their rights over Workspace Data, the Customer answers them. SetteTech helps — through the functions of Klinikbook and otherwise — to find, export, correct and erase that person's data. A request that reaches SetteTech directly is passed to the Customer without delay and is not answered by SetteTech itself.

SetteTech also gives the Customer the information it reasonably needs for a data protection impact assessment, a prior consultation or a question from a supervisory authority about the processing.

Security incidents

SetteTech informs the Customer without undue delay — where possible within 48 hours — after becoming aware of a breach affecting Workspace Data, with what is known: what happened, which data and people are likely affected, the likely consequences and the measures taken. It keeps the Customer informed as it learns more and helps it meet its own duties to notify the authority (in Türkiye, the Personal Data Protection Board within 72 hours) and the people concerned.

Where the data is kept, and transfers

Workspace Data is stored on servers of Contabo in Germany; the other sub-processors above process the parts of it their service needs.

For a Customer established in the European Union, the European Economic Area or the United Kingdom, any transfer to a country without an adequacy decision is covered by the EU Standard Contractual Clauses (controller to processor, module two) and, for the United Kingdom, the International Data Transfer Addendum, which are incorporated into this agreement by reference.

Where Turkish law treats the storage or a sub-processing as a transfer abroad, it relies on the safeguards of KVKK article 9, including the standard contract prescribed by the Personal Data Protection Board, with the notifications that article requires.

When the service ends

The Customer can export its data at any time. When the workspace is closed or the subscription ends, SetteTech deletes Workspace Data within 90 days, unless a law requires it to keep some of it; copies in backups disappear as those backups expire, at the latest 30 days later. On request, SetteTech confirms the deletion in writing.

Audits

SetteTech makes available the information needed to show that it meets this agreement. The Customer may audit, itself or through an independent auditor bound by confidentiality, once a year with 30 days' notice, during business hours and without disrupting the service or touching other customers' data; each party bears its own costs. Where a recent independent report or certificate covers the question, SetteTech may answer with it.

Liability, precedence and changes

The liability provisions of the terms under which the Customer uses Klinikbook also apply to this agreement. On data protection, this agreement prevails over any other agreement between the parties; where the Standard Contractual Clauses apply, they prevail over both.

SetteTech announces changes to this agreement at least 30 days before they take effect. The workspace's owner accepts the new version in Klinikbook; a Customer that does not accept it may end its subscription.

Governing law and contact

This agreement is governed by Turkish law, and the courts and enforcement offices of Manisa have jurisdiction, unless a mandatory rule of the Customer's country provides otherwise or the Standard Contractual Clauses require another law for themselves.

Questions about this agreement and data protection: [email protected].