Data Processing Agreement

Effective date: September 25, 2026

This Data Processing Agreement (DPA) supplements the Practice Terms. The Practice controls the purpose of its clinical records and gives CareCircle documented instructions to process them for the CareCircle service. The Practice remains the health information custodian where applicable; CareCircle acts as its service provider and, where PHIPA applies, its agent to the extent it handles personal health information on the custodian's behalf. Each party remains responsible for its own legal duties.

Scope and instructions

CareCircle may process client and professional identity, contact, intake, appointment, message, note, file, call metadata, invoice, and support data only to provide, secure, maintain, and support the service; to follow a documented Practice instruction; or as required by law. It will not use identifiable clinical data for advertising, model training, or unrelated product analytics. A legal demand will be communicated to the Practice unless law prohibits notice.

People and security

CareCircle will restrict access to personnel who need it for their duties, bind them to confidentiality, train them appropriately, and remove access when no longer needed. It will maintain reasonable technical and organizational safeguards suited to sensitive health information, including identity and access controls, transport security, incident handling, and recovery procedures. The Security Practices page states current controls and gaps; this DPA is an obligation, not a claim that every control is already verified.

Subprocessors and transfers

The Practice authorizes the listed subprocessors for their stated functions, subject to completing applicable transfer assessments and written safeguards before real client data is entered. CareCircle will use written terms requiring appropriate confidentiality, security, assistance, and return/deletion duties, remain responsible for its instructions to them, and give at least 30 days' notice before adding a subprocessor with access to Practice data when practicable. The Practice may object on reasonable privacy grounds; the parties will seek a workable alternative or end the affected service with export. Current US processing is disclosed in Privacy. Before a communication outside Québec, the parties will perform the assessment and use the written agreement required by Québec law where applicable. This DPA is intended to support the service-provider contract requirements of section 18.3 of Québec's private-sector privacy law; the Practice remains responsible for its own assessment and notices.

Incidents

CareCircle will notify the Practice without undue delay and no later than 24 hours after becoming aware of a suspected or confirmed incident involving its Practice data, using the Practice's designated incident contact. Practices should report suspected incidents to nicholas@ponari.ca with “Security incident — urgent” in the subject and without patient details in the first ordinary email. The first notice may be preliminary and will include known scope, data involved, likely impact, containment steps, and a follow-up contact. CareCircle will provide updates as facts develop, preserve relevant evidence, and cooperate with the Practice's legal notification decisions. Where PHIPA applies, an agent must tell the custodian of a theft, loss, or unauthorized use or disclosure at the first reasonable opportunity; the 24-hour outer target does not delay that earlier duty. The Practice decides and makes notices to affected people and regulators unless law requires CareCircle to notify directly.

Rights requests and oversight

CareCircle will promptly forward clinical access, correction, and deletion requests to the Practice, help locate and export relevant data, and assist with reasonable audits, privacy impact assessments, and regulator inquiries. It will not independently alter or delete a clinical record against the Practice's lawful retention instructions. The Practice will give CareCircle enough information to distinguish its clients and authorize a transfer.

Exit, retention, and deletion

At the Practice's request or termination, CareCircle will provide a reasonable manual export or secure transfer, verify the recipient, and then delete or return Practice data on the agreed schedule unless law requires retention. It will confirm completion and disclose any retained legal copies and backup expiry. Deletion may require manual work during beta; it is not instant and cannot erase records held independently by the Practice or processors beyond their contractual deletion schedule. See Retention and Data Safety. These duties survive termination for as long as CareCircle holds Practice data.