Status, parties and roles
This is a DPA template for legal and technical review, not an executed agreement. The subscribing clinic and the legal operator of Ziel Practice must be identified in the signed agreement. The clinic generally directs processing of patient records; Ziel acts as a processor or service provider only to the extent specified in a binding agreement and applicable law.
Processing instructions and purposes
Processing should be limited to documented clinic instructions for hosting, authorized retrieval, synchronization, backups, requested support, patient-facing workflows, or other contracted services. Instructions must be lawful; the provider should inform the clinic if an instruction appears unlawful where required.
People and categories of data
Data subjects may include patients, prospective patients, clinic owners, staff, and authorized contacts. Data may include contact identifiers, appointment details, sensitive dental/medical records, imaging, financial entries, user permissions, and audit metadata. A signed schedule should define the exact categories, purposes, locations, and processing duration.
Confidentiality and staff access
Access to data should be limited to personnel with a legitimate, documented operational need and subject to appropriate confidentiality obligations. Privileged support access should be controlled, recorded where feasible, and scoped to the relevant clinic and task.
Security measures and local responsibilities
The finalized security annex should specify validated authentication, clinic isolation, staff permissions, network and storage protections, auditability, backup/recovery testing, incident monitoring, change management, and handling of exports and local devices. The clinic is responsible for its own terminals, staff authorization, workstation protections and lawful clinical workflows. Security overview.
Subprocessors and regional transfers
The processor should keep an accurate subprocessor schedule covering service role, information accessed, hosting location, contractual protections, change notifications, and the clinic’s applicable objection rights. International transfers require any legally mandated transfer protections. Listing a technology provider on a website is not by itself proof of a valid DPA or HIPAA BAA.
Incident reporting and cooperation
The parties should agree incident classifications, designated contacts, a realistic notice deadline, the information to be supplied, evidence preservation, containment cooperation, and responsibility for statutory notification. The specific deadline must be finalized and should be consistent with applicable law and operational capability.
Requests, correction and regulator assistance
The processor should provide reasonable assistance to the clinic with authorized access, rectification, deletion, security assessment, or regulatory requests, taking into account the nature of processing and available information. The clinic remains responsible for decisions about its patient record and clinical preservation obligations.
Data export, return, deletion and backups
The binding agreement should set out the usable export format, process for requesting export, assistance at termination, deletion triggers, backup retention and exception handling, and documentary confirmation. Do not promise instant deletion from all historical backups unless it is technically and legally possible.
Verification and audit arrangements
The clinic may receive appropriate documentation needed to evaluate protections, subject to privacy, confidentiality and operational security constraints. Specific audit rights, frequency, independent reports and remediation timelines must be agreed before execution.
International healthcare addenda
For qualifying processing subject to the GDPR, a compliant controller–processor arrangement may be required. For eligible U.S. healthcare customers subject to HIPAA, a separate Business Associate Agreement may be required before PHI is entrusted to the service. This DPA template must not be represented as a signed BAA or compliance certification.