Data Processing Agreement

This agreement governs Tnuvia's processing of personal data of patients and site visitors on behalf of the clinic in connection with the service. The clinic is the controller and determines the purposes and means; Tnuvia is the processor and processes personal data only on the clinic's documented instructions, including as configured in the product, except where required by law (in which case we inform the clinic unless the law forbids it).

Processing consists of hosting and operating the clinic's website, booking, reminders/recalls, chatbot and content tools. The data concerns patients and prospective patients (data subjects) and covers identification and contact data (name, email, phone), appointment details and preferences, and chatbot interactions. The clinic must not submit special-category clinical data; the platform is not a clinical-record system.

Tnuvia will: process only on documented instructions; ensure persons authorised to process are bound by confidentiality; implement appropriate technical and organisational security measures (Article 32); assist the clinic with data-subject requests and with its security, breach-notification and impact-assessment obligations, taking into account the information available to us; and make available information needed to demonstrate compliance and allow for audits on reasonable terms.

The clinic authorises Tnuvia to engage the sub-processors set out in our sub-processor list, available on request from dpo@tnuvia.com (hosting, Cloudflare, Resend, Twilio, Google, AI content providers, monitoring). We impose data-protection obligations on each sub-processor no less protective than these, remain responsible for their performance, and give notice of intended changes so the clinic can object. Any transfer outside the European Economic Area (EEA) and the United States relies on an adequacy decision or Standard Contractual Clauses with supplementary measures, as recorded in the sub-processor list.

On termination of the service, and at the clinic's choice, Tnuvia will delete or return all personal data processed on the clinic's behalf and delete existing copies, unless retention is required by law. Breach notifications to the clinic are made without undue delay after we become aware, with the information reasonably available to us.