Data Processing Agreement
Version 2026-09-1 · In force since 24 September 2026
1. Purpose and scope
This agreement governs the processing of personal data on behalf of the physiotherapy clinic accepting this document (the «Controller») by [PLATFORM OWNER], with tax ID [NIF] and address at [ADDRESS], the «Processor», in accordance with art. 28 of Regulation (EU) 2016/679 (GDPR). The Processor provides the Controller with the r3physio.app software (scheduling, online booking, conversational assistant and patient follow-up), which involves the processing of personal data of the clinic's patients and staff on behalf of the Controller.
2. Processor's obligations
The Processor shall process personal data only on the Controller's documented instructions — including those set out in this agreement and the service configuration — unless required to do so by law. It guarantees confidentiality and ensures that persons authorised to process the data have expressly committed to respecting it. It shall not use the data for its own purposes nor disclose it to third parties except as foreseen in clause 5.
3. Description of the processing
Data subjects: the clinic's patients and staff. Categories of data: identity and contact data (name, email, phone), health data recorded by the clinic (reason for visit, symptoms, clinical history, exercise plans) and scheduling data. Purpose: provision of the contracted service (appointment management, patient communications, organisational assistance via the conversational assistant). Duration: for the term of the commercial relationship and the retention periods described in the privacy notice.
4. Data subject rights and assistance
The Processor shall assist the Controller in exercising rights of access, rectification, erasure, objection, restriction and portability, by providing the platform's tools (patient record export and deletion, access audit log). It shall communicate to the Controller without undue delay any data subject or supervisory authority request received directly.
5. Sub-processors
The Controller authorises the Processor to engage the following sub-processors: Mistral AI SAS (France/EU, processing of assistant messages, no training retention); Zoho Mail (EU, transactional email delivery); Dodo Payments (payment processing); EU-based VPS hosting provider; and Telegram Messenger LLP if the clinic connects its own bot (conversations also live on Telegram's servers). The Processor shall notify the Controller of any change of sub-processor and allow a reasonable period to object, in accordance with art. 28.2 and 28.4 GDPR.
6. Technical and organisational measures
The Processor applies at minimum: encryption in transit (HTTPS/TLS) and at rest for backups (AES-256-GCM with a passphrase kept outside the repository); passwordless authentication (magic link) and role-based access control with audit logging; minimisation (clinical history data is only visible to physiotherapists and owners); limited retention (scheduled deletion of inactive conversations and expired audit logs); and per-clinic isolation (each clinic can only access its own data).
7. Personal data breaches
In the event of a personal data breach, the Processor shall notify the Controller without undue delay after becoming aware of it, with the available information on its nature, scope and the measures taken, so that the Controller can comply with its obligation to notify the supervisory authority and, where applicable, the data subjects (art. 33 and 34 GDPR).
8. International transfers
Data is hosted in the European Union. Conversational assistant processing takes place in the EU (Mistral AI, France). When the clinic connects its Telegram bot, messages are also processed on Telegram's infrastructure, outside the EU, under the guarantees described in its privacy policy; the clinic freely decides whether to enable that channel.
9. Term and end of the engagement
At the end of the commercial relationship, at the Controller's request and unless a legal retention obligation applies, the Processor shall erase or return the personal data, including existing copies, and certify erasure when required. Patient data can be exported at any time from the panel.
10. Audit
The Processor shall make available to the Controller the information necessary to demonstrate compliance with this agreement and shall contribute to any audits the Controller considers appropriate, including the audit log built into the platform.
11. Liability
Each party is liable for damage caused by breach of this agreement in accordance with the GDPR and applicable law. The Processor is liable to the Controller where, in breach of the obligations of art. 28, it determines the purposes and means of the processing.
12. Acceptance and version
This agreement is accepted electronically when the clinic is created or expressly accepted from the panel. The acceptance is recorded with date, document version and the identity of the acceptor. The version in force at any time is the one published on this page; material changes will be notified by email before taking effect and will require a new acceptance.