Data Processing Agreement

1. Parties and roles

The Clinic is the data controller and Medisphere is the data processor of all personal data the Clinic enters into the service ("Clinic Data"), within the meaning of Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy.

2. Scope of processing

• Data subjects: patients, their next of kin and guarantors, and the Clinic's staff and suppliers.
• Categories: identification and contact details, national ID, insurance details, clinical records (vital signs, notes, diagnoses, lab results, prescriptions), billing records, and HR and payroll records.
• Purpose: providing the Medisphere service to the Clinic. We do not process Clinic Data for any other purpose.
• Duration: the term of the subscription, plus the export period in section 9.

3. Instructions

We process Clinic Data only on the Clinic's documented instructions, which are these Terms and the Clinic's use of the service's features. If we believe an instruction breaks the law, we will tell the Clinic and need not follow it.

4. Confidentiality

Everyone at Medisphere who can access Clinic Data is bound by a written confidentiality obligation and accesses it only when needed to support the Clinic or keep the service secure.

5. Security measures

• Encryption of data in transit (TLS) and encrypted backups.
• Separation of each clinic's data, checked on every request.
• Per-staff permissions managed by the Clinic, with optional two-factor authentication and session timeouts.
• An audit trail of record access and changes that the Clinic can review.
• Regular backups and tested restoration.

6. Subprocessors

The Clinic authorizes us to use subprocessors for hosting, email and SMS delivery, and payment processing. We bind each one to data protection terms at least as protective as this agreement and remain responsible for their work. We give the Clinic 30 days' notice of a new subprocessor, during which the Clinic may object. Write to privacy@medisphere.com for the current list.

7. Transfers outside Rwanda

We transfer or store Clinic Data outside Rwanda only in the cases allowed by Articles 48 to 50 of Law No. 058/2021, with the registration required from the National Cyber Security Authority, and with safeguards that give equivalent protection.

8. Helping the Clinic meet its obligations

• Data subject requests: the service lets the Clinic view, correct and export a patient's records. We forward any request we receive directly to the Clinic.
• Consent: each patient profile records consent decisions, including withdrawals, with who recorded them and when.
• Personal data breaches: we notify the Clinic without undue delay, and in any case within 24 hours of becoming aware of a breach affecting Clinic Data. This helps the Clinic notify the NCSA within 48 hours as the law requires. We provide the facts known, the likely consequences and the measures taken.
• Impact assessments: we provide reasonable information the Clinic needs for a data protection impact assessment.

9. Return and deletion

When the subscription ends, Clinic Data stays available for export for 90 days. We then delete it, including from backups within their normal rotation, unless Rwandan law requires us to keep it.

10. Audits

On reasonable written notice, we provide the information needed to show compliance with this agreement. We also allow audits by the Clinic or the NCSA, no more than once a year unless a breach has occurred.

11. Contact

Data protection questions: privacy@medisphere.com. Security incidents: security@medisphere.com.