Data processing agreement

Parties and roles

The controller is the clinician or clinic holding the Salumbra account, who decides which patients to register, which questionnaires to send and for what purpose. The processor is Salumbra, which processes the data only to provide the service and on the controller’s instructions.

Subject matter and data

Salumbra processes, on the controller’s behalf: patient identification and contact data (name, phone, email, date of birth, optional clinical identifier), the medical event being followed, answers to validated questionnaires and derived scores, and message delivery records. These are sensitive personal data under the LFPDPPP.

Salumbra’s obligations as processor

Salumbra undertakes to:

• Process the data only on the controller’s instructions, expressed through use of the service’s features.
• Not use the data for its own purposes or any purpose other than providing the service.
• Implement and maintain the administrative, technical and physical measures described on the security page.
• Keep the data confidential, including after the relationship ends.
• Delete the data when the controller instructs (deleting patients or the organization) or when the service ends, unless a legal retention obligation applies.
• Not transfer the data except to the subprocessors listed below or on the controller’s instruction.
• Notify the controller without undue delay of any security breach affecting the data, with the available information on its nature, scope and measures taken, so the controller can meet its own notification duties.
• Assist the controller with patients’ ARCO requests, routing any request received directly within five business days.

Controller’s obligations

The controller undertakes to:

• Hold the legal basis and, where applicable, the express consent of patients for processing health data, and inform them through its own privacy notice, which may refer to this agreement and Salumbra’s notice.
• Register only patients under its care and accurate, relevant data.
• Obtain patients’ consent to receive WhatsApp or SMS messages before recording their phone number.
• Manage its team’s access and remove access for anyone who leaves.

Subprocessors

The controller authorizes Salumbra to rely on the providers listed on the security page (Convex, Vercel, WorkOS, Postmark, Meta WhatsApp Business Platform, Twilio, PostHog, Sentry), which process data under contracts imposing equivalent obligations. Changes to that list are published at least 30 days in advance; if the controller reasonably objects, it may end the service without penalty.

International transfers

Subprocessors operate mainly in the United States. Transfers rely on article 37 of the LFPDPPP and on the contractual clauses with each provider. The controller accepts these transfers as necessary for the service.

Audit and evidence

On request and up to once a year, Salumbra will make available the information reasonably needed to demonstrate compliance with this agreement: a description of security measures, the current subprocessor list, and summaries of incidents that affected the controller. The organization’s audit log is available at all times inside the app.

Term and termination

This agreement applies while the account exists. On termination the controller can export its data before deleting the organization; once deleted, Salumbra erases the data per the retention section of the security page.