Standard Contractual Clauses

They apply automatically, and only where they are needed. Your clinic tells us which country it operates in when it sets up, and that answer decides which instrument attaches to your Data Processing Agreement. Nothing here is a separate signature or a separate negotiation.

The transfer being covered is real rather than theoretical. Your clinical records are stored in Belgium, but we are a United States company and our own staff administer the service from outside Europe, and transactional email is delivered by a provider in the United States. Either of those is enough on its own.

Incorporated: the Standard Contractual Clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (transfer from controller to processor), as completed by the annexes on this page.

Not reproduced: the clause text itself. It is the Commission's, it is published in the Official Journal, and a copy pasted into a marketing site is a copy that can silently fall out of date. The authoritative text governs; the completed annexes are what we owe you.

Where the Clauses and the Data Processing Agreement disagree, the Clauses win. That is not generosity — Clause 5 requires it.

The Clauses leave several choices to the parties. Leaving them unstated is the most common way a set of clauses turns out not to work, so here they are.

Two consequences worth naming. First, the Delaware governing law in our Terms does not reach these clauses; a dispute about the transfer is heard under your own Member State's law. Second, because every one of these resolves from your country rather than from a negotiation, there is no per-customer edition of this document — which is exactly what makes it possible to have it ready before a customer arrives rather than after.

Data exporter — controller. The clinic that holds the account: its registered name, address and contact details as entered in the panel, and the account owner as contact person. Activities relevant to the transfer: use of Clinic+ to schedule appointments, keep clinical records, bill patients, manage stock and answer patients through the assistant. Signature and date: recorded at acceptance, as described in section 10.

Data importer — processor. Pull House LLC, 8 The Green, Suite 23111, Dover, DE 19901, United States, trading as Clinic+. Contact: hello@clinicplus.io. Activities relevant to the transfer: hosting and operating the Clinic+ practice management service on the exporter's instructions.

Sensitive data. Clinical records are data concerning health under GDPR art. 9. The restrictions applied to them are the measures in Annex II, and in particular: tenant isolation enforced in the database rules rather than in application code, role-based access with clinical records and sensitive financial fields as separately grantable modules, exports gated by their own permission and written to an audit log, and a confidentiality obligation on everyone with access.

The supervisory authority of the EEA state in which your clinic is established. For clinics in Iceland, Liechtenstein or Norway, the Irish Data Protection Commission acts as competent authority under Clause 13, consistent with the governing law chosen in section 3. Nothing here limits your right to complain to your own national authority.

These are the measures the importer has implemented, described in the categories Annex II asks for. They are the same measures set out in the Data Processing Agreement, not a more flattering version written for this document.

We do not claim a certification we do not hold. Where a clinic needs assurance beyond this description, section 11 of the Data Processing Agreement sets out how audits work.

Authorised under Clause 9, Option 2, with 30 days' notice before any addition or replacement.

UK GDPR does not accept the EU clauses on their own. For a clinic in the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under s.119A of the Data Protection Act 2018 (version B1.0) is incorporated on top of them.

Where the Addendum and the EU clauses conflict, the Addendum governs the UK transfer. The competent authority is the Information Commissioner's Office, and Clauses 17 and 18 read as the law and courts of England and Wales.

For a clinic established in Switzerland, the same clauses apply with the amendments the Federal Data Protection and Information Commissioner requires: the FDPIC is the competent supervisory authority, references to the GDPR are read as references to the Federal Act on Data Protection, references to EU Member States are read so that a data subject in Switzerland may bring proceedings in Switzerland, and — for as long as Swiss law continues to protect them — the Clauses are read as covering the data of legal entities as well as of individuals.

By acceptance rather than by signature. When your clinic is created you accept the Terms, the Privacy policy and the Data Processing Agreement in one act, and these clauses come with the agreement wherever your country calls for them.

What we record at that moment is deliberately more than a boolean: the version of the document set, the timestamp, who accepted and under which email address, the country given, the instruments that attached because of it, and the IP address and browser the acceptance came from. The record is written in the same operation that creates the clinic, so a clinic cannot exist without one, and it is stored where the clinic's own administrators can read it but cannot alter it.

One honest limit. A clinic that skips the setup questions has not told us where it operates, so no instrument attaches at that moment and the record says so rather than guessing. It attaches when the country is set in Settings. If you are in the EEA, the UK or Switzerland, fill the country in before you enter patient data.

An empty row in section 1 means these particular instruments are not the ones that apply to you. It does not mean your regime is silent on the transfer.

The clearest case is Türkiye. A Turkish clinic transfers health data abroad the moment it uses the service, KVKK art. 9 requires its own mechanism, and Türkiye has issued no adequacy decision for any country — so the practical route is a standard contract notified to the Board within five business days, or an undertaking. That is a separate instrument with a separate filing, and the clauses on this page do not stand in for it. Write to hello@clinicplus.io and we will handle it with you.

Some clinics need paper: a copy of the clauses with both parties' signatures on it, for their own file or their own regulator. Write to hello@clinicplus.io and we will send one. Asking for it does not change what is already in force — the acceptance did that.