Wise DoctorData Processing Addendum
This Data Processing Addendum (the "DPA") forms part of, and is incorporated by reference into, the Terms of Service (the "Terms") between Wise Doctor SARL (single partner), registered with the Commercial Register of Baabda under No. 2075408, Zalka – Rolex Street – St. Rita Bldg., 1st floor, Lebanon ("Wise Doctor" or the "Processor") and the healthcare provider, clinic or other customer that accepts the Terms (the "Provider" or the "Controller"). It applies from the date the Provider accepts the Terms, which constitutes acceptance and execution of this DPA, including the Standard Contractual Clauses where they apply. Each of Wise Doctor and the Provider is a "party".
Providers that have concluded a separate negotiated data processing agreement with Wise Doctor are governed by that agreement and not by this DPA.
1. Definitions
1.1 "Applicable Data Protection Law" means the GDPR (Regulation (EU) 2016/679) and any national law implementing or supplementing it, to the extent applicable to the Controller or the processing, and any other data protection law applicable to the processing, including Lebanese Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data and its implementing texts, the Medical Ethics Law No. 288 of 1994 and Law No. 574 of 2004 on Patients' Rights and Informed Consent. "Personal Data", "processing", "controller", "processor", "data subject", "supervisory authority" and "personal data breach" have the meanings given in the GDPR. "Customer Personal Data" means Personal Data, including health data, processed by Wise Doctor on behalf of the Controller under the Terms. "Sub-processor" means any third party engaged by Wise Doctor to process Customer Personal Data. "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914. "Restricted Transfer" means a transfer of Customer Personal Data subject to the GDPR to a country outside the European Economic Area not covered by an adequacy decision.
2. Scope, Roles and Order of Precedence
2.1 The Controller is the controller and Wise Doctor is the processor of Customer Personal Data. The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects are set out in Annex I. Where Wise Doctor processes Personal Data of account holders for its own purposes (for example, billing and security), it does so as an independent controller as described in the Privacy Policy, and this DPA does not apply to that processing.
2.2 The Controller is responsible for ensuring that it has a lawful basis (including an Art. 9(2) GDPR condition for health data) and has provided all notices and obtained all consents required for the processing and for Wise Doctor's processing on its behalf, and that its instructions comply with Applicable Data Protection Law.
2.3 In the event of conflict, the following order of precedence applies: (a) the SCCs (where they apply); (b) this DPA; (c) the Terms and Privacy Policy.
3. Obligations of Wise Doctor as Processor
3.1 Instructions. Wise Doctor shall process Customer Personal Data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's configuration and use of the Platform, unless required to do otherwise by law, in which case Wise Doctor will inform the Controller beforehand unless the law prohibits it. Wise Doctor will inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law.
3.2 Confidentiality. Wise Doctor ensures that persons authorized to process Customer Personal Data are bound by confidentiality obligations (contractual or statutory) and have access only as necessary to perform the services.
3.3 Security. Wise Doctor implements and maintains the technical and organizational measures in Annex II appropriate to the risk, taking into account the sensitivity of health data (Art. 32 GDPR). Wise Doctor may update the measures provided it does not materially reduce the overall level of protection.
3.4 AI features. Wise Doctor processes Customer Personal Data through AI features only to deliver the functionality requested by the Controller. Direct identifiers (names, contact details, identification numbers) are removed or replaced before any text is sent to an AI model provider, and zero data retention is required on every request. Wise Doctor will not use Customer Personal Data to train or improve models made available to other customers or third parties, and will require AI model providers acting as Sub-processors to refrain from retaining Customer Personal Data for their own purposes or model training. AI outputs are decision-support only and remain subject to the treating clinician's review.
3.5 Records. Wise Doctor maintains records of processing activities carried out on behalf of the Controller as required by Art. 30(2) GDPR.
3.6 Medical secrecy and traceability. Wise Doctor treats Customer Personal Data as covered by medical secrecy. Every access to a medical record is logged; emergency ("break-the-glass") access is logged and notified to the patient; medical notes are never overwritten but amended. Wise Doctor shall not use Customer Personal Data for advertising: sponsored content is never displayed in clinical screens and is never selected using health data.
4. Sub-processors
4.1 The Controller gives general authorizations for Wise Doctor to engage Sub-processors, including those listed in Annex III. Wise Doctor shall impose on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA and remains liable to the Controller for the Sub-processor's performance.
4.2 Wise Doctor will give the Controller at least 30 days' prior notice (by email or through the Platform or the Sub-processor page) of any intended addition or replacement. The Controller may object on reasonable data protection grounds within 15 days of notice; the parties will then discuss in good faith, and if no resolution is reached the Controller may terminate the affected service and receive a pro-rata refund of prepaid fees for it.
5. Data Subject Rights
5.1 Taking into account the nature of the processing, Wise Doctor shall assist the Controller by appropriate technical and organizational measures, insofar as possible, in responding to requests to exercise data subject rights (access, rectification, erasure, restriction, portability, objection). The Platform provides self-service tools for these purposes.
5.2 If Wise Doctor receives a request directly from a data subject concerning Customer Personal Data, it shall not respond except to redirect the data subject to the Controller, and shall notify the Controller without undue delay.
6. Personal Data Breach
6.1 Wise Doctor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and provide the information reasonably available to it to enable the Controller to meet its notification duties (Arts. 33–34 GDPR): nature of the breach, categories and approximate numbers affected, likely consequences, and measures taken or proposed. Wise Doctor will take reasonable steps to contain and remediate the breach and to cooperate with the Controller. Notification is not an admission of fault or liability.
7. Assistance, Audits and Information
7.1 Wise Doctor shall provide reasonable assistance with data protection impact assessments and prior consultation with supervisory authorities where required (Arts. 35–36 GDPR), considering the information available to it.
7.2 Wise Doctor shall make available to the Controller information necessary to demonstrate compliance with this DPA, including its then-current security documentation and, where available, independent audit reports or certifications. Where that is not sufficient, the Controller may, no more than once per year (or after a personal data breach), on 30 days' notice, during business hours and subject to confidentiality and without disrupting operations or compromising other customers' data, conduct an audit itself or through an independent auditor bound by confidentiality. Each party bears its own costs unless the audit reveals material non-compliance.
8. International Transfers and Standard Contractual Clauses
8.1 The Controller authorizes the transfer and processing of Customer Personal Data in the countries where Wise Doctor and its Sub-processors operate, as listed in Annex III, subject to this Clause.
8.2 Where the GDPR applies to the Controller's processing and the transfer to Wise Doctor is a Restricted Transfer, the parties hereby enter into the SCCs, Module Two (controller to processor), which are incorporated into this DPA by reference and completed as set out in Annex IV, with the Controller as "data exporter" and Wise Doctor as "data importer". The Annexes to this DPA serve as Annexes I.A–I.C, II and III of the SCCs.
8.3 Onward transfers to Sub-processors outside the EEA are made under SCCs Module Three (processor to processor) or another valid transfer mechanism concluded between Wise Doctor and the Sub-processor.
8.4 Where the Controller is not subject to the GDPR, the SCCs do not apply and this DPA operates as the data processing agreement under the Applicable Data Protection Law. If a transfer mechanism is invalidated or replaced, the parties will cooperate to adopt an alternative. If the European Commission adopts or approves new or amended clauses applicable to the parties, they shall be deemed to replace the SCCs from the date they become applicable.
9. Return and Deletion
9.1 Upon termination or expiry of the services, and at the Controller's choice, Wise Doctor shall make Customer Personal Data available for export for 30 days and thereafter delete or return it, and delete existing copies within 90 days, unless law requires continued storage, in which case Wise Doctor will protect it and process it only for that purpose. On written request, Wise Doctor will confirm deletion in writing. Backups are overwritten in the ordinary course within 30 days.
10. Liability, Term and Governing Law
10.1 Each party's liability under this DPA is subject to the exclusions and limitations in the Terms (Clause 14), to the extent permitted by Applicable Data Protection Law. Nothing in these DPA limits liability to data subjects under the SCCs or the GDPR, or any liability that cannot be limited by law.
10.2 This DPA remains in force for as long as Wise Doctor processes Customer Personal Data. Wise Doctor may update it on 30 days' notice to reflect changes in law or the services, provided the protection is not materially reduced; the SCCs may not be modified except as they permit.
10.3 Subject to the SCCs (which are governed by the law and courts specified in Annex IV), this DPA is governed by the laws of Lebanon and the dispute resolution provisions of Clause 17 of the Terms apply.
Annex I – Details of Processing
| Controller / data exporter | The Provider that accepted the Terms; identity and contact details as registered on the Platform. Role: controller. Contact for data protection matters: as notified in the account. |
|---|---|
| Processor / data importer | Wise Doctor SARL (single partner), Zalka – Rolex Street – St. Rita Bldg., 1st floor, Lebanon. Role: processor. Contact: privacy@wise-doctor.com; contact person: Patricia Aouad, Manager. |
| Subject matter and nature | Provision of the Wise Doctor platform: hosting, storage, retrieval, display, structuring, transmission, analysis through AI features at the Controller's instruction, backup, support and deletion. |
| Purpose | To enable the Controller to manage patient records, appointments, communications and clinical decision support, and to provide, secure and support the Platform. |
| Duration | For the term of the Terms and until deletion or return under Clause 9. |
| Categories of data subjects | Patients (including minors and their legal representatives) of the Controller; Controller's staff and users; other individuals whose data the Controller enters. |
| Types of personal data | Identification and contact data; demographic data; appointment and insurance data; medical history, diagnoses, medications, allergies, vital signs, test results, clinical notes, prescriptions, pregnancy follow-up, images and other documents; user account data; access logs; AI inputs (pseudonymised) and outputs. |
| Sensitive data | Health data (Art. 9 GDPR) and, where entered by the Controller, genetic or other special-category data. Safeguards: strict access control, encryption, logging, purpose limitation, staff training (see Annex II). |
| Frequency of transfer | Continuous, for the duration of the services. |
| Retention | As instructed by the Controller; return or deletion under Clause 9. |
Annex II – Technical and Organizational Measures
| Encryption | TLS 1.2+ in transit; sensitive medical fields encrypted at application level with AES-256-GCM; storage encrypted at rest by the hosting providers; encryption keys kept in restricted secret storage; files stored privately and served through short-lived signed links. |
|---|---|
| Access control | Unique user IDs; two-factor authentication available to all users; role-based least privilege (six roles); segregation between organisations enforced at database level (row-level security); access to a record subject to a care relationship or patient authorisation; database not reachable from the Internet; prompt revocation on role change or exit. |
| Logging and monitoring | Audit log of every access to medical records, kept 5 years; emergency access logged and notified to the patient; notes never overwritten (amendments); no health data in technical logs, kept 12 months; error monitoring with personal data removed before sending. |
| Segregation and minimisation | Logical segregation of customer environments; production data not used in testing unless de-identified; data minimisation in AI prompts and logs. |
| Resilience and backup | Managed cloud infrastructure in the European Union (Frankfurt); automated database backups overwritten within 30 days; restore procedures; business continuity plan. |
| Vulnerability and change management | Dependency audit and automated tests at each release; secure development lifecycle and code review; documented change control through reviewed pull requests. |
| Personnel | Background checks where lawful; confidentiality undertakings; security and privacy training on onboarding and annually. |
| Incident response | Documented incident response plan, defined roles, breach notification procedure as in Clause 6. |
| Physical security | Provided by certified cloud infrastructure providers (data-center access control, environmental safeguards). |
| Sub-processor assistance measures | Sub-processors are assessed for security before engagement and are contractually bound to equivalent measures. Technical and organizational measures for assisting the Controller with data subject rights are described in Clause 5. |
Annex III – Authorised Sub-processors
The current list is maintained at https://www.wise-doctor.com/legal/subprocessors. Authorised Sub-processors on the effective date:
| Sub-processor | Service | Data concerned | Location of processing | Transfer safeguard |
|---|---|---|---|---|
| Render Services, Inc. (United States) | Hosting of the API and of the PostgreSQL database, including background tasks | All Platform data; sensitive medical fields encrypted | Frankfurt, Germany (EU) | Standard Contractual Clauses |
| Cloudflare, Inc. – R2 (United States) | Private file storage | Medical documents, test results, profile photos | European Union (Cloudflare EU jurisdiction) | Standard Contractual Clauses or EU–US Data Privacy Framework |
| Vercel, Inc. (United States) | Hosting and delivery of the website and of the web application | IP address and technical browsing data; no health data | Global network | Standard Contractual Clauses or EU–US Data Privacy Framework |
| OpenRouter, Inc. (United States), with Claude models (Anthropic, PBC) run on Google Cloud or Amazon Web Services | Access to AI models for clinical decision support and the Ask Wise assistant | Pseudonymised texts only; zero data retention and no training required on every request | United States | Standard Contractual Clauses |
| Sendinblue SAS – Brevo (France) | Transactional emails (confirmations, reminders, password) | Email address, name, appointment date and time | European Union (France) | No transfer outside the EU |
| Google LLC (Firebase Cloud Messaging), Apple Inc. (APNs) and the push services of browsers (Google, Apple, Mozilla, Microsoft) | Push notifications on mobile devices and browsers | Device token or subscription identifier and a short notification text, without medical details | Mainly United States | EU–US Data Privacy Framework |
| Functional Software, Inc. – Sentry (United States) | Monitoring of technical errors, when enabled | Technical error reports, cleaned of personal data before sending | United States | Standard Contractual Clauses or EU–US Data Privacy Framework |
Annex IV – Particulars of the Standard Contractual Clauses (Module Two)
| Clause 7 (Docking clause) | Included. |
|---|---|
| Clause 9(a) (Sub-processors) | Option 2 – general written authorization; notice period: 30 days (Clause 4 of this DPA). |
| Clause 11(a) (Redress) | Optional independent dispute resolution body language: not included. |
| Clause 13 and Annex I.C (Supervisory authority) | The supervisory authority of the EU Member State in which the data exporter is established or, if not established in the EU, in which its Art. 27 representative is established or where the data subjects are located. |
| Clause 17 (Governing law) | Option 1 – the law of Ireland. |
| Clause 18(b) (Forum) | The courts of Ireland. |
| Annexes I.A, I.B, II, III | Annexes I, II and III of this DPA. |
| Parties and signature | Acceptance of the Terms by the Provider constitutes signature of the SCCs by the data exporter; Wise Doctor's signature is given by its publication and execution of this DPA. Wise Doctor may countersign on request. |