Data Processing Agreement (DPA)
1. Subject matter and duration
Cita2 processes the Controller’s customers’ personal data solely to provide the contracted scheduling and management service, for the duration of the contract and until the data is returned or deleted (clause 10).
2. Data and data subjects
Data subjects: the Controller’s customers, patients and guardians. Data: identification, contact details, booking and payment history and, if the Controller enables clinical modules, health data (special category/sensitive).
3. Instructions
Cita2 processes data only on the Controller’s documented instructions (this agreement and use of the platform) and will tell the Controller if an instruction infringes the law. Cita2 does not use this data for its own purposes.
4. Confidentiality
Cita2 personnel with access to the data are bound by confidentiality and access it only as needed for support or to maintain the service.
5. Security
Cita2 applies the measures described in its Privacy Policy (section 8): encryption in transit, password hashing, per-business isolation, role-based access control, a tamper-proof log of consents and privacy actions, and encryption at rest and backups handled by its infrastructure providers.
6. Sub-processors
The Controller gives general authorization for the sub-processors on the current list:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and file storage | Configurable (ver aviso) |
| Railway | Application server hosting | EE. UU. |
| Resend | Transactional and campaign email delivery | EE. UU. |
| Twilio | WhatsApp messaging | EE. UU. |
| Stripe | Card payment processing | EE. UU. / UE |
| PayPal | Payment processing | EE. UU. / UE |
| MercadoPago | Payment processing (Chile and enabled countries only) | LatAm |
| CARTO / OpenStreetMap | Location maps on public pages (visitor IP is sent) | UE / EE. UU. |
Cita2 has contracts with them with equivalent obligations and remains liable for their compliance. It will give reasonable notice of changes; the Controller may object and, if there is no alternative, terminate the service.
7. International transfers
The Controller authorizes processing outside its country. Cita2 will use standard contractual clauses or other valid mechanisms where the law requires them.
8. Data-subject rights
Cita2 provides the Controller with tools to handle access, portability, rectification, restriction and erasure (the Privacy and data panel) and will forward any requests it receives from the Controller’s customers within 15 days. The Controller is the one who answers the data subject.
9. Security incidents
Cita2 will notify the Controller without undue delay after becoming aware of a breach affecting its data, with the information available so the Controller can meet its own notification duties (generally to the authority within 72 hours).
10. Return and deletion
When the service ends, Cita2 will allow the data to be exported and then delete it, except what it must keep by law. Records under a legal retention duty are restricted and deleted when the period expires.
11. Audit
Cita2 will make available the information needed to demonstrate compliance and allow reasonable audits, on prior notice and without affecting other customers.
12. Controller’s obligations
The Controller represents that it has a legal basis to process the data, informs data subjects through a privacy notice, obtains explicit consent for health data and marketing, and keeps its country and clinical-retention period up to date on the platform.
Base document: it must be reviewed by legal counsel in each jurisdiction.