Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) is incorporated into the Terms. It applies while WAdoc processes Customer Data as processor for the Customer as controller. It continues for the subscription term and any export, retention or deletion period.

2. Processing details

Subject matter: providing, securing and supporting WAdoc. Nature and purpose: hosting, organising, transmitting, backing up, restoring, displaying and deleting Customer Data according to the Terms and the Customer’s in-app configuration. Data includes identity, contact, appointment, attendance, service, administrative note, document, message, permission and health-related information. Data subjects include Patients, guardians, Users and Customer personnel.

3. Instructions and confidentiality

WAdoc processes Customer Data only on documented instructions in the Terms, Order Form and Customer’s in-app configuration, unless law requires otherwise. WAdoc will notify the Customer before legally required processing unless prohibited, and will inform the Customer if an instruction appears to breach applicable data-protection law.

Personnel authorised to process Customer Data are bound by confidentiality and receive access only as needed.

4. Security measures

WAdoc maintains role-based access, doctor-level patient scoping, MFA for privileged roles, encryption in transit, hashed session tokens, CSRF protection, audit logging, backups, erasure-journal replay after restore, WhatsApp message-text redaction after 30 days and clinic-snapshot expiry after 30 days. Measures may evolve without materially reducing overall protection.

5. Support access

WAdoc staff access Customer Data only for an open support request or a security or legal need, under an opened case with a recorded reason. Access expires after four hours, is logged and is visible to the Customer.

6. Subprocessors

The Customer gives general authorisation for the subprocessors below. WAdoc will publish the current list and give 30 days’ advance notice of a new or replacement subprocessor. The Customer may object on reasonable data-protection grounds during that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service before the change. WAdoc remains responsible for each subprocessor’s processor obligations.

• Amazon Web Services — hosting, database, backups, files and the self-hosted identity service; hosting region disclosed on request to privacy@wadoc.online.
• Cloudflare — edge delivery, TLS and security.
• Meta Platforms — WhatsApp for Customers that connect it.
• Stripe — billing only; no patient data.
• Brevo — transactional email; no patient records.
• Google — staff sign-in only for Users who choose it.

7. Assistance and incidents

Taking account of the processing, WAdoc assists the Customer with data-subject requests, security obligations, data-protection impact assessments and regulator consultations. The Customer remains responsible for responding as controller.

WAdoc will notify the Customer of a personal-data breach without undue delay and in any event within 48 hours after becoming aware, and provide available information needed for the Customer’s assessment and notification duties.

8. International transfers and KVKK

International transfers use safeguards under GDPR Articles 44–49, including Standard Contractual Clauses where required. Where Turkish personal data is transferred, the parties will use an applicable KVKK Article 9 mechanism. WAdoc performs the processor security duties applicable under KVKK Article 12.

9. Return, deletion and switching

At termination, the Customer has 30 days of read-only access. On request, WAdoc provides Customer Data in a structured, commonly used, machine-readable format. WAdoc deletes Customer Data from live systems within the following 30 days and from backups as they expire within 30 days, unless law requires retention. WAdoc confirms deletion in writing on request.

Where EU Data Act Chapter VI applies, WAdoc supports a transition of up to 30 days, no more than two months’ switching notice and no switching charges.

10. Information and audits

WAdoc will provide information reasonably necessary to demonstrate compliance with this DPA. The Customer may review documentation and, no more than once annually unless an incident or regulator requires otherwise, conduct a reasonable on-site audit at its cost with at least 30 days’ notice. Audits must protect other customers, security and confidentiality and avoid unreasonable disruption.