Trust and compliance

Legal documents

Privacy notice: what we collect, why, who receives it and your rights, including a section for patients of US clinics.

Terms of service: the subscription agreement between your clinic and WAdoc.

Data processing addendum: our processor commitments under GDPR Article 28 and KVKK, part of the terms.

Refunds and cancellation: guarantees, refunds and how to cancel.

Business associate agreement: for US HIPAA-covered clinics; key terms below, full text sent with the order form or on request to privacy@wadoc.online.

GDPR and KVKK

For patient and clinic records, your clinic is the controller and WAdoc is its processor. We process that data only on the clinic's instructions, under the data processing addendum. For accounts, billing, security and support, WAdoc is the controller, as the privacy notice explains.

Where Turkish personal data is involved we apply KVKK Articles 9 and 12. International transfers use the safeguards the addendum describes. Patients exercise their rights through their clinic; we help the clinic answer.

HIPAA (United States)

For US clinics that are HIPAA covered entities, WAdoc acts as a business associate and signs a business associate agreement before the clinic stores patient information. The clinic turns on HIPAA mode, which adds these safeguards:

• Two-step sign-in for every member of the clinic, not only owners and administrators.
• A record of who read each patient's information, which the clinic owner can review.
• Link-only messaging: WhatsApp, Messenger and Instagram carry a generic link to the clinic's patient portal, never appointment details. Patients verify themselves before anything is shown.
• Support notifications sent as links, so support text stays inside the service.
• A named breach contact for every covered clinic.
• Support for federally assisted substance use disorder programs (42 CFR Part 2), with program terms in the agreement.
• Patient data stored in the United States.

There is no official HIPAA certification: the US Department of Health and Human Services does not certify or endorse vendors. Instead, we describe the safeguards and contract terms we offer, and each clinic remains responsible for its own HIPAA program. State-law notes for California, Texas, Washington and Nevada are in the privacy notice.

Business associate agreement: key terms

• A preliminary notice within 72 hours of discovering a possible breach or a security incident that reached patient information.
• A breach report without unreasonable delay and within 10 calendar days of discovery; other security incidents within 5 business days.
• Patient information used only to provide the service; never sold and never used for marketing.
• Every subcontractor that handles patient information is bound in writing to the same restrictions; 30 days' notice before adding one.
• Patient information stored in the United States. WAdoc personnel are in the European Union and reach it only through logged, case-based support access.
• On termination, patient information is returned or destroyed within 30 days.
• Qualified service organization terms for 42 CFR Part 2 programs.

The full agreement is sent with the order form. Request a copy at privacy@wadoc.online.

Security controls

• Encryption in transit (TLS) and at rest for databases, backups and uploaded files.
• Role-based clinic access and doctor-level patient scoping, applied inside every database query.
• Two-step sign-in required for clinic owners, administrators and platform staff.
• Hashed session tokens, idle and absolute session limits, and anti-forgery protection.
• Audit logs of changes and of patient-record reads.
• Support access only through an opened case with a recorded reason; it expires after four hours, is logged and is visible to the clinic.
• Automated encrypted backups with point-in-time recovery and a tested full-service recovery procedure that keeps erasures and restrictions in force after a restore.
• Cloud audit trails and threat-detection alerts for the infrastructure.
• Data minimisation: WhatsApp message text is redacted after 30 days and clinic snapshots expire after 30 days.

No internet service can promise absolute security. These measures may change without reducing overall protection.

Information security management

We run information security in line with ISO/IEC 27001:2022: a security policy, a risk assessment and treatment plan, a Statement of Applicability, incident response, business continuity, supplier management and workforce training. WAdoc is not ISO 27001 certified.

Payments

Stripe processes subscription payments and receives card details directly. WAdoc never sees or stores card numbers, and Stripe receives no patient information.

Subprocessors

This is the current list the data processing addendum refers to. We give 30 days' notice before adding or replacing a subprocessor, and customers may object as the addendum describes.

• Amazon Web Services: hosting, databases, backups, uploaded files and the sign-in service. United States. Business associate agreement in place.
• Cloudflare: network edge, TLS and security; processes data in transit. Business associate agreement in place.
• Brevo: transactional email, including patient portal sign-in codes, which name the clinic. Business associate agreement in place.
• Meta Platforms: WhatsApp, Messenger and Instagram, only for clinics that connect them. Meta does not sign business associate agreements, so HIPAA clinics use these channels link-only.
• Stripe: billing only; no patient data.
• Google: staff sign-in, only for staff who choose it.

Report a security issue

Email privacy@wadoc.online with what you found and how to reproduce it. Please do not access other people's data, change data or disrupt the service while investigating. Clinics should also report suspected incidents through the breach contact route in their agreement.

Changes to this page

We update this page when our controls, certifications or subprocessors change. The date at the top shows the latest version.