Roles and scope
The clinic is the controller of the personal data it puts into Sada and of its patients' data. Digital Echoes, operating Sada, is the processor. Where Sada engages other companies to help provide the service, they act as our subprocessors.
This addendum covers personal data processed by Sada on the clinic's behalf. It does not cover data where we are the controller — for example the clinic's billing contact details — which is described in our Privacy Policy.
Details of the processing
| Item | Detail |
|---|---|
| Subject matter | Providing cloud practice-management software and patient messaging to the clinic |
| Duration | For as long as the clinic's account is active, plus the deletion periods below |
| Nature and purpose | Storage, organisation, retrieval, transmission and deletion of clinic records; sending appointment reminders, follow-ups and, where enabled, AI-generated replies |
| Types of personal data | Names, phone numbers, email addresses, dates of birth, gender, addresses, file numbers; appointment, treatment and billing records; uploaded files including radiographs; WhatsApp message content and metadata; staff account details |
| Special categories | Health data — medical alerts, allergies, conditions, medications, charting, treatment plans, prescriptions and clinical images |
| Categories of data subject | The clinic's patients (including, where the clinic records them, minors) and the clinic's own staff |
Our obligations
- We process personal data only on the clinic's documented instructions, which include using the product as configured. If we believe an instruction breaches applicable law, we will tell you.
- We do not sell personal data, use it for our own advertising, or use patient records or conversations to train our own models.
- Everyone we allow to access personal data is bound by confidentiality obligations.
- We implement the technical and organisational measures set out below, and keep them under review.
Subprocessors
You give general authorisation for the subprocessors listed in our Privacy Policy — currently Railway (hosting), Cloudflare (file storage and backups), Anthropic (AI replies), Meta (WhatsApp delivery), and Speechmatics and Deepgram (voice-note transcription).
- Each is bound by a written agreement with data-protection obligations no less protective than this one.
- We will give at least 30 days' notice before adding or replacing a subprocessor that handles clinic data.
- If you reasonably object on data-protection grounds, tell us within that period and we will work to find a solution; if none is possible, you may terminate the affected part of the service without penalty for the remainder of the term.
- We remain responsible to you for our subprocessors' performance.
Security measures
The measures in force are described in detail under How it is protected. In summary: encryption in transit; salted scrypt password hashing; centrally enforced separation between clinics, verified by automated cross-tenant tests; role-based access control; an audit trail of key actions; automated off-site backups; and access by Sada staff limited to those who need it for support and maintenance.
We will not weaken these measures during the term.
Breach notification
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 72 hours, with the information we have: what happened, which categories and roughly how many records are affected, the likely consequences, and the measures we are taking. We will keep you updated as we learn more, and we will help you meet your own notification duties to regulators and patients.
Helping you meet your obligations
- Patient requests. Most access, correction and deletion requests you can handle yourself in the product. Where you cannot, we will help — including producing a copy of your clinic's data. If a patient contacts us directly, we will refer them to you rather than act on your data ourselves.
- Impact assessments. We will provide the information you reasonably need for a data protection impact assessment or a consultation with a regulator.
- Regulator contact. If a regulator contacts us about your data, we will tell you promptly unless the law forbids it.
International transfers
Sada is hosted in the United States, and our AI and transcription providers process data on their own infrastructure, which may be in the United States or elsewhere. By using Sada you instruct us to make these transfers.
Where a transfer is subject to the GDPR or a comparable regime, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses with the relevant provider. We will provide details on request.
Return and deletion
- At any time during the term, you may ask for a copy of your data and we will provide it in a machine-readable form.
- On termination, we delete your data on request and in any case within 90 days of the account closing, except anything we are legally required to retain.
- Off-site backups are kept on a rolling 30-day window; deleted data disappears from backups as that window passes.
- We confirm deletion in writing when it is complete.
Audits
On reasonable notice, and no more than once a year unless a regulator or a breach requires otherwise, we will make available the information needed to demonstrate compliance with this addendum and respond to a reasonable security questionnaire. Where an on-site or third-party audit is required by your regulator, we will cooperate in good faith and agree scope and timing so that patient confidentiality and other clinics' data are protected.
Sada is operated by Digital Echoes, Lebanon.
To request a signed copy of this addendum, or to raise a data-protection question: hello@sadaclinic.com
See also: Privacy Policy · Terms of Service