Data processing agreement

Data processing agreement under article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). Version 0.5, 26 October 2026 (version 0.5 identifies the processor by its trade name, sets the periods for return and erasure and the jurisdiction, adds the safeguard on AI providers and the assignment to the owner's company, and adjusts the security measures and transfers to the current infrastructure; version 0.4 added usage data without patient data and the assistance mode; version 0.3, the address suggestions; version 0.2, the patient portal). This is a courtesy translation: if it differs from the Spanish text, the Spanish text prevails.

Parties

Controller ("the Clinic"): the natural or legal person who owns the dental clinic identified in its Oclivo account, represented by whoever accepts this agreement as owner of the account, who declares they are authorised to do so.
Processor ("Oclivo"): Oclivo, the trade name of the owner identified in the legal notice.

The Clinic accepts this agreement when it creates the clinic in Oclivo, and each new version under clause 14.

Clause 1 · Subject matter

Oclivo processes on behalf of the Clinic the personal data needed to provide it with the cloud-based clinical management software described in the terms of service. The nature and purpose of the processing and the categories of data subjects and data are described in annex I.

Clause 2 · Duration

The agreement lasts as long as the service relationship between the Clinic and Oclivo, including the trial period. The obligations of confidentiality, return and erasure survive its end.

Clause 3 · Instructions

Oclivo processes the data only on documented instructions from the Clinic, including with regard to transfers to third countries. The instructions are: this agreement, the settings the Clinic chooses in the platform (annex IV) and those it gives in writing.
Oclivo immediately informs the Clinic if it considers that an instruction infringes data protection law.
Oclivo does not process the Clinic's data for its own purposes, except the usage data without patient data of point 6. In particular, it does not use patient data to train or improve artificial intelligence models, its own or third parties'.
Artificial intelligence and transfers. No real health data are sent to artificial intelligence or transcription providers established, or processing the data, in countries without a European Commission adequacy decision or the appropriate safeguards of Chapter V of the GDPR. With real data, those providers process the data in the European Union, without keeping them or using them to train models, and receive the clinical text after the server has replaced the data that identify the patient.
Address suggestions. When an address is typed in the platform (of a patient, a payer, a supplier or the Clinic itself), the typed text is sent from the Oclivo server to Google (Places API) to suggest full addresses. Only that text, a random identifier of the search and the Clinic's province as a hint are sent; never the name, phone number, record number or any identifier of the patient, the Clinic or the user, nor the IP address of their device. Google processes what it receives as an independent controller, under its controller-controller data protection terms for Google Maps and its privacy policy, with the transfer to the United States relying on the EU-US Data Privacy Framework; it is not a subprocessor of Oclivo. While Google is not enabled, the suggestions come from CartoCiudad (Spanish National Geographic Institute). Oclivo neither stores nor logs the searched text or the suggestions: only the address the person confirms. The Clinic gives this instruction when it accepts the agreement, and its staff can always type the address by hand without choosing any suggestion.
Usage data to improve the service and assistance mode.
1. Usage data without patient data. The Clinic knows and authorises that Oclivo collects, from its staff's use of the platform, usage data and statistics that contain no patient data: screens visited with the address stripped of identifiers, clicks without the text of the elements, timings, errors by code, survey answers and session recordings in which everything typed, patient values and clinical areas (odontogram, records, images, documents, dictation) are masked. Oclivo processes them as controller, to maintain, fix and improve the service, and informs each user about it in the privacy policy of the application.
2. Safeguards. (a) Never patient data, not even pseudonymised; (b) the identifiers of the person and the Clinic are replaced by an irreversible code, without names, emails, the Clinic's name or IP address; (c) each member of staff decides whether their use is measured and can withdraw at any time, and the Clinic does not know who accepted; (d) the Clinic can turn it off for its whole team in its settings; (e) Oclivo does not give the Clinic individual usage data or recordings of its staff, and neither Oclivo nor the Clinic will use them to assess a person's performance or for any employment monitoring (articles 87 to 91 LOPDGDD); (f) the analytics provider, in its European Union cloud, acts as processor of Oclivo for these data and is listed in the list of subprocessors among the providers of Oclivo as controller.
3. Aggregate statistics. Oclivo may produce and keep aggregate statistics on the use of the platform that do not identify any Clinic or person, and use them to improve the service.
4. Assistance mode. At the Clinic's request, whoever has the management permission can switch on from the platform an assistance mode of 1, 4 or 24 hours, which ends by itself and can be stopped earlier, so that Oclivo support can see the recorded sessions and solve an incident. Switching it on and off is recorded in the audit log the Clinic can consult. Recordings from that period are marked and deleted after 7 days, keep the same masking as point 1 and are only used for that incident. It is a documented instruction of the Clinic.
5. Unmasked recording. Oclivo does not offer unmasked recording of patient data. If it ever offered it during the assistance mode, it would notify it as a new subprocessor with the notice of clause 6, only the Clinic could switch it on for each period, and access to patient data would be governed by clause 4.

Clause 4 · Confidentiality

Oclivo ensures that the persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. By default, Oclivo staff do not access patient data; any exceptional access (for example, to solve an incident or carry out a migration the Clinic has asked for) requires the Clinic's prior authorisation, is temporary and is recorded in the audit log the Clinic can consult.

Clause 5 · Security

Oclivo applies the technical and organisational measures of annex II, appropriate to the risk of processing health data (article 32 GDPR), and reviews them periodically. It may update them as long as the level of protection is not reduced.

Clause 6 · Subprocessors

The Clinic gives a general authorisation for Oclivo to engage the subprocessors in the published list (annex III).
Oclivo notifies any addition or replacement of a subprocessor 30 days before its effective date, in the application and by email to the owner. During that period the Clinic may object on reasoned grounds; if the parties do not find an alternative, the Clinic may terminate the agreement without penalty with respect to the affected service.
Oclivo imposes on each subprocessor, by contract, the same data protection obligations as this agreement and remains liable to the Clinic for their performance.
The Clinic's data are hosted in the European Union. Where a subprocessor is established outside the European Economic Area or may access the data from outside it, the list says so together with the Chapter V GDPR safeguard for the transfer (adequacy decision or standard contractual clauses).

Clause 7 · Data subjects' rights

Oclivo gives the Clinic tools to handle the rights of access, rectification, erasure, restriction, portability and objection (machine-readable patient export, rectification with history, blocking). If a data subject contacts Oclivo, it informs the Clinic without delay and does not reply on its own. The patient portal is a channel of the Clinic: requests made by the patient through it reach the Clinic, which resolves them within the legal period.

Clause 8 · Assistance to the Clinic

Oclivo assists the Clinic, taking into account the nature of the processing and the information available to it, in meeting its obligations on security, breach notification, impact assessment and prior consultation (articles 32 to 36 GDPR). In particular, it provides the general impact assessment of the product and, where appropriate, templates for the Clinic's own.

Clause 9 · Security breaches

Oclivo notifies the Clinic of any breach affecting its data without undue delay and, as a target, within 24 hours of becoming aware of it, with the information of article 33.3 GDPR available at each moment. Notification to the supervisory authority and to data subjects is the Clinic's responsibility.

Clause 10 · End of the agreement: return and erasure

When the service ends, the Clinic has 30 days to download the full export of its data from the platform, in a structured, machine-readable format (for example, JSON) and with its documents (for example, as PDF). Nothing is erased during that period.
After that period, Oclivo securely erases the Clinic's data from its servers and destroys the Clinic's encryption keys (cryptographic erasure). Backups that contain them are erased when they expire under their rotation cycle and, until then, are not restored for any other purpose.
On request, Oclivo gives the Clinic a certificate of erasure.
Oclivo only keeps, blocked, what a rule obliges it to keep.
Keeping the clinical records for the legal period is the Clinic's obligation (Spanish Law 41/2002, of 14 November, on patient autonomy): that is why it must download them before the period of point 1 ends. If it wants Oclivo to hold them after the end of the service, it must be expressly agreed in writing before that period ends.

Clause 11 · Information and audits

Oclivo makes available to the Clinic the information needed to demonstrate compliance with this agreement (description of the measures, a summary of penetration test results and certifications, if any) and allows audits, by the Clinic or by an independent auditor bound by confidentiality, with 30 days' notice, during business hours and at the Clinic's expense, at most once a year except in case of a breach or a request from an authority.

Clause 12 · Obligations of the Clinic

The Clinic:

Guarantees the lawfulness of the processing and the legal basis of each datum it enters.
Informs its patients (article 13 GDPR), including about the use of the AI scribe and transcription if it uses them, with the templates Oclivo offers as guidance, which it must review with its adviser. If it switches on the patient portal, its privacy policy covers it and the address of that policy is set in the portal settings, which link it from the first layer of the notice.
Carries out its own impact assessment where appropriate and decides which optional features it switches on (annex IV).
Manages its staff's permissions, requires the responsible use of credentials and tells Oclivo of any incident it detects.
Does not enter real patient data in test or demo environments, nor before the date Oclivo tells it in writing under the terms of service.
If it switches on the patient portal, keeps its patients' mobile, email, date of birth and guardians up to date, records the objection of minors aged 14 and 15 and removes the access of anyone who must not see a patient's area.

Clause 13 · Liability, governing law and jurisdiction

Each party's liability is governed by article 82 GDPR and, otherwise, by the terms of service. This agreement is governed by Spanish law. For any dispute, the parties submit to the courts of Albacete, unless a mandatory rule provides for another forum.

Clause 14 · Versions

New versions of this agreement are announced in the application and by email to the owner 30 days before they come into force, and the Clinic accepts them in the platform. Minor changes (typos or contact details) need no new acceptance.

Clause 15 · Assignment

If the owner sets up a company to provide the service, this agreement is assigned to it together with the terms of service, as provided in their section 14: the Clinic consents in advance, receives a notice by email at least 30 days in advance and, if it does not accept the assignment, can terminate at no cost. The company assumes all the rights and obligations of Oclivo as processor.

Annex I · Description of the processing

Nature: hosting, recording, organisation, consultation, modification, cancellation, blocking, export, transcription, migration from other software and erasure, in a multi-clinic cloud service with isolation per clinic.
Purpose: to provide the Clinic with the clinical management software: patient file and clinical records, agenda, odontogram, quotes and payments, invoicing, documents and signature, AI scribe, communications with patients, patient portal and staff management.
Data subjects: patients (including minors), guardians and representatives, payers and the Clinic's staff.
Data: identification and contact data, identity document, address, financial data; special categories: health data; digitised handwritten signature; consultation audio, transcribed on the fly and not kept; and access data of patients and guardians to the patient portal (sessions, summarised device and access log).
Location: European Union (annex III).

Annex II · Technical and organisational measures

Isolation per clinic in four layers, with row-level security policies in the database that fail closed.
Access control: least-privilege roles defined in a single source; second sign-in factor, session expiry and automatic sign-out on inactivity. Patients sign in to the portal with a one-time code sent to the contact the Clinic already holds, in a session separate from staff sessions, and need a recent code to see documents.
Encryption: TLS 1.2 or higher and HSTS; encrypted disks; application-level encryption of clinical notes, transcriptions, files and other sensitive data, with per-clinic keys protected by a master key kept on an encrypted volume of the server itself, in the European Union.
Traceability: audit log of changes and of readings of the clinical records, immutable and chained, which the Clinic can consult.
Artificial intelligence: providers processing in the European Union, without retention of the data or use to train models; server-side replacement of the data that identify the patient before a text is sent; no change to data without human confirmation.
Availability: daily encrypted backups, kept off the server in the European Union under their rotation cycle, with restoration tested periodically.
Exports encrypted with a one-time password, re-authentication and expiry.
Secure development: separate environments, fictitious data only outside production, security review of every relevant delivery, dependency updates and an external penetration test before processing real data and every year after that.
Organisational: staff confidentiality commitment, breach management procedure, record of processing activities, a data protection officer designated before processing real data and annual training.

Annex III · Subprocessors

The current list, with the service, location and safeguards of each subprocessor, is the list of subprocessors, in the version accepted by the Clinic.

Annex IV · Instructions the Clinic configures

AI scribe and transcription: available to staff with the permission to use AI; each professional decides in each consultation whether to use them. The Clinic's management configures AI and removes the permission from anyone who must not use it.
Consultation audio: transcribed on the fly and not kept.
Communications to patients on each channel: according to the recorded consents. Managed by staff with permission.
Automatic sign-out on inactivity: 30 minutes by default (5 to 60). Changed by the owner or the administration.
Expiry of export files: 24 hours by default (up to 7 days). Changed by the owner or the administration.
Patient portal (switching it on, its address and the countries of the mobile numbers accepted): off by default. Changed by the owner or the administration.
Documents shared with the patient in the portal: by default, signed consents and the quotes, invoices and receipts in their name; the rest, one by one. Decided by staff with permission over the portal who can see the document.
Access of minors and guardians to the portal: under 14, the guardian; aged 14 and 15, the minor and the guardian unless the minor objects; from 16, only the patient. The rule is fixed; the objection and "No portal access" are recorded by staff with permission over the portal.
First layer of the portal privacy notice and link to the Clinic's policy: text by Oclivo and the link the Clinic gives. Changed by the owner or the administration.
Address suggestions (clause 3.5): on. Each person decides in each field whether to choose a suggestion or type by hand.
Usage data without patient data (clause 3.6.1 to 3.6.3): on for the Clinic; each member of staff decides whether their use is measured (no answer, not measured). Changed by the Clinic's management and, for themselves, by each person in their account settings.
Assistance mode with session recording (clause 3.6.4): off; when switched on, 1, 4 or 24 hours, masked recording and deletion after 7 days. Switched on by the Clinic's management, recorded in the audit log.