Data Processing Agreement.

Roles

The clinic is and remains the custodian (BC PIPA / e-Health terminology; controller, in GDPR-style terms) of patient health information. Nidl acts as a service provider / processor: we process personal health information only to provide the contracted services and only on the clinic’s documented instructions.

Scope of processing

Intake documents and referrals, scheduling and appointment records, patient messages, task and audit records, and the patient-account data a patient chooses to connect to the clinic. No secondary use. No sale. No AI training on tenant data.

Residency & sub-processors

Production processing and storage occur in Canada (Montréal region primary). Sub-processors are listed, with purpose and region, on the security page; the DPA commits us to notice before adding or changing any sub-processor that touches PHI.

Safeguards

Encryption in transit and at rest; role-based access with least privilege; tenant isolation enforced at the database layer (row-level security); an append-only, hash-chained audit trail of access and changes; personnel confidentiality obligations; and environment separation between production and development.

Breach notice

We notify the clinic without undue delay — and in any case within 72 hours — of confirming a breach affecting its data, with the facts needed for the clinic to meet its own notification duties, and we cooperate fully in the response.

Audit & assistance

The clinic may request evidence of our controls (documentation, audit-trail exports, and — for cause — a scoped review). We assist with patient access/correction requests routed through the clinic.

Return & deletion

On termination, clinic data is returned or exported in a standard format and then deleted from production within ninety days, except audit records retained as law requires. Patient account connections honour the platform’s recall model — a revoked connection removes clinic access immediately.

Getting the signature copy

Email hello@nidl.ca with your clinic name and privacy officer contact and we’ll send the current DPA for signature alongside the pilot order form.