Data processing agreement
1. Parties and scope
This agreement is between the clinic (“you”) and Spics Digital Marketing SH.P.K. (“DigiDent”, “we”), Rruga Ukë Bytyqi, Prizren, Kosovo, NUI 812274893 with ARBK. It is the processing contract under Articles 27 and 32 of Law No. 06/L-082 on Protection of Personal Data (the “Law”) and part of the Terms of service. After we send you links to both, you accept them together by confirming by email; we keep your confirmation with the version you accepted and send a copy on request. Electronic form counts as written form (Art. 27(8)).
It applies from the first personal data, including during the free trial, to clinic data: what you enter, upload or send us for support, plus the audit trail, technical logs and backups. Our own processing as controller (website, demo requests, our customer relationship, account security) is explained in the Privacy policy. On data protection, this agreement prevails over the Terms; the Albanian version prevails.
2. Roles and the clinic's responsibilities
You are the controller and decide why and how the data is processed; we are the processor and act on your lawful instructions. You are responsible for the legal basis, including for health data (Art. 8), informing people (Arts. 12 and 13), accuracy, record retention, patients' requests, accounts and roles, passwords, devices, your network, files you download or print, deactivating leavers' accounts without delay, and notifying the Information and Privacy Agency (AIP) and patients of breaches where required. A processor that decides the purposes and means in breach of the Law is treated as controller (Art. 27(9)); we do not decide them.
3. Details of the processing
| Item | Details |
|---|---|
| Subject matter, nature, purpose | Providing DigiDent under the Terms so the clinic can manage patients, dental charts, visits, appointments, X-rays, prescriptions, invoices and payments: storing, displaying, searching, changing, deleting, printing and downloading as staff work, encrypted transmission, the audit trail, security, recovery and support on request. |
| Duration | Continuous, from the first data until deletion under section 11. |
| Data subjects | Patients, including children; staff with accounts (clinic admins, doctors, receptionists); others in a file, such as a parent or guardian. |
| Patients | Identification and contact data; health data, such as medical history, dental chart, visits, treatments, X-rays and photos, prescriptions; appointments and recalls; invoices and payments (no bank card numbers). |
| Staff | Account data: identification and contact data, role, login and security data. |
| Logs and backups | The audit trail and technical logs, which can contain health data; backups. |
DigiDent sends no messages to patients: call, SMS and WhatsApp links open staff members' own phones, and those services are not sub-processors.
4. Instructions and confidentiality
We process only on your documented instructions, including for transfers: the Terms, this agreement, your use of DigiDent and written instructions from a clinic admin (Art. 32(2)). We never use the data for our own purposes (testing, analytics, marketing, AI training) and never copy it to development or test systems. If a law requires other processing, we tell you first, unless that law forbids telling you on important public-interest grounds. If we believe an instruction is unlawful, we tell you immediately and may suspend it until you confirm or change it.
Everyone acting under our authority follows your instructions (Arts. 28 and 31(4)) and is bound to confidentiality, also after they leave. We look at the data only as needed to run, protect or fix the service, or at your request, and disclose it only to sub-processors or where a law requires, also after this agreement ends.
5. Security measures
Our measures, which are also our guarantees under Art. 27(1) (Arts. 31 and 32(2)):
| Measure | How it works |
|---|---|
| Encryption | Every connection is encrypted. |
| Passwords | Stored only in a protected one-way form, unreadable even to us. |
| Accounts | Personal, with roles, managed by the clinic admin. |
| Misuse | Protection against forged requests and abuse of the service. |
| Audit trail | Records who changed what and when in clinic data. |
| Files | Private storage, opened only by authorised users. |
| Backups | Regular, in private storage in the EU. |
| Access | To servers, the database and file storage, only the people who run the service. |
Sections 4, 6, 9 and 11 are also part of these measures. We review them when the service or risk changes, without lowering overall protection. You receive a fuller technical description with the contract and on request at hello@digident.app.
6. Sub-processors
You give general written authorisation (Art. 27(2)) for sub-processors in the EU in two categories: our hosting provider (app, database, logs and email) and our file storage and backup provider. You receive the current list, with each one's name, service and location, with the contract and on request at hello@digident.app.
We email you at least 30 days before adding or replacing a sub-processor: who, what it does, which data, where. You may object in writing; if we find no solution, you may end the contract without penalty before the change takes effect. Each sub-processor is bound by written contract to the same obligations and sufficient guarantees (Art. 27(4)); we remain fully liable for them.
7. Where the data is kept
Clinic data is kept in the EU, which is on the AIP adequacy list (Decision No. 22/2025), so no authorisation is needed (Arts. 45 and 46). Where a provider has a US parent company, US transfers happen only under the EU-US Data Privacy Framework or another lawful safeguard. We transfer to a country off the list only on your documented instruction and with the AIP's prior authorisation (Art. 49).
8. Patients' requests and other help
You answer requests for access, rectification, erasure, restriction of processing, portability and objection; we help as far as the nature of the processing allows (Art. 27(3.5)). We export one patient's full data or erase a patient's record when a clinic admin asks at hello@digident.app, without delay, within the one-month deadline (Art. 11(3)). If a patient writes to us, we pass the request to you without delay and refer the patient to you; we don't answer it ourselves.
We help you with security, breaches, impact assessments and prior consultation with the AIP (Arts. 21 to 36), including with the description of the service and measures for your records of processing or for sensitive data in cloud services (Regulation No. 05/2022 on Security Measures in the Course of Personal Data Processing, Art. 22). We keep our own records of processing (Art. 29) and have internal security rules and responsible persons appointed in writing (Art. 40).
9. Personal data breaches
For a breach of clinic data we email the contract address and clinic admins without undue delay and within 48 hours of becoming aware, so you can notify the AIP within 72 hours (Art. 33) and patients where required (Art. 34). The notice gives the nature of the breach, categories and approximate numbers of people and records, likely consequences, measures taken or proposed and a contact person; further information follows in stages. We stop the breach, limit the consequences and give you our documentation. We notify the AIP or patients ourselves only if you ask in writing or a law requires.
10. Information and audits
On request, we show you that we meet this agreement and Art. 27; you supervise our measures (Art. 32(3)). You, or an auditor you authorise who is bound to confidentiality, may check, including by visiting the office from which we run the service, once a year or after a breach, with reasonable notice, during working hours, without interrupting the service and without seeing other clinics' data. For data centres, we pass on our providers' security information. We cooperate with the AIP and other supervisory authorities (Art. 30).
11. Return and deletion
Until deletion, during or after the contract or trial, you may ask for an export: we deliver it within 30 days, in common formats and with the original files. We delete all clinic data and copies within 90 days of the end of the contract; after a trial without a subscription, 30 days after it or, if you asked for an export, on delivery and no later than 90 days after it.
We don't delete data from backups item by item: it is deleted when the backup expires, stays protected and unused until then, and is restored only to recover the service after an incident; if a restore brings back clinic data due for deletion, we delete it again immediately. We keep data longer only as a law requires, such as the Law on Archives (Art. 27(3.7)). We confirm deletion in writing on request. In a dispute, at your request we immediately return the data, stop processing and keep no copies (Art. 32(4)). If DigiDent ceases its activity, we return the data immediately (Art. 32(5)) and then delete it.
12. Liability
Liability between the parties follows the Terms of service and their limits, without affecting patients' and others' right to compensation under Art. 56 of the Law. Under that article, a processor is liable only where it breaches its own obligations or the controller's lawful instructions.
13. Clinics in Albania
Where the clinic is established in Albania, you are controller under Law No. 124/2024 “On the protection of personal data”, supervised by the Commissioner for the Right to Information and Personal Data Protection (IDP). This section supplements the agreement under Article 26 of that law, and where it is stricter it prevails. Under that law, these apply: section 4 (Art. 26(3)(a) and (f); Art. 30(1) and (3)); section 5 (Arts. 26(1) and 28); section 6 (Art. 26(2) and (4)); section 8, with the 30-day period of Art. 12(4), also for Arts. 31 and 32; section 10 (Art. 26(3)(f)); section 11 (Art. 26(3)(ë)); section 2 (Art. 26(8)). We keep records of the categories of processing (Art. 27(2)). We notify you of a breach immediately and within 48 hours (Art. 29(2)), so you can notify the IDP within 72 hours (Art. 29(1)).
Kosovo and the EU are in Annex 1 to IDP Decision No. 01 of 30 April 2025, so transfers to us need no authorisation (Art. 40); to the US, only to recipients certified under the EU-US Data Privacy Framework or with a safeguard under Arts. 39 to 42.
IDP Instruction No. 02 of 30 April 2025 “On the protection of personal health data” also applies to processors (Art. 1(2)): you set record retention (Art. 5(4)); our Art. 8(3) controls are those in section 5, with physical access to the data centres (point (a)) controlled by our providers, and backups kept in private storage in the EU (point (e)); we keep an internal regulation (Art. 8(4)) and give you what you need for yours; the same measures apply on phones and tablets (Art. 10(2)); on request, we export a patient's data in a structured format (Art. 7(4)). Art. 4(4) forbids sharing health data by personal email or WhatsApp; you decide whether staff use the WhatsApp link (section 3) for patients in Albania.
14. Changes and contact
This version replaces the earlier one. We email material changes at least 30 days ahead and publish them here, under section 13 of the Terms; sub-processor changes follow section 6. If the AIP adopts standard contractual clauses (Art. 27(7) of the Law), or the IDP publishes them (Art. 26(7) of the Albanian law), we will propose aligning this agreement with them. Contact: hello@digident.app. No data protection officer has been appointed. Spics Digital Marketing SH.P.K., Rruga Ukë Bytyqi, Prizren, Kosovo.