Data Processing Agreement
Last updated September 30, 2026
This agreement applies when a clinic ("Clinic") uses Clinvite ("Processor") and it forms part of the Terms of Service. The Clinic is the organization responsible for the personal information of its patients and their referred friends. Where the Clinic is a health information custodian under Ontario's Personal Health Information Protection Act, Clinvite acts as its agent and electronic service provider.
1. What we process
First names and mobile numbers of patients who send invites, first names, mobile numbers and contact consent of friends who claim them, and the dates of scans, invites, claims, visits and rewards. No health information, diagnoses or treatment details are collected.
2. Purpose
We process this information only to provide Clinvite to the Clinic: generating invites, claim pages and visit passes, showing the Clinic its referrals and rewards, and keeping the service secure. We do not use it for any other purpose and we never sell it.
3. Our commitments
- Process the information only on the Clinic's instructions, given through the product settings and this agreement.
- Limit access to people who need it to provide or support the service, under confidentiality obligations.
- Protect it with safeguards suited to its sensitivity: encryption in transit and at rest, role-based access, rate limits, and an audit log of access to records, exports and deletions.
- Notify the Clinic without undue delay, and within 72 hours where possible, after becoming aware of a breach of security safeguards affecting its information, and help the Clinic meet its own notification duties.
- Help the Clinic respond to requests from individuals to access, correct or delete their information. The dashboard lets the Clinic export and delete records directly.
- Delete records automatically after 24 months without activity, and delete all Clinic data within 30 days after the account closes.
4. Sub-processors
| Provider | Purpose | Data |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, security | All service data |
| Resend | Email to clinic staff | Staff email addresses, counts, first names |
| Stripe, Inc. | Subscription billing | Clinic billing details only |
We will give 30 days' notice of a new sub-processor that handles patient or friend information.
5. The Clinic's commitments
- Use the information only to provide care and to follow up on referrals with people who consented to contact.
- Choose reward settings that comply with its professional college's rules.
- Keep staff accounts limited to people who need them, and remove access when staff leave.
6. Audits
On reasonable written request, once a year, we will answer the Clinic's security questionnaire and describe our safeguards.