Data processing agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Clinic Prep ("we", "us") and the clinic using our service ("you", "the Clinic"). It sets out how we handle personal information, including health information, on your behalf while providing the Clinic Prep service. It is incorporated by reference into our Terms of Service.

Clinic Prep connects to your practice management system, de-identifies patient history, sends the de-identified text to an AI provider for summarising, re-attaches the patient's identity on our own infrastructure, and delivers a briefing to the clinician. Section 4 covers that AI step in detail, because it is the part most clinics want to understand before they sign.

If your organisation needs a separately signed or bespoke version of this DPA, contact [email protected].

You are the health agency responsible for your patients' personal and health information under the Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC). Clinic Prep acts as your agent for the purpose of section 11 of the Privacy Act 2020: we process personal information only to provide the service you have configured (retrieving appointments, generating briefings, and delivering them to your clinicians), and only on your instructions as reflected in your account settings.

If you are an Australian clinic, you are the APP entity responsible for the health information under the Australian Privacy Act 1988, and we handle it on your behalf on the same basis.

We do not use patient information for any purpose other than delivering the service to you. We do not sell it, and we do not share it with third parties for marketing purposes.

We process the following categories of information on your behalf:

• Clinic and account information - your clinic name, timezone, settings, and the names and email addresses of your administrators and clinicians.
• Practice management system credentials - the API credentials you provide so we can read appointments and patient history. Encrypted at rest and only decrypted at the point of use.
• Patient appointment and clinical history - retrieved from your practice management system at briefing time and processed to generate a summary. Raw patient records are not stored in our database.
• Patient summaries - the patient name and generated summary text for each briefing, stored encrypted at rest and purged after 24 hours.
• Account security records - sign-ins, failed sign-ins, and changes to account security settings, each with a timestamp, IP address, browser user agent, and the email address used. Failed sign-ins record the email address attempted even where it does not match an account. These records contain no patient information and are retained for 12 months so that a security incident can be investigated. This is the one category we retain on our own account rather than solely on your instruction, as a security measure under section 6 below.
• Briefing run records - one record per clinician per briefing run, showing when it ran and whether delivery succeeded. Purged after 24 hours.

Further detail is in our Privacy Policy.

We use the following sub-processors to provide the service:

• Anthropic PBC (United States) - AI processing of de-identified clinical text via the Claude API. Only de-identified text is sent. See section 4 for exactly what is removed first, and section 5 for our position on offshore processing.
• Hetzner Online GmbH (Germany, EU) - application and database hosting. This is where identifiable patient information is held during the 24 hours a briefing exists.
• Postmark (Wildbit LLC) - transactional email delivery, including the briefing emails sent to your clinicians.
• Stripe - payment processing for your Clinic Prep subscription. Stripe does not receive patient information.
• Slack - optional briefing delivery, only where you connect your Slack workspace. If you do not connect Slack, no information reaches Slack.
• Cloudflare - DNS for our website and application domains.

Gensolve and Cliniko are your own practice management systems, not Clinic Prep sub-processors. We connect to them using credentials you provide, under your existing agreement with that vendor.

We will give you reasonable notice by email before adding or replacing a sub-processor that will handle patient information, so you can raise any objection.

Before any clinical text leaves our infrastructure, we de-identify it. The following are removed from the record and replaced with a reference code or a placeholder:

• Patient name, including first name, last name, and full name as they appear in the notes.
• Date of birth.
• NHI number.
• Phone numbers.
• Email addresses.

The de-identified text is then sent to the Anthropic Claude API for summarising. When the summary comes back, the reference code is swapped for the patient's identity on our own infrastructure. The map between the reference code and the patient exists only for the duration of the briefing run and is never written to our database.

Anthropic does not use commercial API data to train its models. Anthropic retains API inputs and outputs for a limited period for trust and safety and abuse monitoring purposes, then deletes them. We do not have a zero data retention arrangement with Anthropic, and we do not claim one.

An honest limit. De-identification is automated and best-effort. It removes the structured identifiers listed above and the patterns we can reliably detect in free text, but clinical notes are written by people, and no automated process can guarantee that every identifying detail has been caught. We do not represent the text sent to Anthropic as fully anonymised information under the Privacy Act 2020. You remain the health agency responsible for the underlying patient record, and you should treat this step as a strong safeguard rather than a removal of your obligations.

The Clinic Prep application and database are hosted in the European Union (Germany), with Hetzner Online GmbH. EU hosting is subject to EU data protection law (GDPR), which we consider to provide comparable safeguards to those required under the Privacy Act 2020 for information disclosed or stored outside New Zealand.

The AI summarising step is the one exception. De-identified clinical text is sent to Anthropic in the United States, and the summary is returned to our EU infrastructure, where identity is re-attached. Identifiable patient information is not stored in the United States.

We are happy to discuss this further if your organisation has a specific data residency requirement.

We maintain security measures appropriate to the sensitivity of the information we process:

• All traffic runs over HTTPS/TLS, so information is encrypted in transit, including calls to your practice management system and to the Claude API.
• Practice management system credentials are encrypted at rest and only decrypted at the point of use.
• Your Slack token is encrypted at rest, where you have connected Slack.
• Patient summaries, meaning the patient name and the generated summary text, are encrypted at rest.
• Passwords are hashed, never stored in plain text, and access to the application requires an authenticated account.
• Every briefing run is logged, recording which clinician it was generated for, when it ran, and whether delivery succeeded.

To be precise about the limits: our databases are not encrypted at the volume level beyond the application-level encryption described above, and we do not log individual user access to patient summaries. We review and improve these measures on an ongoing basis. Further detail is in our Privacy Policy.

If we become aware of a privacy or security breach affecting your patients' personal information, we will notify you without undue delay, and in any case within 48 hours of confirming the breach, with the information available to us at the time.

We will provide reasonable assistance so you can meet your own notification obligations, including to the Office of the Privacy Commissioner and affected patients under the Privacy Act 2020, or to the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme in the Australian Privacy Act 1988.

If a patient asks you to access, correct, or delete information we hold on your behalf, contact [email protected] and we will help you respond promptly.

In practice, we hold very little: the source record stays in your practice management system, and anything we generate is purged after 24 hours. That means most requests are answered from your own system rather than ours.

Patient summaries and briefing run records are automatically purged from our database 24 hours after they are created. Copies may persist for a short time in operational systems (queue records, server logs, and backup snapshots) and are removed on our normal backup rotation schedule.

Clinic and account information is retained for as long as your account is active. When your account is closed, we delete your data from our production systems immediately, subject to removal from backups on our normal backup rotation schedule. Account security records are the exception: they contain no patient information and are kept for 12 months so that a security incident affecting your clinic can still be investigated after the account is closed.

You can also ask us to delete your data at any time by emailing [email protected].

On reasonable request, we will provide information about our security and privacy practices to help you assess your own compliance obligations, including completing a procurement or security questionnaire.

This DPA applies for as long as our Terms of Service apply to you. It is governed by New Zealand law. For any questions, contact [email protected].