Data Processing Agreement

1. Roles

The Business controls the personal information of its customers ("Customer Data"). The Provider processes Customer Data only to provide the service and only on the Business's documented instructions (the service configuration — flows, policies and settings agreed with the Business — plus written requests).

2. Instructions only

The Provider does not use Customer Data for its own purposes, does not sell it and does not use it to train models. Diagnosing and fixing faults in the service is part of providing it.

3. AI processing — disclosure to the Business

The service uses third-party AI models to read customer messages, extract details and draft or send replies. Before text reaches a language model, contact details and identity numbers are replaced with placeholders and credentials removed; images, speech audio and text for speech synthesis are not masked. The Business decides, as its sole choice and responsibility, whether and how to inform its customers that AI is used. The Provider does not disclose AI use to the Business's customers unless the Business enables it; when it does, the service sends the Business's own notice once as the first part of the first reply in each conversation. A customer who says they are leaving or asks not to be contacted receives no further automatic message in that conversation; messages a person at the Business decides to send still go.

4. Subprocessors

The Business authorizes the subprocessors listed in Schedule A. The Provider notifies the Business before adding or replacing a subprocessor that receives Customer Data, giving the Business a chance to object, and imposes data protection obligations on each subprocessor no weaker than these terms. Some subprocessors are outside Canada (mainly the United States).

5. Security

The Provider maintains the safeguards summarized in Schedule B.

6. Breach notice

The Provider notifies the Business of any breach of security safeguards involving Customer Data without unreasonable delay, with a target of 72 hours after becoming aware of it, with the facts known at that time, and keeps the Business updated. The Provider records every such breach. Reporting to regulators and notifying affected individuals is coordinated with the Business as controller.

7. Assistance

The Provider helps the Business answer access, correction and deletion requests and complaints from its customers within the legal time limits, and with privacy impact assessments the Business performs.

8. Confidentiality

Everyone at the Provider with access to Customer Data is bound by confidentiality.

9. Return and deletion on termination

On termination, the Provider returns Customer Data in a usable format if the Business asks within 30 days, then deletes it from live systems. Encrypted backups expire under the backup retention schedule (up to 365 days, monthly copies included). Personal information past its retention period is erased automatically.

10. Audit

On reasonable notice, the Provider gives the Business the information needed to show compliance with these terms (its privacy program documents and records).

Schedule C — Sealed Mode (for a Business whose panel runs in Sealed Mode)

Applies when one or more of the Business's panels runs in Sealed Mode.

1. Where the work happens. For a Sealed Panel, all reading of the Business's system and all de-identification happen on the Business's own computer, in the NextDoer Connector. The Provider's servers can only request the operations listed below and receive the results of those operations; they have no browsing access to the Business's system, except during a logged, time-boxed window the Business explicitly enables (clause 4).
2. The only operations. The Provider may request only the operations listed for the Business's panel at signing, each with its description. A new operation appears in the Connector's permission panel, flagged as new, before it can be used against the Business's wishes.
3. What crosses. Only each operation's declared fields: de-identified text, document type and date, and — as a documented exception, because the Business's staff must recognise which patient a document concerns — the patient's first name, with the health number and phone shown masked to their last four digits. Every free-text field is checked again on the Provider's server; anything still identifying is rejected, never stored.
4. Remote access window. Remote (debug) access to a Sealed Panel exists only after the Business taps Allow in the Connector app; it closes after four hours or when the Business turns it off. Every action in the window is written to the Business's local activity journal and the Provider's developer-access log.
5. The Business's switch. The Business may disable any operation at any time in the Connector app. The part of the service that needs it then pauses until the Business enables it again; responsibility for that stoppage rests with the Business.
6. Everything is written down. Everything the system does on the Business's computer is in the Connector's Activity journal, in plain language, on that computer only.
7. Residual risk. The Provider cannot see the raw text a Sealed Panel reads, so a local de-identification miss is caught only by the server-side re-check of clause 3 and the Provider's de-identification tests; this is the residual risk recorded in the privacy impact assessment.

Schedule A — Subprocessors

The subprocessors currently in use, and the features each one is used for, are published at nextdoer.com/compliance#providers. The list that applies to the Business is attached at signing.

Schedule B — Security summary

The safeguards are summarized at nextdoer.com/compliance#safeguards. A fuller summary is attached at signing.