1. Controller and processor
Where a practice uses the platform to bill for care, the practice is the controller: it decides why and how personal data is processed. We are the processor, acting only on the controller's documented instructions under Article 28. For our own website visitors and for the administration of our subscriptions, we are the controller.
2. Lawful bases
- Contract (Article 6(1)(b)). Providing the service you subscribed to, and administering your account.
- Legal obligation (Article 6(1)(c)). Retention and reporting duties, including audit records.
- Legitimate interests (Article 6(1)(f)). Securing the platform, preventing fraud and improving the product, balanced against your rights.
- Consent (Article 6(1)(a)). Optional communications, which you can withdraw at any time.
Health data is a special category under Article 9. It is processed under Article 9(2)(h), for the management of health care services, on the controller's instructions and subject to the duty of professional secrecy.
3. Your rights
Under the Regulation you have the following rights. Use the contact details in section 8 to exercise any of them.
| Right | Article | What it means |
|---|---|---|
| Access | Article 15 | Get a copy of your personal data and learn how it is used. |
| Rectification | Article 16 | Have inaccurate data corrected and incomplete data completed. |
| Erasure | Article 17 | Have data deleted where no legal duty requires us to keep it. |
| Restriction | Article 18 | Pause processing while an accuracy or objection dispute is resolved. |
| Portability | Article 20 | Receive your data in a structured, machine-readable format. |
| Objection | Article 21 | Object to processing based on our legitimate interests. |
| Automated decisions | Article 22 | Not be subject to a decision based solely on automated processing. |
We respond within one month, as Article 12 requires. If a request is complex we may extend by two further months and will tell you why within the first month. We do not charge a fee unless a request is manifestly unfounded or excessive.
If your data sits in a practice's records, we will forward your request to that practice without undue delay, because the controller decides the outcome.
4. International transfers
Our infrastructure is hosted in the United States. Where personal data moves from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses together with a transfer impact assessment, and on the UK International Data Transfer Addendum where it applies.
5. Sub-processors
We engage sub-processors for hosting, database services, email delivery and, when a practice enables AI features, Anthropic, which receives only non-identifying codes and column descriptions. Each is bound by a written contract imposing the same obligations we carry. The current list is available on request, and we give controllers advance notice of any addition, with the right to object.
6. Security and breach notification
We apply the technical and organizational measures Article 32 requires: encryption in transit, encryption at rest by our hosting providers, role-based access control, an audit log of key actions, and the database host's backups. If a personal data breach occurs, we notify the controller without undue delay so it can meet the 72-hour deadline in Article 33.
7. Retention and data minimization
We collect only what the service needs and keep it only as long as the controller specifies or the law requires. At the end of a subscription we return or delete personal data on the controller's instruction, retaining only what a legal obligation compels us to keep.
8. Contact and complaints
Reach our data protection contact through the contact page, selecting the privacy topic, or by mail to CollaboratMD, 10377 S Jordan Gateway #110, South Jordan, UT 84095. You also have the right to lodge a complaint with your local supervisory authority, and we would ask that you raise the matter with us first so we have the chance to put it right.