Data Processing Addendum
This Addendum forms part of the agreement between the clinic (“Controller”) and Menaela (“Processor”) and governs the processing of personal data, including patient health data, on the Controller’s behalf.
1. Roles
The clinic is the controller of clinic and patient data. Menaela processes that data only on documented instructions from the clinic, as necessary to provide the platform.
2. Scope of processing
- Subject matter: provision of AI-first practice management.
- Data subjects: clinic staff, patients and leads.
- Data types: contact details, appointments, communications, clinical documentation (special-category health data).
3. Security measures
Per-clinic database isolation, permission-controlled access, encryption in transit, auditability of agent-originated actions, and controls appropriate to health data.
4. Sub-processors
The clinic authorizes the use of vetted sub-processors (hosting, communications channels, speech and language processing) under written terms with equivalent obligations. A current list is maintained and available on request; the clinic is notified of material changes.
5. AI processing
AI features operate through controlled, tenant-bound application operations. The model does not receive unrestricted database access, patient-facing automation uses a narrowed tool catalog, and AI-generated clinical content remains a draft for clinician review.
6. Data subject requests
Menaela assists the clinic in responding to data-subject requests and in meeting its obligations for security, breach notification and impact assessments.
7. International transfers
Where applicable, transfers are covered by appropriate safeguards such as standard contractual clauses.
8. Return and deletion
On termination, Menaela returns or deletes personal data per the clinic’s instructions, subject to legal retention requirements.
9. Contact
Data protection queries: hey@menaela.com.