Legal Hub

This Data Processing Agreement ("DPA") is between you (the "Provider") and Homeopathic Healing Inc., operating as Materia+ ("Materia+"). It forms part of the Provider Terms and applies automatically to Providers who register from the United Kingdom, Ireland or elsewhere in the European Union.

It includes the contract terms required by Article 28 of the EU General Data Protection Regulation (EU GDPR) and of the UK General Data Protection Regulation with the Data Protection Act 2018 (UK GDPR). "GDPR" in this DPA means whichever of them applies to the Provider. The Provider is the controller and Materia+ is the processor.

• Subject matter and purpose: hosting and providing the Materia+ practice software and directory.
• Duration: while the Provider's plan is active, plus the export period in section 9.
• Data subjects: the Provider's patients, their caregivers and contacts, and the Provider's own staff.
• Personal data: contact details, year of birth, appointment details, payment records, treatment notes, care plans, check-ins, messages and documents, including health data (special category data under Article 9).

Materia+:

• processes personal data only on the Provider's documented instructions, as set out in the Provider Terms and given through the Platform, unless UK, EU or member state law requires otherwise (in which case we tell the Provider first, unless the law forbids it)
• makes sure everyone authorized to process the personal data is bound by confidentiality
• takes the security measures in section 5
• uses sub-processors only as section 6 allows
• helps the Provider respond to data subjects exercising their rights
• helps the Provider meet their obligations on security, breach notification, data protection impact assessments and prior consultation
• deletes or returns the personal data when the service ends, as section 9 sets out
• gives the Provider the information needed to show compliance with Article 28, and allows and contributes to reasonable audits, including inspections, by the Provider or an auditor they appoint

Materia+ never uses the data for its own purposes, including analytics, marketing, profiling or artificial intelligence training, and never sells it.

Personal data is stored and processed on Amazon Web Services infrastructure in its Canada (Central) region in Montreal, Quebec (ca-central-1). Transfers to Canada rely on the European Commission's adequacy decision for Canada (EU GDPR Article 45) and, for the UK, on the UK's adequacy regulations for Canada (UK GDPR Article 45). Both cover organizations subject to PIPEDA.

Back-up transfer mechanism. If an adequacy decision is changed, withdrawn or found not to apply to this processing, the European Commission's Standard Contractual Clauses (Module 2: controller to processor) are incorporated into this DPA and, for UK data, so is the UK International Data Transfer Addendum to those clauses. For their annexes, the parties' details come from the Provider's registration, the description of processing is section 2, and the security measures are section 5.

Materia+ takes appropriate technical and organizational measures under Article 32, including:

• two-step sign-in for all staff access to servers and administrative tools, limited to people who need it and logged
• encryption in transit (TLS) and at rest (AES-256), with an additional layer for the most sensitive fields
• a database that isn't reachable from the internet
• daily encrypted backups, kept for 14 days and tested for restore
• a written incident response plan

The Provider gives general authorization for Materia+ to use the sub-processors listed on "Companies that help us", including Amazon Web Services (hosting and video visits through the Amazon Chime SDK, Montreal). Materia+ tells the Provider by email at least 30 days before adding or replacing a sub-processor, so the Provider can object. If the Provider objects on reasonable data protection grounds and we can't resolve it, the Provider may end their plan and receive a refund of any unused prepaid fees. Each sub-processor is bound by a written contract with the same data protection obligations as this DPA, and Materia+ remains responsible for it.

Materia+ notifies the Provider, at their account email, without undue delay after becoming aware of a personal data breach. The notice includes the information Materia+ has, so the Provider can notify their regulator within 72 hours where required (the Information Commissioner's Office in the UK, the Data Protection Commission in Ireland, or their own supervisory authority elsewhere in the EU), and tell affected individuals.

If a data subject contacts Materia+ directly, Materia+ passes the request to the Provider without responding to it, unless the Provider asks us to.

When the Provider's plan ends, Provider Terms section 15 applies: personal data stays available read-only for 90 days so the Provider can export it (or longer on the archive plan). After that, Materia+ deletes it, and copies in backups are replaced within 14 days, unless UK, EU or member state law requires us to keep it.

Providers in the UK, Ireland and the EU sign this DPA in setup step 4 (Agreements) by ticking this box and typing their full legal name:

"By checking this box, I execute the Materia+ Data Processing Agreement. Materia+ agrees to process all personal data only on my behalf and in line with the UK GDPR and the EU GDPR. Hosting in AWS's Montreal region (ca-central-1) relies on the UK's and the EU's adequacy decisions for Canada (GDPR Article 45)."

We record your name, the practice you're signing for, the version of this DPA, the date and time (UTC), and your browser and IP address.