Data Processing Agreement

Template version v0.1

Romanian counsel ✓

1. Purpose

This DPA defines the obligations of NaturClinica (processor) when processing personal data on behalf of you (controller) per GDPR Article 28.

2. Parties

Controller: the practitioner (or practice) using NaturClinica. Processor: MGR Group UAB doing business as NaturClinica.

3. Scope of processing

All processing required to operate the platform's documentation, scheduling, communication, and billing features.

4. Processor obligations

Process only on documented instructions; maintain confidentiality; implement appropriate technical + organisational security; assist with data-subject requests; notify breaches within 72 hours.

5. Sub-processors

Listed in the Privacy Policy. We notify you at least 14 days before changes.

6. Security measures

EU-region hosting, RLS-enforced tenant isolation, encryption at rest + in transit, RBAC for admin tooling, audit-log on every privileged action.

7. Return / deletion

On termination we return or delete personal data within 30 days, except where retention is legally required.