Data Processing Agreement

The Controller determines the purpose and means of processing patient data. The Processor handles patient data only on the Controller’s behalf and under its documented instructions. Both parties comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The Controller, as a health service provider, acknowledges that Health Information attracts additional protections under applicable Australian privacy legislation.

The Processor handles patient data solely to:

• Operate patient intake and referral forms on the Controller’s website.
• Store form submissions for retrieval by the Controller through the portal.
• Send administrative email notifications to the practice.
• Provide technical maintenance and security monitoring.

Patient data is not used for marketing, AI training, profiling, or disclosed to third parties without the Controller’s written consent.

All patient data is stored and processed exclusively in Australia on AWS Asia Pacific (Sydney) infrastructure (ap-southeast-2). Data is not transferred outside Australia without the Controller’s prior written consent, consistent with APP 8.

• Database: Supabase on AWS ap-southeast-2 — per-client schema isolation and row-level security (RLS).
• File storage: Amazon S3 ap-southeast-2 — per-client key prefix isolation, private access only.
• Email delivery: Amazon SES ap-southeast-2.

Email is standard and accepted practice for administrative notifications in Australian medical settings, consistent with OAIC guidance and RACGP 5th edition standards. The Processor applies TLS 1.2+ encryption in transit via Amazon SES; SPF, DKIM, and DMARC sender authentication; and Australian mail infrastructure throughout.

Standard notification emails to the practice may include basic patient contact details sufficient to action an enquiry (name, date of birth, phone, reason for contact, medication name for script repeats, referral reason). Uploaded files are never attached to an email, and full clinical records are never reproduced in an email body.

How an uploaded document reaches the practice depends on the delivery mode configured for that practice:

• Portal delivery — the notification contains a link to the authenticated portal. The file is reachable only after sign-in, and every view and download is logged.
• Email delivery — the notification contains a time-limited download link, currently valid for 7 days. Anyone with access to that email can open the link without signing in. We provide this at the Controller’s direction; the Controller is responsible for its practice inbox access controls and accepts the associated risk.

Portal delivery is the more secure option and the one we recommend. A practice may ask us to change its delivery mode at any time.

Patient confirmation emails may include information the patient themselves submitted (their name, form type, summary of request), consistent with standard Australian GP practice. The patient’s act of submitting the form constitutes implied consent to receive a confirmation email at the address provided.

The Processor maintains:

• TLS 1.2+ encryption in transit.
• AES-256 encryption at rest.
• Per-client data isolation with row-level security.
• Authenticated access controls on all patient data endpoints.
• Spam and bot filtering on all form endpoints.
• Automated daily backups retained for 7 days within ap-southeast-2.
• Uptime monitoring.

S3 file objects are stored with private ACL and are never publicly accessible. Under portal delivery, access is via a short-lived presigned URL (30 minutes) generated only on an authenticated portal request. Under email delivery, the presigned link included in the notification is valid for 7 days and does not require sign-in.

We use a short list of Australian-hosted service providers to operate the portal. Each is bound by contract to protect information and process it only on our instructions.

The Processor will give at least 14 days’ written notice of any proposed addition or replacement of subprocessors that handle patient data.

The Processor imposes data-protection obligations on each subprocessor no less protective than those in this DPA, and remains responsible to the Controller for any subprocessor’s handling of patient data as if it were the Processor’s own.

Patient data is retained only as long as necessary to provide the services or as required by law. Uploaded documents are automatically deleted from file storage 90 days after they are received by default.

On termination of the Agreement, the Processor will provide a full data export to the Controller and securely delete all patient data from its systems within 30 days, subject to any applicable legal retention obligations and to all outstanding fees being paid in full.

On the Controller’s written request, the Processor will confirm in writing once secure deletion has been completed.

The Processor will notify the Controller within 72 hours of becoming aware of a suspected or confirmed data breach involving patient data, including a description of the breach, categories of data affected, and steps taken. The Controller, as data controller, is responsible for assessing obligations under the Notifiable Data Breaches (NDB) scheme and making any required notifications to the OAIC and affected individuals.

Where a patient exercises rights under the Privacy Act 1988 (Cth) — including access, correction, or complaint — the Controller is the primary contact. The Processor will assist the Controller in fulfilling such requests within 7 business days of a written request.

The Controller may ask the Processor to demonstrate its compliance with this DPA on reasonable written notice, no more than once in any 12-month period (or more often if reasonably required by a regulator or following a data breach affecting the Controller’s data). The Processor will respond within a reasonable time to reasonable written questions about its security and data-handling practices, and provide the documentation it has available — such as its security overview and current subprocessor list.

Any on-site or independent third-party audit is by mutual agreement and at the Controller’s cost, and must be carried out on reasonable notice, during business hours, and in a way that does not disrupt the Processor’s operations or compromise the confidentiality or security of other clients’ data.