Data Processing Agreement

At a glance

Version: 2.0.0
Effective: 1 February 2026
Languages: EN · FR · DE · NL
Legal basis: GDPR Article 28

This page summarises the Doctena Data Processing Agreement template (DPA). The summary is provided for convenience only. The signed PDF is the legally binding instrument — see the Languages and downloads section.

Parties and counterpart entities

The DPA is signed between the practitioner or corporate customer (the controller) and the Doctena legal entity that operates the service in the country where the controller is established (the processor).

Country	Counterpart Doctena entity	Registered office
Luxembourg	Doctena S.A.	42 Rue de la Vallée, L-2661 Luxembourg
Belgium	Doctena Belgium Sprl	Square de Meeûs 37, B-1000 Brussels, Belgium
Netherlands	Doctena Afspraken BV	Square de Meeûs 37, B-1000 Brussels, Belgium
Germany	Doctena Germany GmbH	Kurfürstendamm 14, 10719 Berlin, Germany
Austria	Doctena Austria GmbH	Simmeringer Hauptstraße 24, 1110 Wien, Austria
Switzerland	Doctena Switzerland GmbH	Hagenholzstrasse 81a, 8050 Zürich, Switzerland

Customers established in countries outside this list are routed to Doctena S.A. (Luxembourg) by default. Where multiple Doctena entities are involved in the service (for example, Belgian practitioners using a video infrastructure hosted by the Swiss entity), the DPA names the relevant entities as co-processors.

Subject matter and duration

Subject matter: the processing of personal data carried out by Doctena on behalf of the controller for the purpose of operating the appointment-booking platform, calendar synchronisation, teleconsultation, patient messaging and the related ancillary services.

Duration: the DPA enters into force on the effective date of the master service agreement between the parties and remains in force for as long as Doctena processes any personal data of the controller. End-of-contract handling is covered in End of processing.

Data and data subjects

Category of data subject	Categories of personal data
Patients of the controller	Identification data (name, contact details, date of birth where applicable); appointment data (date, reason, free-text notes, attachments); special category data concerning health where the controller chooses to record it (Article 9 GDPR).
Employees of the controller	Identification data; professional contact details; authentication and audit data; calendar-integration credentials when integrations are enabled by the user.
Other persons designated by the controller	Identification data and any data the controller chooses to record in the free-text fields.

Documented instructions

Doctena processes personal data only on the controller's documented instructions. The controller's instructions are set out in the master service agreement, in this DPA, in the product configuration (retention period, integrations enabled, sub-processor opt-outs), and in any written instruction the controller subsequently provides to privacy@doctena.com.

Doctena will immediately inform the controller if, in its opinion, an instruction infringes the GDPR or other applicable EU or member state data protection provisions.

Sub-processing and notice

The controller grants Doctena a general written authorisation to engage sub-processors, subject to Article 28(2) GDPR. The current sub-processor register is published at /sub-processors.

Doctena commits to 14 days' prior written notice of any addition or change of a sub-processor that touches personal data. During the notice window the controller may object on reasonable grounds related to the protection of personal data; in that case Doctena either resolves the controller's concerns or terminates the affected portion of the service at no penalty.

Security commitments

Doctena maintains the technical and organisational measures documented at /security. The measures include — without limitation — pseudonymisation, encryption at rest with AES-256 and in transit with TLS 1.3, segregation of environments, ISO 27001:2022 certified ISMS, annual third-party penetration testing, mandatory MFA on every Doctena account with production access, formal incident management, supplier security review and continual improvement.

Personal data breach

Doctena notifies the controller of any personal data breach affecting the controller's data within 48 hours of becoming aware of it. The notification includes:

The nature of the breach and the categories and approximate number of data subjects and records concerned.
The likely consequences.
The measures taken or proposed to address the breach and mitigate its possible adverse effects.
The contact point for further information.

Doctena cooperates with the controller as needed to allow the controller to comply with its own obligations under Articles 33 and 34 GDPR.

International transfers

Personal data is stored and primarily processed inside the European Union (AWS Frankfurt). Where a sub-processor's service requires transfers to a third country, the transfer is covered by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module 3 (processor-to-processor), together with a documented Transfer Impact Assessment. The list of current third-country sub-processors is published at /sub-processors.

For Swiss customers, transfers outside Switzerland and outside the EU/EEA are additionally covered by the SCCs as adapted to the Swiss Federal Act on Data Protection.

Audit and inspection

Doctena demonstrates compliance with this DPA by:

Making available the up-to-date Statement of Applicability and ISO/IEC 27001:2022 certificate.
Allowing the controller, on reasonable notice and at the controller's cost, to perform an annual audit limited to information necessary to verify compliance.
Accepting a third-party auditor mandated by the controller, subject to confidentiality undertakings and minimal disruption to production.
Sharing a redacted summary of our annual penetration test under NDA.

Where the same audit would impose disproportionate effort if repeated for every controller, Doctena may provide pooled audit reports satisfying the same purpose.

Cooperation on data-subject rights

Doctena assists the controller, by appropriate technical and organisational measures, in the fulfilment of the controller's obligation to respond to data-subject requests (Articles 12-22 GDPR). The product provides direct self-service for data export (Article 20), correction (Article 16) and deletion (Article 17) on the controller's instruction. Doctena cooperates with the controller within the timeframes required by the GDPR.

End of processing

Upon the end of the master service agreement, and at the controller's documented instruction, Doctena either:

Returns to the controller a structured machine-readable export of all personal data; or
Deletes the personal data from production within 90 days, and from operational backups as they roll off (default rolling 90-day window).

Doctena retains an anonymised aggregate dataset for statistical purposes, and retains audit logs and accounting records to the extent required by EU and member state law.

Languages and downloads

The DPA is signed in the language requested by the controller. English is the canonical version; the other language editions are translations of that canonical version. The full PDF for each language is hosted on cdn.doctena.com and linked below.

Need an earlier version, a redlined comparison against your master DPA, or an amended counterpart-specific text? Email privacy@doctena.com.

How to sign

Confirm the counterpart entity from the table in Parties.
Request the DPA in your preferred language at privacy@doctena.com, mentioning your master service agreement reference.
Doctena sends the DPA via Dropbox Sign for authenticated electronic signature. Both signatures are time-stamped and audit-logged.
The countersigned PDF is returned automatically and stored alongside your service contract.

For enterprise customers requiring an amended DPA (customer-specific liability cap, additional jurisdictions, extra audit terms, etc.), contact privacy@doctena.com and reference the master service agreement.

Version 2.0.0 · Effective 1 February 2026 · Replaces the 2024-02-09 template.