Clinic Logo

Data Processing Agreement

Last updated: 26 October 2026

This Data Processing Agreement ("DPA") is between the clinic that registers on MyClinicBooking (the "Clinic", the controller) and Maja Vella, 29, Triq Alessandru, Birzebbuga BBG 2303, Malta, trading as MyClinicBooking ("we", the processor). It forms part of the Terms of Use and applies when the Clinic accepts it during registration. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR).

1. Subject Matter and Duration

We process personal data on the Clinic’s behalf to provide the appointment booking platform described in the Terms of Use. This DPA applies for as long as the Clinic uses the platform, and afterwards until the data has been deleted as set out in section 10.

2. Roles

  • The Clinic is the controller for the appointment information it receives and manages through the platform, and for the details of patients it enters itself (for example walk-in and phone bookings).
  • We are the processor for that information.
  • We are a separate controller for patient and staff user accounts, payments, no-show fees, subscriptions and billing, and platform security, as described in our Privacy Policy. This DPA does not cover that processing.

3. Nature and Purpose of Processing

  • storing and displaying the Clinic’s bookings, schedules, doctors and rooms;
  • sending booking confirmations, changes, cancellations, delay notices and, if requested, reminders to patients by SMS or email;
  • recording attendance, no-shows and the reasons for changes;
  • producing reports and exports for the Clinic; and
  • hosting, backing up, securing and supporting the platform.

4. Personal Data and Data Subjects

  • Data subjects: the Clinic’s patients, and the Clinic’s doctors and administrators.
  • Personal data: names, email addresses, phone numbers, appointment details (doctor, speciality, room, date, time, status), booking notes, attendance and cancellation records.
  • Special category data: health-related information that bookings or notes may reveal (Article 9 GDPR).

5. The Clinic’s Obligations

  • The Clinic is responsible for having a lawful basis for its processing, including under Article 9(2)(h) GDPR for health-related information, and for informing its patients.
  • The Clinic only enters patient details that are needed for booking, and does not put clinical information (diagnoses, treatments, test results) in booking notes. Medical records are kept outside the platform.
  • The Clinic keeps its administrator credentials confidential and gives platform access only to staff who need it.

6. Our Obligations

  • We process the personal data only on the Clinic’s documented instructions, which are given by this DPA, the Terms of Use and the Clinic’s use of the platform’s features, including for transfers outside the EU. If we are legally required to process it otherwise, we will tell the Clinic first unless the law forbids it.
  • We tell the Clinic if we believe an instruction breaks data protection law.
  • Everyone we authorise to process the data is bound by confidentiality.
  • We do not use the Clinic’s patient data for our own purposes, and we do not sell it.

7. Security

We maintain technical and organisational measures appropriate to the risk, as required by Article 32 GDPR, including:

  • encryption of all connections (HTTPS) and of stored data and backups;
  • hosting in the EU, with daily backups kept for 35 days;
  • separation of each Clinic’s data, and role-based access for Clinic staff;
  • passwords stored only as secure hashes, temporary account lockout after repeated failed sign-ins, and rate limiting of sign-in requests;
  • firewalled servers with automatic security updates and access restricted to authorised administrators; and
  • review and improvement of these measures as the platform and the risks change.

8. Sub-processors

The Clinic gives us general authorisation to use sub-processors. Our current sub-processors are:

  • Microsoft Ireland Operations Ltd. (Azure): hosting, database and backups, in the Netherlands (EU).
  • MessageBird B.V. (Bird), Netherlands: SMS and email delivery, through its EU data centre.
  • Google Ireland Ltd.: maps and address search, and calendar entries for patients who choose to connect Google Calendar.
  • We impose on each sub-processor data protection obligations equivalent to those in this DPA, and we remain responsible to the Clinic for their performance.
  • We will inform the Clinic of any intended addition or replacement of a sub-processor at least 30 days in advance, by email or in the platform. The Clinic may object on reasonable data protection grounds by writing to info@myclinicbooking.com. If we cannot address the objection, the Clinic may close its account.
  • Where a sub-processor transfers data outside the EU, the transfer is protected by an adequacy decision, the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

9. Assistance to the Clinic

  • Data subject requests: patients can download their data and delete their account themselves. If we receive a request about data the Clinic controls, we forward it to the Clinic without undue delay and help the Clinic respond.
  • We provide reasonable help with the Clinic’s obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR), taking into account the information available to us.

10. Personal Data Breaches

We notify the Clinic without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Clinic’s data. The notice describes the nature of the breach, the data and people affected, its likely consequences and the measures taken or proposed. We provide further information as it becomes available.

11. Retention, Return and Deletion

  • During the agreement: booking notes and the reasons recorded for changes and cancellations, including the patient details the Clinic enters for walk-in and phone bookings, are deleted automatically 12 months after the appointment.
  • The Clinic can export its booking reports at any time while its account is active.
  • When the Clinic closes its account, its booking notes are deleted within 30 days, and the remaining booking records are kept only in anonymised form or as part of the patient’s own account. Backups containing the data are overwritten within a further 35 days.
  • We may keep data longer only where EU or Maltese law requires it, for example invoices.

12. Audits and Information

We make available to the Clinic the information needed to demonstrate compliance with Article 28 GDPR, and we allow for and contribute to audits, including inspections, by the Clinic or an auditor it mandates. Audits take place on reasonable notice, during business hours, no more than once a year unless required by a supervisory authority or after a breach, and subject to confidentiality.

13. General

  • If this DPA conflicts with the Terms of Use on data protection, this DPA prevails.
  • This DPA is governed by the laws of Malta, and the courts of Malta have jurisdiction.
  • Contact for this DPA: info@myclinicbooking.com.