Legal information

Data Processing Agreement (DPA)

Between:

You, a practitioner holding a Patiflo account, acting as data controller under the GDPR for your patients' data,

and

Patiflo (see legal notice), acting as data processor under the GDPR,

the following is agreed. By ticking the acceptance box upon your first login, you confirm that you have read and accept this agreement on behalf of your practice.

Article 1 — Subject matter

This agreement governs the processing, by Patiflo, of your patients' personal data, in connection with the provision of the Patiflo application (tracking of consultations and billing).

Article 2 — Duration

This agreement applies for the entire duration of use of your Patiflo account, and until the complete deletion of the data in accordance with Article 8 below.

Article 3 — Nature and purpose of the processing

Patiflo processes the data you enter into the application for the sole following purposes: recording and tracking your consultations, calculating billing (co-payment, insurance contribution, supplements), tracking the status of insurance billing, managing your patient record, and related functions (import, export, dashboard). The processing consists of hosting, storing, displaying, and backing up this data; Patiflo does not transmit any data to a third party (insurer, administration) on your behalf.

Article 4 — Type of data and categories of data subjects

Categories of data subjects: your patients.

Types of data processed: first and last name, e-mail, national register number, ID document number, date of birth, phone number, notes, data relating to consultations and their billing. The fact that a person appears in the record constitutes data concerning health under Article 9 of the GDPR.

Article 5 — Obligations of Patiflo (processor)

Patiflo undertakes to:

1. Process the data only on your documented instructions, as they result from the normal use of the application;
2. Guarantee the confidentiality of the data, including internally — only access strictly necessary for technical support is permitted;
3. Implement appropriate security measures: hashed passwords, two-factor authentication, encrypted connection (HTTPS), data isolation between accounts, protection against SQL injection, hosting in Switzerland with a provider subject to contractual security obligations;
4. Not engage any sub-processor other than its hosting provider (Infomaniak, Switzerland) without informing you beforehand;
5. Assist you, to a reasonable extent, in responding to your patients' requests to exercise their rights (access, rectification, erasure, portability);
6. Notify you without undue delay, and at the latest within 72 hours of becoming aware of it, of any personal data breach likely to affect you;
7. Delete or return all data at the end of the contractual relationship, in accordance with Article 8;
8. Provide you with the information reasonably necessary to demonstrate compliance with these obligations.

Article 6 — Your obligations (controller)

As data controller, it is your responsibility to:

• Ensure that the collection of your patients' data rests on an appropriate legal basis (performance of your care mission, legal obligations);
• Inform your patients of the processing of their data in accordance with your own information obligations;
• Respond to your patients' requests to exercise their rights, with Patiflo's technical assistance where necessary;
• Use the application in accordance with its intended purpose and your professional and ethical obligations.

Article 7 — Security and data breaches

Patiflo implements the measures described in Article 5.3. In the event of a data breach likely to result in a risk to the rights and freedoms of your patients, you are responsible, where applicable, for notifying the Data Protection Authority and, if necessary, the data subjects; Patiflo provides you with all the information it holds for this purpose.

Article 8 — Fate of the data at the end of the contract

The closure of your account — whether you end your subscription or payment is not made — opens a period of 6 months during which your data is kept and remains fully exportable from the application. After those 6 months it is permanently deleted, and you are warned by e-mail beforehand. You may request an early export or deletion at any time.

Article 9 — Audit

You may request from Patiflo, in writing to contact@patiflo.be, the information reasonably necessary to verify compliance with this agreement.

---

Last updated: 27 September 2026 — beta version, pending finalisation.