Data Processing Agreement

Our Data Processing Agreement (“DPA”) supplements the Master Services Agreement and the Business Associate Agreement to address EU/UK General Data Protection Regulation (GDPR), the UK Data Protection Act, and applicable US state privacy laws.

Subject matter & duration

WeConsult Rx processes personal data on behalf of the Customer for the duration of the Service term, plus the wind-down period defined in the MSA.

Roles

Customer is the Controller; WeConsult Rx is the Processor. Where WeConsult Rx engages subprocessors, those subprocessors are sub-processors of the Customer.

Categories of data subjects & data

• Customer staff (admins, reviewers).
• Facility staff (administrators, medical directors, providers).
• Residents / patients (PHI) — only as instructed by the Customer.
• End-user identifiers (name, email, phone), authentication metadata, and audit log entries.

Subprocessor list

See /subprocessors for the full list. Customers will be notified at least 30 days before a new subprocessor is engaged for any covered data category.

International transfers

We rely on the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) and the UK International Data Transfer Addendum where required.

Security measures

Technical and organisational measures are described in our Security overview and exhibited in the DPA Annex. We will not materially reduce these measures during the term.

Audit rights

Customer may request, no more than annually, an audit by an independent third party at Customer’s cost, subject to confidentiality and to a reasonable schedule.

Data subject requests

We will assist Customer in fulfilling data subject access, correction, deletion, restriction, and portability requests within applicable statutory deadlines.

Breach notification

We notify Customer of a Personal Data Breach without undue delay, and no later than 72 hours after we become aware where required by Article 33(2) GDPR.

Signing the DPA

Request a countersigned DPA: email [email protected].