Last updated: March 15, 2026
2.1 The Controller (you, the healthcare provider) determines the purposes and means of processing Patient Data. You are responsible for ensuring a lawful basis for processing, obtaining appropriate patient consent, and complying with all applicable data protection and healthcare regulations.
2.2 The Processor (AI4DOCS.AI LTD) processes Patient Data solely on documented instructions from the Controller and only for the purpose of providing the Service. The Processor does not independently determine how Patient Data is used.
2.3 For Smart EMR users: all patient records are stored on the Controller's own Google Drive. The Processor accesses the Controller's Google Sheet only when explicitly authorised, and only to facilitate CDA integration (reading patient context, writing generated notes).
3.1 Purpose: The Processor processes Patient Data solely to provide the clinical documentation service, specifically:
3.2 Categories of Data Subjects:
3.3 Types of Personal Data Processed:
| Data Category | Processing Method | Retention |
|---|---|---|
| Patient audio recordings | Transient processing (in-memory or temporary GCS storage) | Maximum 24 hours (auto-deleted) |
| Patient clinical text (symptoms, history, findings) | Transient processing (in-memory only) | Not retained |
| Uploaded medical documents | Transient processing (in-memory only) | Not retained |
| Generated clinical notes | Returned to Controller's browser or Google Sheet | Not retained by Processor |
| Controller's professional profile | Stored in Supabase database | Duration of account + 30 days |
| Controller's email and authentication | Stored in Supabase Auth | Duration of account + 30 days |
4.1 This DPA shall remain in effect for the duration of the Controller's use of the Service.
4.2 Upon termination of the Service agreement, the Processor shall delete all Controller account data within 30 days, unless retention is required by law. Patient Data is not retained beyond the brief processing window and requires no deletion action.
The Processor implements the following measures to protect Personal Data:
6.1 The Controller authorises the Processor to engage the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Backend hosting, AI processing (Vertex AI), temporary storage | United States (us-central1) |
| Firebase Hosting (Google) | CDA application frontend | Global CDN (Google Cloud) |
| Supabase | Authentication, doctor profiles, usage tracking | Frankfurt, Germany (EU) |
| Stripe | Payment processing | United Kingdom |
| Resend | Transactional email delivery | United States |
6.2 The Processor shall notify the Controller at least 30 days before engaging a new sub-processor. The Controller may object to the appointment of a new sub-processor by notifying the Processor in writing within 14 days.
6.3 The Processor ensures that all sub-processors are bound by data protection obligations no less protective than those in this DPA.
7.1 The Processor shall assist the Controller in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, objection) in relation to Personal Data processed through the Service.
7.2 If the Processor receives a request directly from a data subject, the Processor shall promptly forward the request to the Controller and shall not respond directly unless instructed to do so.
7.3 Due to the zero-storage architecture, Patient Data is not retained by the Processor. Requests for erasure of Patient Data require no action by the Processor, as no Patient Data is stored. The Processor will confirm this in writing upon request.
8.1 The Processor shall notify the Controller without undue delay, and in any event within 48 hours of becoming aware of a Personal Data breach affecting the Controller's data.
8.2 The notification shall include:
8.3 The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.
8.4 Due to the zero-storage architecture, the risk of a Patient Data breach is inherently limited to data in transit during the brief processing window. There is no stored Patient Data that could be compromised.
9.1 Patient Data is not stored by the Processor and therefore does not require return or deletion. Generated clinical notes are delivered to the Controller's browser or Google Sheet in real-time.
9.2 Upon termination of the Service agreement, the Processor shall:
9.3 Data retained for legal or regulatory purposes (billing records, audit logs) shall be handled in accordance with applicable law and deleted when no longer required.
10.1 The Controller has the right to audit the Processor's compliance with this DPA, subject to reasonable advance notice (at least 30 days) and during normal business hours.
10.2 The Processor shall make available all information necessary to demonstrate compliance, including documentation of technical and organisational measures, sub-processor agreements, and incident response procedures.
10.3 The Processor may satisfy audit requests by providing existing compliance documentation, certifications, or audit reports from sub-processors (such as Google Cloud SOC 2 reports or Stripe PCI DSS attestations).
11.1 Personal Data may be transferred to and processed in the United States (Google Cloud backend, us-central1) and the European Union (Supabase, Frankfurt). Payment data is processed in the United Kingdom (Stripe).
11.2 For transfers from the EEA/UK to the US, the Processor relies on:
11.3 Account data (profiles, authentication) is stored in the EU (Supabase, Frankfurt) and does not require international transfer mechanisms for EEA data subjects.
11.4 The Processor shall ensure that any international transfer of Personal Data complies with applicable data protection law.
12.1 The Processor shall ensure that all personnel authorised to process Personal Data are bound by obligations of confidentiality.
12.2 The Processor shall not disclose Personal Data to any third party except as required to provide the Service (via authorised sub-processors) or as required by law.
13.1 Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms & Conditions.
13.2 Nothing in this DPA limits either party's liability for breaches of applicable data protection law to the extent such limitation is prohibited by law.
14.1 This DPA is governed by the laws of England and Wales.
14.2 For Controllers located in the European Economic Area, this DPA shall be interpreted in accordance with GDPR (EU) 2016/679. For Controllers located in the United Kingdom, it shall be interpreted in accordance with the UK GDPR.
By creating an account and using the AI4Docs.AI Service, the Controller accepts the terms of this Data Processing Agreement. If you require a signed copy of this DPA for your records, please contact us at support@ai4docs.ai.
For questions about this Data Processing Agreement:
Email: support@ai4docs.ai
Data Protection Officer: Prof. Dr. Alaa Meshref
Company: AI4DOCS.AI LTD
Address: 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
Company No. 16893518
ICO Registration: C1891752