Data processing agreement

This contract forms part of the Terms for professionals and is accepted electronically when signing up to Vínculo. It is recorded in writing in electronic form, as allowed by article 28.9 of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR). Vínculo keeps a record of the acceptance: date and time, version accepted and identification of the account.

Its content follows article 28.3 GDPR and article 33 of Spanish Organic Law 3/2018 (LOPDGDD), and takes as a reference the European Commission’s standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915).

1. Parties

• The Professional: the health psychologist identified in their Vínculo account (name, tax ID, professional address, professional association and membership number). They act as controller.
• Vínculo: Vínculo Salud Digital, S.L. (being incorporated), tax ID (NIF) [pending: NIF], with registered office at [pending: registered office], Madrid. It acts as processor.

2. Purpose

Vínculo will process, on behalf of the Professional, the data of their patients needed to provide them with the practice management tools: clinical record, consent forms, questionnaires, tasks, session summaries, video sessions, messaging after booking, diary and invoicing in their name (Annex I). It applies both to patients from the marketplace and to those the Professional brings from their own practice.

It does not cover the data Vínculo handles as controller: accounts, searches, bookings, payments, messages before the first paid session, reviews, verification of professionals and DAC7. That data is governed by the Privacy policy. When Vínculo passes the pre-booking questionnaire to the Professional, the copy added to the clinical record comes under the Professional’s responsibility and under this contract.

3. Term

The contract applies from its acceptance and for as long as the relationship between the parties lasts. Confidentiality, return, blocking and, where applicable, safekeeping of the clinical record (section 8) survive termination.

4. Nature and purpose of processing

Vínculo will carry out the processing operations needed to provide the service: hosting, recording, structured organisation and storage, encryption, consultation, real-time transmission (video and messaging), document generation, sending notices, export, blocking and erasure.

The sole purpose is to provide the Professional with the service contracted to care for their patients and run their practice. Vínculo will not use the data for its own purposes: no analysis, profiling, advertising or training of artificial intelligence models. If it did, it would be considered the controller of that processing (article 28.10 GDPR).

5. Data and data subjects

Identification, contact, invoicing and health data are processed, the latter being a special category (article 9 GDPR). The data subjects are patients, people taking part with them in couples therapy, their emergency contacts and third parties the Professional mentions in the clinical record. Details are in Annex I.

6. Vínculo’s obligations

6.1 Documented instructions

Vínculo will process data only on the Professional’s documented instructions (article 28.3.a GDPR). The instructions are:

• this contract and the Terms for professionals;
• the settings the Professional chooses on the platform, such as their region and retention period, sharing summaries with the patient or syncing their calendar;
• additional written instructions sent to privacidad@vinculo.app that Vínculo accepts as technically feasible.

If in Vínculo’s opinion an instruction infringes the GDPR or other rules, it will say so immediately. If a rule requires it to process the data differently, such as a court order, it will inform the Professional first, unless the law prohibits it.

6.2 Confidentiality

Vínculo guarantees that the people authorised to process the data have committed to confidentiality or are under a statutory obligation of confidentiality (article 28.3.b GDPR and article 5 LOPDGDD). That duty continues after their relationship with Vínculo ends.

Vínculo staff do not access clinical content in ordinary operation. Exceptional technical access is only possible at the Professional’s request, where required by law or in a security incident, and is limited to what is essential, documented and logged.

6.3 Security

Vínculo applies the technical and organisational measures of article 32 GDPR described in Annex II. It may update them in line with the state of the art, provided it does not reduce the overall level of security, and will report relevant changes.

6.4 Sub-processors

The Professional grants a general written authorisation to use the sub-processors in Annex III (article 28.2 GDPR). To add or replace sub-processors:

1. Vínculo will give at least 15 days’ notice, by email and in the professional dashboard, stating the provider, the service and where the data is located.
2. Within that period, the Professional may object on reasonable grounds relating to data protection.
3. The parties will seek a solution in good faith. If there is none, the Professional may terminate the contract without penalty after exporting their data.

If the replacement is urgent for security or service continuity, the notice period may be shorter, with the reasons explained. Vínculo will impose the same obligations on each sub-processor and remain fully liable for their compliance (article 28.4 GDPR).

6.5 Data subjects’ rights

Vínculo will help the Professional respond to patients’ rights (article 28.3.e GDPR) with tools to view, correct, export and block the clinical record. Exports for the patient exclude subjective annotations by default (article 18.3 of Spanish Law 41/2002).

If a patient contacts Vínculo about their clinical data, Vínculo will pass the request on to the Professional without delay and within 5 working days at most [pending: confirm period], and let the patient know. It will not resolve it itself unless instructed.

6.6 Help with security and impact assessments

Vínculo will help the Professional comply with articles 32 to 36 GDPR. It will provide the information needed for their risk analysis, a summary of the platform’s impact assessment and its cooperation if they need to consult the Spanish Data Protection Agency (AEPD).

6.7 Security breaches

Vínculo will notify the Professional of any security breach affecting their data without undue delay and, in any case, within 36 hours at most of becoming aware of it. This lets the Professional meet the 72-hour deadline with the AEPD (article 33 GDPR). The notice will be sent to the account email and the professional dashboard and will include, at least:

1. the nature of the breach and, where possible, the categories and approximate number of data subjects and records affected;
2. the contact details of Vínculo’s Data Protection Officer;
3. the likely consequences;
4. the measures taken or proposed to remedy it and mitigate its effects.

The information may be provided in stages. Vínculo will not notify the AEPD or patients on the Professional’s behalf unless instructed in writing. [pending: confirm with a lawyer — offering that Vínculo coordinates notifications when the same breach affects many professionals.]

6.8 Record of processing activities

Vínculo keeps a record of the categories of processing activities it carries out as processor (article 30.2 GDPR) and will make it available to the AEPD on request.

6.9 Information and audits

Vínculo will provide the information needed to demonstrate compliance with this contract and allow audits, including inspections, by the Professional or an auditor they appoint (article 28.3.h GDPR), on these conditions:

• Vínculo may first offer answers to questionnaires, audit reports or certifications of its own or of its sub-processors.
• Audits will be announced 30 days in advance and carried out at most once a year, except after a security breach or at the AEPD’s request.
• The auditor will be bound by confidentiality and will not have access to other professionals’ data.
• The cost will be borne by the Professional, unless the audit reveals a material breach by Vínculo.

6.10 Data Protection Officer

Vínculo will appoint a Data Protection Officer (article 37.1.c GDPR), who can be reached at dpo@vinculo.app. [pending: appointment.]

6.11 Disclosures of data

Vínculo will not disclose the data to third parties except in these cases:

• to authorised sub-processors;
• to the patient themselves, through features the Professional turns on (for example, shared summaries or consent forms to sign);
• to the Spanish Tax Agency, when sending invoicing records under the Invoicing mandate;
• to authorities, when the law requires it. In that case it will let the Professional know, unless the law prohibits it.

7. The Professional’s obligations

The Professional, as controller, undertakes to:

1. Have a valid legal basis for the processing. For healthcare this is article 9.2.h GDPR, together with the 17th additional provision of the LOPDGDD and Law 41/2002, and always under professional secrecy.
2. Inform their patients in accordance with articles 13 and 14 GDPR, stating that Vínculo acts as processor. Vínculo offers an editable template that the Professional must review and adapt.
3. Obtain informed consent to the treatment (article 8 of Law 41/2002) and to the online format. Vínculo’s templates are editable and their content is the Professional’s responsibility.
4. Decide the retention period: set their region, review the periods that will apply and give erasure instructions when appropriate.
5. Enter only the data needed and not include clinical data in fields not intended for it: appointment titles, invoice descriptions, public profile or pre-booking messages.
6. Protect their access: use a strong password, turn on two-step authentication when available, not share credentials, protect their devices and tell Vínculo immediately if they suspect unauthorised access.
7. Respond to their patients’ rights with Vínculo’s help.
8. Notify security breaches to the AEPD and to patients where appropriate (articles 33 and 34 GDPR).
9. Keep their own record of processing activities (article 30.1 GDPR).
10. Only see people aged 18 and over through Vínculo.
11. Not give Vínculo instructions that are contrary to the rules.

8. End of the processing

8.1 Export

The Professional can export all clinical records in a structured format at any time, and especially when the contract ends:

• PDF, one readable document per patient;
• JSON and CSV, to move them to another system.

The export includes notes, subjective annotations (identified separately), consent forms with their signature record, questionnaire results, tasks, summaries and invoices.

8.2 Return and erasure

After termination, Vínculo will keep the data available for export for [pending: proposed 90 days]. It will then erase it, including copies, except as provided in sections 8.3 and 8.4 (article 28.3.g GDPR). Backups will be deleted in their ordinary rotation cycle [pending: proposed 35 days]. Vínculo will issue a certificate of erasure on request.

8.3 Legal retention of the clinical record

A self-employed Professional is responsible for safeguarding the clinical record for the legal period. That period is at least 5 years from the discharge of each episode of care (article 17 of Law 41/2002), or longer where regional rules require it. Where that obligation exists, the data is returned to the controller, who guarantees its retention (article 33.3 LOPDGDD). That is why export is the default option.

Alternatively, if the Professional so indicates, or if they cannot take over safekeeping because they stop practising, become incapacitated or die, Vínculo may keep the records blocked for the remaining period. Only the Professional or whoever legally replaces them, the competent judges and authorities and, to exercise their rights, the patients themselves will be able to access them. When the period ends, they will be erased. [pending: confirm with a lawyer — mechanism and basis for safekeeping without an active account, possible cost, and what happens to records in the event of death or incapacity (professional association or successor professional).]

8.4 Blocking for liability purposes

Vínculo may keep, duly blocked, the data needed to demonstrate its compliance, such as access and instruction logs, while liability may arise from its relationship with the Professional (article 33.4 LOPDGDD).

9. International transfers

Clinical data is hosted in the European Union. Vínculo will not transfer it outside the European Economic Area except to the sub-processors in Annex III, and always with the safeguards of chapter V GDPR: an adequacy decision (article 45) or standard contractual clauses with a transfer impact assessment and, where appropriate, additional measures (article 46.2.c). Any new transfer will be communicated as provided in section 6.4.

Cloudflare runs the web application, so it processes in memory the data the application displays, including decrypted clinical content. That processing must therefore be limited to EU data centres. [pending: confirm Cloudflare’s data localisation settings before launch.] Resend and Expo receive no clinical content: only the email address or device identifier needed to send notices without health data.

10. Liability

Each party is liable for the damage it causes under article 82 GDPR. Vínculo, as processor, is only liable where it has not complied with the obligations the GDPR places on processors or has acted outside or contrary to the Professional’s lawful instructions (article 82.2). A party that has compensated a data subject beyond its share may claim back from the other (article 82.5).

The limitations of liability in the Terms for professionals apply to the extent permitted by law. They do not apply in cases of wilful misconduct or gross negligence or to penalties imposed directly on one of the parties. [pending: confirm with a lawyer — cap on liability and Vínculo’s cyber-risk insurance.]

11. Changes and governing law

Vínculo may change this contract with 15 days’ notice, unless the change is imposed by a rule or an authority. If the Professional does not agree, they may terminate the contract before the change applies, after exporting their data.

On data protection matters, this contract prevails over the Terms for professionals. It is governed by Spanish law, and jurisdiction will be as provided in those Terms.

12. Annex I: description of the processing

13. Annex II: security measures

13.1 Encryption

• Communications encrypted with TLS.
• Encryption at rest of the database and files.
• Clinical notes and subjective annotations are additionally encrypted at application level with AES-256-GCM. Each professional has their own data key, protected by a platform master key (envelope encryption) kept separately from the data. [pending: key management service and rotation policy.]

13.2 Access control

• Separate roles (patient, professional and administration) with row-level security in Postgres. Each user only accesses their own data and each professional only their patients’ data.
• Least privilege for staff. No administration role sees clinical content in the interface.
• Two-step authentication for professionals and administrators. [pending: implement before launch.]

13.3 Traceability

• A log of access to and changes in the clinical record, with user, action and date.
• A log of administration actions. [pending: log retention period, proposed 5 years.]

13.4 Retention

• Periods set according to the professional’s region.
• Deletion technically blocked for as long as the legal obligation to keep the data lasts.
• Signed notes that cannot be deleted and consent forms with a record of the version accepted.

13.5 Minimisation

• No health data in notifications, email subject lines, calendar titles, web addresses or technical logs.
• Neutral invoice descriptions.
• Contact details hidden in the chat until the first paid session.

13.6 Video sessions

• Rooms restricted to the participants of each appointment, with temporary credentials.
• Encryption in transit.
• No recording feature. [pending: consider end-to-end encryption.]

13.7 Availability

• Encrypted backups in the EU, with point-in-time restore and regular recovery tests. [pending: frequency and retention.]
• Full export available to the professional.

13.8 Development and operations

• Code review and secure secrets management.
• Separate environments, with no real data in development or testing.
• Dependency updates.
• No advertising pixels or third-party trackers.
• External penetration test before launch and yearly. [pending.]

13.9 Organisation

• Confidentiality commitments and data protection training for staff.
• Incident and security breach management procedure.
• Assessment of providers and article 28 contracts with each sub-processor.

14. Annex III: authorised sub-processors

Stripe Payments Europe, Ltd. is not on this list because payments are data Vínculo handles as controller, and Stripe acts partly as an independent controller.

Google Calendar and Microsoft Outlook are not Vínculo sub-processors either. If the Professional connects them, they contract with them directly. Vínculo only sends them the slots and events the Professional authorises, with titles that contain no health data.