CareIL
Data Processing Agreement
This DPA forms part of the CareIL Terms when a therapist enters client information into CareIL.
1. Parties and roles
The therapist or clinic is the controller (or equivalent responsible party) for client information. The CareIL operator is the processor/service provider and processes that information only on documented instructions represented by use of the service and these terms.
2. Processing details
Subject matter: hosting and operating clinic-management functions. Duration: the account term plus permitted retention. Data subjects: clients, guardians, family contacts and clinic personnel. Data types may include identity, contact, appointments, communications, files and therapy or health-related records.
3. CareIL obligations
CareIL will process client information only to provide, secure and support the service or as required by law; require confidentiality; apply appropriate technical and organizational safeguards; assist reasonably with rights requests, security incidents and deletion; and notify the controller without undue delay after confirming a reportable breach affecting its data.
4. Therapist obligations
The therapist determines lawful purposes and instructions, provides required privacy information, obtains necessary consent, uses appropriate account security, limits data to what is needed, responds to clients, and ensures professional and statutory retention requirements are met.
5. Subprocessors
The therapist authorizes the subprocessors listed on CareIL's Subprocessors page. CareIL will impose data-protection duties appropriate to their services and will publish material changes. A therapist with a legally grounded objection should contact CareIL before the change takes effect.
6. International transfers
Where information is processed outside its country of origin, the parties will rely on an available legal transfer mechanism and supplementary safeguards where required. The therapist authorizes transfers necessary for the listed hosting, email and optional Google integration services.
7. Security and incidents
Measures include transport encryption, password hashing, tenant separation, access controls, encrypted Google tokens, expiring portal invitations, logging and controlled deletion. Each party will cooperate on incident assessment and legally required notifications according to its role.
8. Return, deletion and audit
During an active account, the therapist may access and export information through available features. On verified deletion, CareIL removes active tenant data after the recovery period, subject to narrowly limited legal or provider retention. CareIL will provide reasonable compliance information; intrusive audits require advance agreement, confidentiality and proportionality.
Operator and contact
CareIL
Privacy: privacy@careil.net
Support: support@careil.net
Accessibility: support@careil.net
These are general product documents and do not replace legal advice tailored to the operator or therapist’s specific activities.