Alveodont

Version 2026-05-15-draft · Art. 28 Regulation (EU) 2016/679 (GDPR)

1. Parties

1.1 Controller (Clinic)

Business name, Company ID (IČO), registered address, authorised representative, and notice email are populated from the Clinic's details at registration and acceptance (the "Controller").

1.2 Processor (Service provider)

Michal Svoboda, Company ID (IČO): 29544441, registered office: Palachova 228/18, 67401 Třebíč, Czech Republic. Sole trader (OSVČ — secondary activity) registered with the Municipal Office of Třebíč on 10/05/2026; not VAT-registered. Notice email: legal@alveodont.com; Data Protection Officer (DPO): dpo@alveodont.com (the "Processor"). The Controller and the Processor together as the "Parties".

2. Subject matter and purpose of processing

2.1 Subject matter

The Processor provides the Controller with a software service named Alveodont (the "Service") — a web application for dental practice management available at www.alveodont.com, comprising patient records management, scheduling, clinical documentation, billing, and related features. In providing the Service, the Processor processes personal data of the Controller's patients, employees, and other data subjects on the Controller's behalf.

2.2 Purpose

The sole purpose of processing is the operation of the Service for the Controller within the scope of the agreed features and in accordance with the Controller's instructions. The Processor does not process the Controller's personal data for its own purposes, except for maintaining the security, integrity, and availability of the Service (intrusion detection, anti-spam, backups), compliance with legal obligations (e.g. retention of accounting records), and aggregated anonymised usage statistics from which no data subject can be identified.

2.3 Duration

For the term of the contractual relationship between the Parties and thereafter for the period strictly necessary to fulfil the Processor's legal obligations (in particular accounting and tax).

2.4 Nature

Automated processing in cloud infrastructure (Art. 4 GDPR). Includes in particular collection, recording, storage, retrieval, use, transmission (to the Controller and, on request, to data subjects), structuring, restriction, erasure, and destruction.

3. Categories of data subjects and personal data

3.1 Data subjects

• Patients of the Controller (incl. minors — processed on the basis of legal representatives);
• Employees and contractors of the Controller (dentists, hygienists, reception, assistants);
• Contact persons of suppliers, payers, insurers, and other partners of the Controller, whose data the Controller enters into the Service.

3.2 Categories of personal data

Regular personal data: identification (first name, last name, date of birth, birth number, gender), contact details (address, phone, email), health insurance data, payment and billing data, audit and operational logs (IP address, login timestamps, device IDs), recordings and transcripts of doctor–patient voice consultations.

Special categories (Art. 9 GDPR — health data): medical history, allergies, chronic conditions, current medications, diagnoses, treatments, procedures, dental chart, X-rays and other imaging modalities, consultation records and clinical notes. Processing of special categories is performed on the legal basis of Art. 9(2)(h) GDPR (provision of health care) ensured by the Controller.

4. Controller's obligations and rights

The Controller: (a) is responsible for the lawfulness of processing and for obtaining a legal basis for each processing operation of its data subjects' personal data; (b) fulfils information obligations toward data subjects (Art. 13–14 GDPR), including the identity of the Processor and categories of sub-processors; (c) provides instructions to the Processor exclusively in writing, via the Service's configuration, contractual provisions, or by email to legal@alveodont.com; (d) is responsible for the accuracy of personal data entered and for the secure handling of access credentials; (e) ensures the exercise of data subjects' rights (Art. 12–22 GDPR) — the Processor provides only technical assistance under Section 8; (f) has the right to audit compliance with this DPA under Section 11.

5. Processor's obligations (Art. 28(3) GDPR)

• Process personal data only on documented instructions of the Controller — including cross-border transfers only under the Section 9 mechanism. If the Processor identifies an instruction inconsistent with GDPR or other applicable law, it shall promptly inform the Controller;
• Maintain confidentiality — ensure that persons authorised to process personal data (employees, contractors) are bound by a contractual or statutory duty of confidentiality;
• Implement appropriate technical and organisational measures under Art. 32 GDPR — see Annex A;
• Engage sub-processors only under the conditions of Section 7;
• Provide assistance to the Controller under Art. 32–36 GDPR (security, breach notification, impact assessment, prior consultation with the supervisory authority);
• Assist the Controller in responding to data subject requests — see Section 8;
• Return or erase personal data upon termination as set out in Section 10;
• Make available all information necessary to demonstrate compliance with Art. 28 GDPR and allow audits (Section 11);
• Maintain a record of processing activities (Art. 30(2) GDPR).

6. Security measures (overview — details in Annex A)

The Processor implements in particular: transport encryption (TLS 1.2+) and at-rest encryption of sensitive fields (Fernet) and file storage / backups (AES-256); multi-factor authentication for administrative access; least-privilege access (RBAC); separated processing of each clinic's data (multi-tenancy at the clinic_id level); regular backups with restore testing; traffic monitoring and anomaly detection; security logging (tamper-evident audit log); regular dependency updates (CVE scanning); penetration testing of key entry points; incident management and breach notification process (Section 12).

7. Sub-processors

7.1 General authorisation

The Controller hereby grants the Processor general (prior) authorisation to engage further processors (sub-processors) under the conditions of this Section. The binding, always-current list is published at www.alveodont.com/legal/sub-processors and forms Annex B to this DPA.

7.2 Current sub-processors

Principal sub-processors include: Hetzner Online GmbH (Germany, EU — application & database hosting), Cloudflare R2 (EU-region database backups), Anthropic, PBC (USA — optional, disableable AI assistant; SCC), Resend, Inc. (USA — transactional email; SCC), Twilio Inc. (optional voice/SMS agent; SCC), Stripe Payments Europe Ltd. (Ireland, EU — subscription billing), and Sentry (optional error reporting; SCC). This list is indicative — the complete and binding list with regions, transfer bases, and DPA status is maintained as Annex B at /legal/sub-processors and in docs/legal/sub-processors.md.

7.3 Changes to sub-processors

The Processor shall notify the Controller of any planned addition or replacement of a sub-processor at least 30 days in advance, by email per Section 1.1 and by updating /legal/sub-processors. The Controller may raise a reasoned objection within 14 days. In the event of a reasoned objection, the Parties shall in good faith seek a resolution; if none can be found, the Controller may terminate the relationship with 30 days' notice.

7.4 Sub-processor contracts

The Processor enters into a written agreement with each sub-processor obligating it to obligations equivalent to those of the Processor under this DPA. The Processor remains responsible for the acts of any sub-processor as if it had performed the processing itself.

8. Data subject rights

The Processor provides reasonable assistance to the Controller in fulfilling its obligations under Art. 12–22 GDPR. The Service enables the Controller to search, correct, export (machine-readable format), and delete a specific data subject's personal data; deletion includes related records in the AI critic corpus ("Bětka v2") and in backups (backup rotation ≤ 35 days). A request addressed directly to the Processor is forwarded to the Controller within 5 business days, or assistance is provided per the Controller's instruction. Response time generally within 7 business days, unless GDPR mandates a different deadline.

9. Cross-border transfers

Transfers of personal data to third countries (outside the EEA) occur only through the sub-processors listed in Section 7 and always on the basis of Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914, or other safeguards under Art. 46 GDPR. The Controller may disable optional features requiring transfers outside the EEA (in particular Anthropic AI assistant, Twilio AI phone).

10. Return and erasure upon termination

1. The Controller has 30 days from termination to export its data via the "Clinic export" feature (JSON / CSV).
2. After this period, the Processor shall permanently erase personal data from all production systems.
3. Encrypted backups shall be rotated and overwritten within the following 35 days.
4. Records in the AI critic corpus ("Bětka v2") are erased together with patient records and additionally re-purged upon termination as a safeguard.
5. Accounting records and logs required by the Processor's legal obligations are retained for the statutory period (generally 10 years).
6. Upon the Controller's request, the Processor shall issue a written confirmation of erasure.

11. Audit and cooperation

The Controller may, at most once per year (except where there is reasonable suspicion of breach), audit the Processor's compliance with this DPA by requesting documentation (TOMs, record of processing, penetration testing results), requesting a completed questionnaire, engaging an independent auditor bound by confidentiality (at the Controller's cost), or accepting third-party audit reports (e.g. SOC 2, ISO 27001), if any. Audits must be announced at least 30 days in advance and conducted during regular business hours so as not to disrupt the Service.

12. Personal data breach

The Processor shall notify the Controller of any personal data breach affecting personal data processed for the Controller without undue delay and no later than 48 hours after becoming aware of it. The notification shall include a description of the nature of the breach (categories and approximate number of data subjects and records affected), the name and contact of the Processor's DPO, a description of the likely consequences, and a description of the measures taken or proposed. The Controller is responsible for its own notification to the supervisory authority (ÚOOÚ) and to data subjects.

13. Liability

The Parties are liable for damage caused by breach of this DPA under the general provisions of the Czech Civil Code and within the limits agreed in the Terms of Service. Nothing in this DPA relieves a Party of liability toward data subjects or the supervisory authority arising from GDPR.

14. Final provisions

1. This DPA forms an integral part of the Terms of Service (ToS) and, in case of conflict, takes precedence in matters of personal data processing.
2. The contractual relationship is governed by the laws of the Czech Republic, in particular GDPR, Act No. 110/2019 Coll., and Act No. 89/2012 Coll. (Civil Code).
3. Disputes shall be settled by the courts of the Czech Republic having jurisdiction over the Processor's registered office (Regional Court in Brno).
4. Amendments require mutual consent. The Clinic expresses consent by accepting the new version upon login; the accepted version is permanently recorded (dpa_accepted_at, dpa_accepted_version).
5. This DPA takes effect upon acceptance by the Controller at clinic registration or at the first login after publication of a new version.

Annex A — Technical and organisational measures (TOMs, Art. 32 GDPR)

Encryption: sensitive database fields encrypted with Fernet (AES-128-CBC + HMAC) at rest; file storage and backups AES-256; all transport TLS 1.2+. Access control: RBAC with least privilege; MFA for administrative accounts; per-clinic data isolation at the clinic_id level (multi-tenancy), including isolation of the AI critic corpus. Resilience: daily/monthly encrypted backups in an EU region with restore testing; backup rotation within 35 days. Monitoring: tamper-evident audit log of key operations, anomaly detection, error reporting with PII filtering. Development process: CVE dependency scanning, penetration testing of key entry points, incident-management and breach-notification process within 48 h. Detailed retention periods: docs/legal/retention-periods.md; processing-activity mapping: docs/legal/ROPA.md (Art. 30 GDPR).

Annex B — Current sub-processor list

The binding, maintained list is published at www.alveodont.com/legal/sub-processors (source of truth: docs/legal/sub-processors.md). The version published at the time of acceptance governs and is permanently evidenced in the Processor's audit log.