Draft version. A lawyer must review this text before it is used.

Data processing agreement (GDPR Article 28)

This agreement is between the practice that uses PediJurnal (“the practice,” the controller) and Promotion Performance SRL, with its registered office in Târgu Mureș, Romania (“we” or “us,” the processor). It is part of the PediJurnal terms of service and applies from the moment the account is created.

1. Subject matter

We process the personal data the practice enters into PediJurnal only to provide the service to the practice. We don’t use this data for our own purposes.

2. Duration

This agreement applies for as long as the practice’s account exists and until the data is erased under section 13.

3. Nature and purpose of the processing

We store, organize, display, export, archive, and erase data at the practice’s request and through the app’s features. The purpose is to let the practice’s team keep records of patients, visits, appointments, and payments.

4. Categories of data

• patient identity and contact details;
• health data, which is special-category data (GDPR Article 9): medical history, visit findings, and foot photos;
• signed consents: the signature image and the exact text signed;
• appointments, payments per visit, and expenses;
• team members’ accounts;
• the access log: who viewed or exported a patient’s record, and when.

5. Data subjects

• the practice’s patients;
• members of the practice’s team who have a PediJurnal account.

6. The practice’s instructions

We process data only on the practice’s documented instructions. These instructions are the terms of service, this agreement, and the actions the team takes in the app. If we believe an instruction breaks the law, we’ll tell you right away. If EU or Romanian law requires us to process data in some other way, we’ll tell you beforehand, unless that law forbids it.

7. Confidentiality

Everyone on our side who may have access to the data has committed to confidentiality or is bound by a legal duty of confidentiality. They access the data only when needed to run the service or to handle a support request from the practice.

8. Security measures (GDPR Article 32)

• Each team member signs in to the app with their own account.
• An access log records who viewed or exported each patient’s record.
• Patient photos are re-encoded on upload, and location data is removed. Photos are shown only to signed-in members of the practice, and to the patient when the practice shares the visit report with photos in the app.
• Card details never pass through PediJurnal. They go only to Stripe.
• The website and the app use no advertising or analytics trackers. They use only strictly necessary cookies: the session cookie and, if the user asks for it, one that remembers a trusted device for two-step sign-in.
• Deleted items stay in the archive for 30 days so they can be restored. After that, they are erased for good.
• The practice can export a single patient or all its data as a ZIP file at any time.
• After the account is deleted, backups, if any, are overwritten within 30 days at most.

We review these measures regularly and adapt them to the risk, keeping in mind that health data is sensitive data.

9. Sub-processors

The practice authorizes us to use the following sub-processors:

• Stripe: payment of the practice’s subscription;
• hosting provider: Namecheap, Inc. (USA);
• service that sends email to the practice’s accounts: Namecheap, Inc. (USA).

Before we add or replace a sub-processor, we’ll notify you by email at least 30 days in advance. During that time, you can object, giving your reasons. If we can’t find a solution, you can cancel your subscription and delete your account before the change.

We require each sub-processor to meet data protection obligations equivalent to those in this agreement. We remain responsible to the practice for how they meet those obligations.

10. International transfers

We transfer data outside the European Economic Area only with the safeguards set out in Chapter V of the GDPR. Stripe may process data outside the EEA under the standard contractual clauses approved by the European Commission. If we choose a hosting or email provider that processes data outside the EEA, we’ll notify you under section 9.

11. Assistance to the practice

• Patients’ rights: the app lets you view, correct, export, and delete a patient’s data. This is how you can answer requests for access, correction, portability, and erasure. If a patient writes to us directly, we pass the request on to the practice without delay and don’t answer it on the merits ourselves.
• Data protection impact assessments (DPIAs) and prior consultation: we give you the information we have about the processing and the security measures.
• Security and notifications: we help you meet your obligations under GDPR Articles 32–36, as far as the information available to us allows.

12. Personal data breaches

If we become aware of a security breach affecting the practice’s data, we’ll notify you without undue delay and no later than 48 hours after we became aware of it. We’ll tell you what happened, what data and roughly how many people may be affected, the likely consequences, and the measures we have taken or propose. If we don’t have all the information at first, we’ll send it as we learn it.

The practice, as controller, decides whether to notify ANSPDCP and the patients.

13. When the service ends

• The practice can export all its data as a ZIP file at any time.
• After the trial or the subscription ends, the data stays in the account and can be read and exported, but not edited.
• When the practice deletes its account, we first offer an export. Then we erase all data at once. Backups, if any, are overwritten within 30 days at most.
• We keep data after erasure only if EU or Romanian law requires us to.

14. Audits

We make available all the information needed to show that the obligations in GDPR Article 28 are met. We allow audits, including inspections, by the practice or by an auditor it appoints who is bound by confidentiality, with reasonable advance notice. An audit may not give access to other practices’ data.

15. Final provisions

On data protection matters, this agreement takes precedence over the terms of service. It is governed by Romanian law. The supervisory authority is ANSPDCP. If the Romanian, Hungarian, English, and Spanish versions differ, the Romanian version prevails.

Contact: motion@promotioncreative.ro.

Last updated: 2026-10-29