Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the agreement between StartCare and a customer (for example, a clinic or organization) that uses StartCare to process personal and health information. It describes how StartCare processes such data on the customer's behalf.
1. Roles
Where the customer determines the purposes and means of processing, the customer is the controller (or covered entity) and StartCare acts as a processor (or business associate) that processes personal data only on documented instructions.
2. Scope & Purpose
StartCare processes personal and health information solely to provide the telemedicine services, to comply with law, and as otherwise instructed in writing by the customer.
3. Confidentiality
StartCare ensures that personnel authorized to process the data are bound by appropriate confidentiality obligations.
4. Security Measures
StartCare maintains administrative, physical, and technical safeguards designed to protect the data, including encryption in transit and at rest, access controls, audit logging, and multi-tenant isolation.
5. Subprocessors
StartCare may engage subprocessors (for example, cloud hosting, communications, e-prescribing, and payment processing) under written terms that impose data-protection obligations consistent with this DPA. A current list is available on request.
6. Data Subject Requests
StartCare will provide reasonable assistance to enable the customer to respond to requests from individuals to access, correct, or delete their data, subject to legal and clinical retention requirements.
7. Breach Notification
StartCare will notify the customer without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of the data.
8. Return or Deletion
Upon termination, StartCare will return or delete the personal data as instructed, except where retention is required by law or professional standards.
9. Audits
StartCare will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality protections.
10. Contact
To request our subprocessor list or a signed DPA, email info@startcare.ai.