← mydosha.org

MyDosha — Data Processing Agreement

This Data Processing Agreement (the "DPA") governs the processing of personal data that MyDosha carries out on behalf of a practitioner or clinic that holds an account. It gives effect to Article 28(3) of Regulation (EU) 2016/679 ("GDPR"). It supplements, and forms part of, the Terms of Service and the Privacy Policy.

1. The parties and their roles

This DPA is entered into between:

• The Controller — the qualified Ayurvedic practitioner, clinic, practice or school that holds the account and uses the Service in a professional capacity ("you"). You determine the purposes and means of processing the Patient Data you enter into the Service.
• The Processor — Aardstroom B.V. (i.o.), the operator of the MyDosha platform: a private limited company currently in formation (in oprichting) and, during the incorporation period, represented by Thomas Thijs at Frazione Ammazzavecchia 12, 58010 Sorano (GR), Italy, P. IVA IT01671290530 (the "Operator" or "we"). Full operator identity is set out in our legal notice.

For Patient Data — personal data, including special-category health data under Article 9 GDPR, relating to your patients and processed through the Service — you are the controller and the Operator acts as your processor. For your own Account Data (your identity, login and billing information), the Operator is the controller and processes it as described in the Privacy Policy rather than under this DPA.

Where the Operator engages another organisation to process Patient Data on its behalf (see Annex III), that organisation acts as a sub-processor and the Operator remains fully liable to you for its performance.

2. Subject matter, duration, nature and purpose

• Subject matter. The processing of Patient Data necessary to provide the Service: AI-assisted patient intake, the AI clinical dossier (a reorganisation of the patient's self-report), the practitioner portal (records, examination notes, care plan, photos), the curated reference library, the herb and formula inventory, invoicing, appointments and messaging.
• Duration. For as long as you hold an account or an active subscription, and for the export and deletion window described in Section 9.
• Nature and purpose. Collection, structuring, storage, retrieval, transmission to the sub-processors listed in Annex III, and erasure, all solely to provide and support the Service on your documented instructions.
• Categories of data subject. Your patients, and any individuals whose data you enter into a patient record.
• Types of personal data. Set out in Annex I.

3. Processing on documented instructions

The Operator processes Patient Data only on your documented instructions — which include these documents (the Terms, this DPA and your configuration and use of the Service) — including as regards transfers to a third country, unless required to do otherwise by EU or Member State law, in which case the Operator will inform you of that legal requirement before processing, unless the law prohibits it on important grounds of public interest. If the Operator believes an instruction infringes the GDPR or other data-protection law, it will inform you without undue delay.

4. Special-category (health) data and lawful basis

Patient health data is special-category data under Article 9 GDPR. It is processed on the basis of the patient's explicit consent, captured at the start of the intake. As controller, you are responsible for ensuring a valid lawful basis under Articles 6 and 9, for obtaining and recording that consent, for providing your patients the Article 13 to 14 information (including the AI reorganisation of their self-report and the sub-processors involved), and for honouring your patients' data-subject rights. You must not process the data of any patient under 16 through the Service without appropriate consent from a holder of parental responsibility, and you must document that consent.

5. Confidentiality

The Operator ensures that any person authorised to process Patient Data (whether personnel or a contractor) is bound by an appropriate obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement.

6. Security of processing

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to data subjects, the Operator implements appropriate technical and organisational measures under Article 32 GDPR. The current measures are described on our Security & Trust page and summarised in Annex II, and include encryption in transit and at rest, tenant isolation enforced at the database layer beneath the AI, role-based access, audit logging, and daily off-platform backups.

7. Sub-processors

You give the Operator a general authorisation to engage the sub-processors listed in Annex III. The Operator imposes on each sub-processor, by contract, data-protection obligations equivalent to those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures, and remains fully liable to you for each sub-processor's performance.

Where the Operator intends to add or replace a sub-processor, it will give you prior notice — by updating the list maintained here and in the Privacy Policy and, where practicable, by email — giving you a reasonable opportunity to object on reasonable data-protection grounds before the change takes effect. If you object and the matter cannot be resolved, your remedy is to terminate and export your data under Section 9.

8. International transfers

Some sub-processors are established outside the EEA or may provide support access from outside it. Where Patient Data is transferred to a third country that is not the subject of an adequacy decision, the transfer is covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) incorporated into the Operator's agreement with the relevant sub-processor, together with supplementary measures where appropriate. The applicable mechanism per sub-processor is noted in Annex III.

9. Assistance, breach notification, deletion and audit

• Data-subject requests. Taking into account the nature of the processing, the Operator assists you by appropriate technical and organisational measures, insofar as possible, to fulfil your obligation to respond to patient requests to exercise their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability and objection). Self-serve tools in the portal cover the common cases.
• Compliance assistance. The Operator assists you in ensuring compliance with your obligations under Articles 32 to 36 GDPR (security, breach notification, data-protection impact assessments and prior consultation), taking into account the nature of processing and the information available to it.
• Personal-data breach. The Operator notifies you without undue delay after becoming aware of a personal-data breach affecting Patient Data, with the information you need to meet your own notification duties.
• Return or deletion. At the end of the provision of the Service, at your choice, the Operator deletes or returns all Patient Data to you and deletes existing copies, unless EU or Member State law requires storage. You may export your data for 30 days after termination; after that window it is deleted in line with the retention policy in the Privacy Policy. As controller you remain responsible for exporting and keeping any records you must retain under your own professional or legal duties.
• Audit. The Operator makes available to you the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice, no more than once a year unless a supervisory authority or a breach requires otherwise, and subject to appropriate confidentiality.

10. Liability, governing law and order of precedence

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. This DPA, and any dispute arising out of or in connection with it, are governed by the laws of Italy, with the exclusive jurisdiction stated in the Terms, subject to any mandatory rule of law that requires otherwise. In the event of a conflict between this DPA and the Terms or Privacy Policy on the subject of data processing, this DPA prevails. Where a separate data-processing agreement is executed on an institution's own template, that document governs to the extent of any conflict with this DPA.

Annex I — Categories of data subject and types of personal data

Categories of data subject: the Controller's patients and any individual whose data the Controller enters into a patient record.

Types of personal data:

• Identity and contact data — name, email address, and any contact details the patient provides.
• Special-category health data (Article 9 GDPR) — intake responses about constitution (prakriti), imbalance (vikriti), digestion, sleep, energy, mood, menstrual information where relevant, chief complaint and self-reported symptoms; the AI-generated dossier that reorganises those responses; practitioner examination notes, care-plan entries, clinical photographs and daily journal entries.
• Usage and record metadata — record identifiers, timestamps, status and language, and audit-log entries.

The Operator does not ask for, and you should not enter, patient payment-card numbers, government identifiers or bank details into patient records; billing of your own subscription is handled separately through Stripe.

Annex II — Technical and organisational security measures (summary)

• Encryption in transit (TLS) and at rest.
• Tenant isolation — the intake, dossier and practitioner assistants are given only the records belonging to the signed-in clinic; the boundary is enforced in the database layer beneath the AI, not by the AI's own instructions.
• Access control — practitioner sign-in with a second factor (email one-time code); service credentials held only in server-side environment variables.
• AI containment — the assistant cannot fetch data on its own; it has no database access and no ability to call other systems.
• Audit logging — an append-only event log records access and changes.
• Backups and recovery — daily logical backups kept off-platform, with a periodic restore drill.

The current, fuller description is maintained on our Security & Trust page.

Annex III — Authorised sub-processors

Each sub-processor below processes Patient Data only to provide the function stated, under contractual data-protection terms equivalent to this DPA. Where data leaves the EEA, the EU Standard Contractual Clauses are the transfer mechanism.

Google Ads / Google Tag is used on our public marketing pages for measurement only and does not process Patient Data. The authoritative, current sub-processor list is maintained in the Privacy Policy.

Effective date: 25 August 2026 · Last updated: 2026-09-01 (Annex III: GitHub, Inc. added for encrypted backup storage).