Data Processing Agreement
The contract that governs all processing of hospital and patient data.
Current version: 1.1 · Effective 18 October 2026
ClinicalHIS is operated by Claridad Health Solutions. The hospital or clinic using the platform is the data controller (or HIPAA Covered Entity in the US); Claridad is the data processor (Business Associate). This DPA sets out exactly how we process that data, on whose instructions, with which sub-processors, and under which safeguards.
Key commitments
- ✓Processing only on the hospital's documented instructions; no sale of data; no processing for our own purposes.
- ✓Confidentiality obligations and need-to-know access for all personnel.
- ✓Security measures as detailed in Annex A — the same controls listed in our Security Overview.
- ✓Sub-processors listed in Annex B with 30 days' notice of changes and a right to object.
- ✓International transfers documented — including the intra-group radiology link to clinicalris.com (US-hosted), protected by Standard Contractual Clauses / IDTA where the EU/UK annex applies.
- ✓Breach notification to the hospital within 48 hours of awareness, supporting the hospital's own regulatory deadlines.
- ✓Assistance with patients' rights requests; the hospital stays the point of contact.
- ✓Exit: full-record export available for 30 days after leaving; deletion from production within 90 days; written deletion certificate on request.
Annexes
Version history
| Version | Date | Summary |
|---|---|---|
| 1.1 | 18 October 2026 | Adds Annex G: deployment modes and data ownership — the tenant's data stays on the tenant's own hardware by default (tenant-local / hybrid); EU cloud only at the tenant's request. |
| 1.0 | 17 October 2026 | First published version. Introduced with the in-product DPA acceptance gate for hospital administrators. |
Downloads
Acceptance
Hospital administrators accept this DPA in the product at first login (the acceptance screen records who accepted, which version, when and from where) and are re-prompted when a new version materially changes obligations. Countersigned paper copies are recorded against the hospital's account by our team on request. Superadmins operating the platform are not a party to customer DPAs.
Change notice and objection
If a new DPA version changes what data is processed, adds sub-processors, or changes transfers, hospitals receive at least 30 days' notice (in-product and by email) and may object on reasonable data-protection grounds; unresolved objections allow termination of the affected services with a pro-rata refund of prepaid unused fees.
Questions about the DPA: privacy@clinicalhis.com · Claridad Health Solutions, P.O. Box CT 4835, Cantonments, Accra, Ghana · Reg. No. BN099561220.