Data Processing Agreement — personal information (Quebec's Law 25)

DRAFTED WITHOUT LEGAL REVIEW. The Provider stands by this text as written; it applies to the extent permitted by law. There is no lawyer on file and there will be none. This text describes, in good faith, what the Provider actually does, as documented in its privacy impact assessment and its sub-processor register. It promises nothing those documents do not say. This is a translation of the French agreement ("Entente de sous-traitance"); the French version prevails.

Version 1.2 — 2026-09-14 (v1.1: 2026-09-02; v1.0: 2026-08-27). Published at https://allo-clinique.com/en/legal/dpa from the release of the product version that carries it (TGV work of September 2026; before that release the address returns 404 and no acceptance exists); the French version is the one accepted in the dashboard ("Conditions" screen, by the owner or an administrator of the account), and the acceptance is then recorded with the version, the date and the IP address. This translation covers the whole French version 1.2. Additions in v1.1, without rewriting the rest: a stated deadline for the incident notice (section 8), notice before any change of AI model or type of artificial intelligence (section 7), known residual retention periods at sub-processors after a deletion (section 10), and an "AI commitments" annex. Additions in v1.2 (2026-09-14), without rewriting the rest: banner with no promise of a lawyer; basis for the question about the expiry date of the health insurance card (sections 3 and 4, same clause as section 4 of the terms of use); what the Provider gives the Clinic after an incident (section 8, same words as section 6 ter of the privacy policy); updated sub-processor table; possible copy in Vapi's backups (section 10, same period as section 4 of the privacy policy); acceptance in the dashboard (sections 1 and 13). Revision of 2026-09-15, before publication (same version 1.2, never accepted to date): locations and content received by ElevenLabs and Microsoft Azure made precise, Google row brought in line with the facts (table); cases where call content is not deleted at Vapi (sections 6 and 10); AI commitments document named in Annex A and added to the documents of section 11. Revision of 2026-09-17, before publication (same version 1.2): the sentence "no audio recording has been created since August 3, 2026" is made precise (sections 3, 6 and 10, Cloudflare row of the table): it applies to patient calls received by the Clinic's assistants; two exceptions are named.

⚠️ Scope: Quebec regime. Sections 1 (Parties) and 8 (Confidentiality incidents) are written for Quebec's Act respecting the protection of personal information in the private sector (Law 25) and the Commission d'accès à l'information; section 12 chooses Quebec law. The English site (/en) addresses clinics across Canada: for a clinic located outside Quebec, the provincial or federal law that governs its patient information has not been established and this text does not cover it. This point must be settled before contracting with a clinic outside Quebec.

Authorised sub-processors (as of 2026-09-17)

This table follows the Provider's sub-processor register. The "Jurisdiction" column says what the provider's documents establish, and what they leave unstated. The "Agreement" column says in what form the provider is bound.

Provider	Role	Information received	Jurisdiction	Agreement
Supabase	Database and authentication	The whole structured record: clinics, patients (name, phone, reason), appointments, transcripts, text messages	Canada (ca-central-1 region); entity named for the standard contractual clauses: Supabase Pte. Ltd (Singapore)	Data processing agreement incorporated into its terms (version of August 1, 2026), copy kept
Vercel	Application hosting	Data in transit (call reports, forms), function logs of about one day	United States (functions run in the iad1 region, Washington)	Data processing agreement incorporated into its terms, copy kept
Twilio	Telephony and text messages	Caller and called numbers, voice in transit (no recording), text-message content, call statuses (13-month log)	United States	Data processing agreement incorporated into its terms, copy kept
Vapi	Voice orchestrator	Voice in transit during the call, transcript (deleted at Vapi as soon as it is written on the Provider's side; a copy may remain for up to 30 days in its backups, see section 10), call metadata	Outside Quebec. United States according to Vapi's transfer impact assessment; its documents also mention a European Union deployment, not established for the Provider's account	Data processing agreement incorporated into its terms; text of the agreement and list of its sub-processors kept since 2026-09-13
Cloudflare (Vapi's sub-processor)	Vapi's network ingress; used to host call audio	Audio of calls made before August 3, 2026; since then, no audio of patient calls (exceptions in section 3: internal tests with a fictitious patient, service pause)	United States or European Union (Vapi's sub-processor list)	No direct contract; covered by the Vapi agreement, under which Vapi answers for its sub-processors
Deepgram	Transcription of the patient's voice	Audio stream of the patient's voice, transcribed in memory, never written to persistent storage (requests flagged to opt out of the model improvement program)	United States (no Canadian region)	Agreement signed on 2026-09-06
Anthropic	Language model (Claude)	Text of the conversation (name, phone, reason; campaign fields) and of the text messages handled by the assistant; deleted within 30 days; no training	United States	Data processing agreement incorporated into its commercial terms (effective February 24, 2025), copy kept
ElevenLabs	Voice synthesis (the agent's voice)	Text of the agent's replies only — never the patient's voice; this text contains the patient's name and the day, time and practitioner of their appointment	United States, the Netherlands or Singapore (hosting locations named in its privacy policy)	Data processing agreement incorporated into its terms, copy kept
Microsoft Azure (through Vapi)	Fallback voice; Vapi's servers	Text of the agent's replies (patient's name and appointment included), only if ElevenLabs fails or during a service pause; Vapi's list also names it for its servers, without saying what information goes through them	United States or European Union (Vapi's sub-processor list); exact region not established	No direct contract; covered by the Vapi agreement
Stripe	Payments	Clinic billing — no patient data	United States	Stripe's data processing agreement (version of November 18, 2025), copy kept
Sentry	Error log	Technical errors, IP address; fragments (phone, name) may remain despite the filter; 90 days announced	United States	Agreement accepted in the account on 2026-09-05
Hostinger	Email (sending, mailboxes)	Emails of clinic managers; alerts to the clinic, which now carry only the last four digits of a patient's phone number	Outside Canada: company established in Cyprus; mail server location not stated in its agreement	Standard contractual clauses incorporated into its terms, copy kept
GitHub	Source code, continuous integration, daily database backup	Backups encrypted before upload (the decryption key stays with the Provider), kept 30 days	United States	Terms of service (contents of private repositories confidential); application of its data processing agreement to a personal account not established
Google (Gmail)	The Provider's mailbox, outreach to clinics	Prospect emails — no patient data	United States	Google Terms of Service (consumer account), copy kept; they contain no personal-information protection commitment, and no data processing agreement is offered for this type of account; outside the patient chain

---

1. Parties

The Controller: the client clinic that accepts this agreement (the "Clinic"), responsible for its patients' personal information under Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25.

The Processor: Allo Clinique, operated by Lotfi Hichem Boutalbi, person in charge of the protection of personal information, reachable at contact@allo-clinique.com (the "Provider").

2. Purpose and term

This agreement governs the processing, by the Provider on behalf of the Clinic, of the personal information needed for the service described in the terms of use: phone reception by a voice agent, booking, moving and cancelling appointments, confirmations and reminders by text message, and, if the Clinic turns it on, outbound call campaigns.

It takes effect when the account is opened and lasts as long as the service contract does, then until the return or deletion set out in section 10.

3. Nature of the information and persons concerned

Persons concerned: patients and anyone who calls the Clinic or whom the agent calls on its behalf.

Information processed:

• caller's phone number, first name, last name (optional);
• reason for the call, as the person states it;
• requested time window, appointments booked, moved or cancelled;
• text transcript of the conversation;
• content of text messages sent and received;
• in outbound campaigns only, and only if the Clinic ticks the field: pharmacy, expiry date of the health insurance card (on the conditions of section 4), email, date of birth, address (closed list).

No health insurance number and no social insurance number is ever asked for: the service has no field to collect them (closed list above), the agent is instructed never to ask for them, and the Clinic does not have them asked in a free-form campaign question.

No clinical note, no medical history, no medical record. The agent makes no diagnosis. No audio recording of a patient call has been created by the Clinic's assistants since August 3, 2026: of the conversation, only the text transcript exists. Two exceptions, stated as they are: a call received during a service pause (absence message) is recorded by the voice orchestrator and is not deleted, until the Provider has put online the setting that corrects it; the Provider's internal tests, where a fictitious patient talks to the agent, may also be recorded — they carry no information about a real patient.

4. Purposes and instructions

The Provider processes this information solely to provide the service to the Clinic, according to the instructions the Clinic gives through its account configuration (opening hours, services, practitioners, campaign instructions) and in writing. It uses it for no other purpose, does not sell it, and never uses transcripts to train artificial-intelligence models, neither its own nor a third party's. The Provider may read individual transcripts to diagnose a defect in the service, for no other purpose.

Expiry date of the health insurance card (v1.2). The Clinic turns on the question about the expiry date of the health insurance card only if it provides insured services within the meaning of Quebec's Health Insurance Act (CQLR, c. A-29, ss. 9.0.0.1 and 22); it is responsible for that basis. The agent tells the patient why the date is asked and that they may refuse; the Clinic informs its patients of this collection. No health insurance number and no social insurance number is ever asked for. Source of the law: LégisQuébec, text "up to date as of April 7, 2026", read on 2026-09-13. S. 9.0.0.1: the card may be required only for purposes related to services whose cost is assumed by the government. S. 22: payment for an insured service provided to a person who presented their card.

5. Confidentiality

The Provider keeps this information confidential. Only the people who need it to run the service have access to it. The Provider discloses it to no third party other than the sub-processors in section 7, and where the law requires it — in which case it notifies the Clinic, unless legally prohibited.

6. Security measures

Measures in place, as documented in the privacy impact assessment and the privacy policy:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 on the database side);
• Database in Canada (Supabase, ca-central-1 region); real-time processing during the call goes through providers outside Quebec, listed in section 7;
• Isolation per clinic: full-deny access for the anonymous and authenticated roles, the application filters every query by clinic identifier;
• Retention: transcripts and text-message content automatically deleted after 12 months; appointment data (name, phone, appointments) kept for the term of the contract and deleted on request (section 10); the content of each call is deleted at the voice orchestrator as soon as it is written on our side, except in the cases named in section 10;
• No audio recording of patient calls (exceptions named in section 3);
• Daily encrypted backups, decryption key kept outside the cloud, by the Provider;
• Error log, secrets masked.

7. Sub-processors

The Clinic authorises the sub-processors in the table at the top of this document, which follows the list of the privacy impact assessment and the sub-processor register. The Provider notifies the Clinic by email at least 30 days before adding or replacing one for the processing of patient information; the Clinic may then terminate the service at no cost if it objects. The Provider remains responsible to the Clinic for the work of its sub-processors.

Change of AI model or type of artificial intelligence (v1.1). The Provider also notifies the Clinic by email at least 30 days before any change of the language model used to understand and answer during the call, or before adding a new type of artificial intelligence to the service (for example a model that would decide alone, without a human confirmation step, on an irreversible action). The Clinic may then terminate the service at no cost if it objects. The commitments made to the purchaser on the use of AI are set out in Annex A.

8. Confidentiality incidents

In the event of a confidentiality incident affecting the Clinic's information (unauthorised access, use, disclosure or loss), the Provider:

• notifies the Clinic within a reasonable time, without undue delay, and no later than 72 hours after becoming aware of it (stated deadline added in v1.1), with what it knows: nature of the incident, information affected, persons concerned if identifiable, measures taken; an incomplete first notice is followed by updates as soon as they are known, without waiting for the full picture;
• keeps a register of incidents;
• works with the Clinic to assess the risk of serious injury and, where the law requires it, to notify the Commission d'accès à l'information and the persons concerned;
• assists the Clinic with its own notification obligations;
• gives the Clinic, and it alone, a written report (timeline, information affected, measures taken), the log extracts needed for its own declaration and the list of the persons affected; the list never goes to the Commission, whose declaration form forbids any information that identifies a person (v1.2);
• offers the Clinic a template notice to the persons concerned (v1.2);
• gives the Clinic a single point of contact: support@allo-clinique.com (v1.2).

The same commitment appears in section 6 ter of the privacy policy, which forms part of the terms of use (section 5) accepted by each clinic.

9. Assistance with requests from persons concerned

When a patient exercises a right of access, rectification, erasure, portability, objection or de-indexing with the Clinic, the Provider gives the Clinic, within 30 days, the information or action requested (copy, correction, deletion). A request received directly by the Provider is passed on to the Clinic, unless it concerns information the Provider holds on its own account.

10. End of contract: return and deletion

At the end of the contract, nothing is deleted without a request: the information stays in place until the Clinic asks for its export (structured, readable format) or its deletion, a request handled within 30 days. Transcripts and text messages follow, in any case, the automatic 12-month purge. After deletion, the Provider keeps only what the law obliges it to keep (invoicing, accounting: the Clinic's account data, with no patient information) and the encrypted backup copies, which expire on their own cycle.

Spread to sub-processors (v1.1). A deletion requested from the Provider does not necessarily remove, on the same day, a copy already passed to a sub-processor during processing. Known periods, as of 2026-09-17:

• Anthropic (language model): up to 30 days after processing;
• Twilio (telephony and SMS): up to 13 months for the call log;
• Sentry (error log): up to 90 days (period announced by the provider);
• Vapi: the call content is deleted there within seconds, as soon as the end-of-call report is written on the Provider's side, before any request from the Clinic or a patient. Its documents do, however, describe daily backups kept for 30 days; its agreement sets no deadline for deleting data during the contract and, at the end of the contract, does not require it to purge its backups: a copy may remain there for up to 30 days (not confirmed by Vapi). The content is not deleted at all, and stays at Vapi under its ordinary retention, if the deletion fails, if the call cannot be linked to any clinic, if the end-of-call report does not arrive, for a call received during a service pause, or for an internal test with a fictitious patient (section 3).

The Provider gives these periods to a Clinic that asks for them to answer a patient itself, and keeps them up to date in its inventory of personal information.

11. Verification

On reasonable written request, at most once a year except after an incident, the Provider makes available to the Clinic the information needed to demonstrate compliance with this agreement: the privacy policy, the privacy impact assessment, the sub-processor register, the description of security measures, the document "Engagements de la SARIA envers l'acquéreur" (Annex A), and it answers the Clinic's questions in writing. An on-site verification takes place on an agreed date, without access to other clinics' data.

12. Governing law

This agreement is governed by the laws of Quebec. Any dispute is brought before the courts of the judicial district of Montreal. In case of conflict with the terms of use, this agreement prevails as regards personal information.

Annex A — AI commitments (v1.1)

The service described in section 2 uses artificial intelligence to understand speech, decide on a reply, and offer or make an appointment booking. The commitments made by the Provider to the Clinic and its patients on this use — notice of change (section 7), possible human review, stated limits, continuous improvement measures — are detailed in the Provider's document titled "Engagements de la SARIA envers l'acquéreur" (AI commitments to the purchaser, in French; the SARIA being here the voice agent service described in section 2), which section 11 names among the documents made available to the Clinic (updated separately from this agreement; in case of a discrepancy on a CONTRACTUAL commitment, this agreement prevails). That document covers in particular: the proposed user and patient committee, the register of AI-specific risks, and the retention period of the log of the agent's decisions.

13. Signatures

Acceptance of this agreement in the Clinic's dashboard, by its owner or an administrator of the account, recorded with the version, the date and the IP address, takes the place of a signature. A Clinic that also wants a handwritten signature fills in the table below.

	For the Clinic (Controller)	For Allo Clinique (Processor)
Name		Lotfi Hichem Boutalbi
Title		Person in charge of the protection of personal information
Date
Signature