Version 1.0, effective 12 October 2026. Under review by licensed counsel in Egypt and the United States.
Clinic data processing agreement
Version 1.0, effective 12 October 2026
Summary of the agreement every clinic accepts before entering patient data.
This policy is published in Arabic and English. For users in Egypt, if the two versions differ, the Arabic version applies.
6.1Parties and roles
The clinic or doctor is the controller of patient data; Novantria Health LLC is the processor.
6.2Instructions
We process patient data only to provide Dawaaka Rx and on the clinic's documented instructions.
6.3Confidentiality
Everyone with access is bound by confidentiality and trained.
6.4Security
The safeguards in section 1.6 of the Privacy notice.
6.5Sub-processors
We list our sub-processors on the Trust page and give 30 days' notice before adding one; the clinic may object.
6.6Transfers
Patient data stays in Egypt unless a PDPC transfer permit is in place.
6.7Assistance
We help the clinic answer patient rights requests and carry out impact assessments.
6.8Breaches
We notify the clinic without undue delay and within 72 hours, with the details needed to inform the PDPC and patients.
6.9End of service
On termination we return or delete patient data within 90 days, as the clinic chooses, unless law requires retention.
6.10Audits
We provide the information needed to show compliance and allow a reasonable audit once a year with 30 days' notice.