This Data Processing Agreement ("DPA") supplements the ORALZY Terms of Service ("Agreement") and governs the processing of Personal Data by ORALZY ("Processor") on behalf of the Customer ("Controller"). The Customer accepts this DPA by accepting the Terms or by clicking through any equivalent acceptance flow inside the Service. In case of conflict between the Terms and this DPA, this DPA prevails for matters of personal-data processing.
Capitalised terms have the meanings given in the Agreement or in applicable data-protection law. "Customer", "Service", and "Subscription" have the meanings given in the Terms. "Data Principal", "Data Fiduciary", and "Significant Data Fiduciary" have the meanings given in the DPDP Act 2023; for GDPR jurisdictions "Data Subject", "Controller", and "Processor" have the meanings given in Article 4 GDPR.
The Customer is the Controller / Data Fiduciary in respect of Personal Data uploaded to or generated within the Service. ORALZY acts as the Processor / Data Processor on the Customer's behalf and processes Personal Data only to provide and improve the Service in accordance with the Agreement. ORALZY is an independent Controller solely for limited Account-level data (billing contacts, login telemetry, security logs) needed to operate the Subscription.
ORALZY shall process Personal Data only:
ORALZY ensures that personnel authorised to process Personal Data are bound by appropriate confidentiality undertakings or are under a statutory duty of confidence. Access is granted on a need-to-know basis and removed promptly when the role ends.
ORALZY implements and maintains the technical and organisational measures set out in Annex B to ensure a level of security appropriate to the risk, in line with Article 32 GDPR and Section 8(5) of the DPDP Act 2023.
The Customer authorises ORALZY to engage sub-processors as listed at /subprocessors.html. ORALZY will:
Taking into account the nature of the processing, ORALZY assists the Customer in fulfilling its obligation to respond to requests for the exercise of Data-Principal / Data-Subject rights — access, correction, erasure, portability, restriction, objection, and withdrawal of consent — by providing self-service tools inside the Service and, where reasonably needed, by responding to specific requests from the Customer within fifteen (15) calendar days.
ORALZY notifies the Customer of any confirmed Personal-Data breach without undue delay, and in any event within 72 hours of becoming aware. The notification will include, to the extent known: the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and the measures taken or proposed.
Taking into account the nature of the processing and the information available, ORALZY provides reasonable assistance to the Customer in carrying out Data Protection Impact Assessments (Article 35 GDPR) and prior consultations with supervisory authorities (Article 36 GDPR), at the Customer's cost where the assistance materially exceeds standard documentation.
Upon termination of the Subscription, the Customer may export Personal Data in a machine-readable format using the in-Service tools or by written request to [email protected] within ninety (90) days of termination. After this 90-day window, ORALZY will delete or anonymise Customer Personal Data, except where retention is required by law or is necessary to defend legal claims (for example, billing and tax records).
ORALZY makes available to the Customer all information reasonably necessary to demonstrate compliance with this DPA. The Customer may, no more than once per calendar year and on reasonable prior notice, request an audit limited to information needed to demonstrate compliance. Where the Customer is itself audited or asks for evidence, ORALZY will normally satisfy the request by providing third-party audit reports of upstream sub-processors and ORALZY's own security documentation, before any on-site audit is required. On-site audits are at the Customer's cost.
Customer Personal Data is hosted primarily in Mumbai, India. Where a sub-processor processes data outside India, ORALZY relies on an appropriate transfer mechanism — Standard Contractual Clauses, adequacy decisions, or, for India, the cross-border transfer regime once notified by the Central Government under Section 16 of the DPDP Act 2023.
The liability of each Party under this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits a Party's liability for fraud, gross negligence, wilful misconduct, or any liability that cannot be limited by applicable law.
This DPA takes effect on the Effective Date and continues for the duration of the Subscription. Provisions which by their nature should survive termination — including confidentiality, deletion, audit, and liability — survive termination of the Agreement.
Notices under this DPA may be sent to [email protected] for ORALZY and to the Customer's registered admin email. This DPA is governed by the laws of India, subject to mandatory data-protection rules of any other jurisdiction whose protection cannot be derogated from by contract.
| Subject matter | Provision of the ORALZY dental practice-management Service. |
|---|---|
| Duration | Term of the Subscription, plus the post-termination data-export window. |
| Nature & purpose | Storage, transmission, retrieval, presentation, computation, AI-assisted analysis, communication, and back-up of Customer data; provision of related billing and operational features. |
| Categories of Data Subject | Patients, prospective patients, accompanying relatives, clinic staff, doctors, vendors, and other persons whose data the Customer enters into the Service. |
| Categories of Personal Data | Identification (name, DOB, gender, IDs); contact (mobile, email, address); health (dental history, treatment notes, prescriptions, X-ray and intra-oral images, lab reports); financial (invoices, payments); operational (appointments, attendance, communications); device/login logs. |
| Special categories | Health data, including dental and medical history. |