Data processing agreement

The roles

The practice is the controller of the personal data it enters into Labrador. YUFU CAPITAL, which publishes Labrador, processes it on the practice's behalf, as a processor within the meaning of article 28 of the GDPR. The agreement applies throughout the contract, then during the return period that follows it.

What we do with the data

We host, store, display and format it, to provide the service, support and onboarding assistance. Nothing else.

We act only on the practice's instructions: the contract, and the way it uses Labrador. If an instruction seems to us to be contrary to the law, we tell the practice straight away.

The people and data concerned

Two groups of people are concerned.

• Pet owners, the practice's clients: identity, contact details, invoices and payments, information about the animal and its follow-up (identification, medical record, tests, prescriptions, reminders, appointments, documents, photos), team notes.
• Members of the practice's team: identity, email, sign-in credentials, role, sign-in and action logs.
• No sensitive data within the meaning of article 9 of the GDPR is expected: the medical information concerns the animal. The practice refrains from entering any, including in free-text notes.

How long

During the contract, then 12 months so that the practice can take its data back. Technical logs are kept for 12 months. After that, or sooner if the practice asks, we delete the data and its copies, unless the law requires us to keep it. We certify the deletion on request.

Security

We apply the measures of article 32 of the GDPR, in particular:

• encryption of communications, and of the data stored with the host;
• passwords never kept in plain text;
• separation of each practice's data, enforced by the database itself, row by row;
• access according to each person's role, limited to what is strictly needed;
• access by our team to a practice's space that must be justified, is limited to four hours and is recorded in the log;
• software components kept up to date, and an incident management procedure.

Confidentiality

The people who process the data undertake to keep it confidential, or are bound to do so by law.

Sub-processors

The practice authorises the use of the providers below. Any addition or replacement is announced to it in writing at least 30 days in advance. It may object on legitimate grounds; failing a solution, it may terminate without charge, refunded for the unused period. Each provider is bound by equivalent obligations, and we remain responsible for it.

• Supabase Pte. Ltd.: database and authentication. European Union (Ireland).
• Vercel Inc.: hosting of the application and running of the server. United States and global network.
• Plus Five Five, Inc. (Resend): sending of emails. United States.

Timestamping of the till

Every night, a fingerprint of the till is dated by timestamping services (Sectigo, DigiCert). They receive only this fingerprint, the result of a calculation, which contains no personal data: they are not sub-processors.

Outside the European Union

The data is stored in Ireland. But the application server runs in the United States, and emails are sent through a US company. These transfers are covered by an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for the companies that adhere to it, or by the Commission's standard contractual clauses.

Individuals' rights

We help the practice answer the requests of its clients and its team: access, rectification, erasure, restriction, portability, objection. A request that reaches us directly is forwarded to the practice within 5 working days.

Data breach

We notify the practice without delay, and at the latest 48 hours after becoming aware of the breach, by email to the address given in the contract, with the information required by article 33 of the GDPR. We immediately take measures to limit its consequences.

Assistance, documentation and audit

We assist the practice, as far as possible, with an impact assessment or a consultation of the supervisory authority. Beyond the documentation available, this assistance may be subject to a quotation. We keep available to the practice the documentation that shows we comply with this agreement, and a record of the processing carried out on behalf of our clients.

The practice may have an audit carried out once a year, at its own expense, with 30 days' written notice, by an independent auditor who is bound by confidentiality and is not our competitor. One further audit is possible after a data breach.

Write to us

For any question about personal data: bonjour@labrador.vet.