Data Processing Agreement

1. About this agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between your clinic and Velon LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. It applies whenever Reva processes personal data on your clinic's behalf that is protected by the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection or a similar data protection law.

For your patients' data, your clinic is the controller and Velon LLC is the processor. You accept this DPA when you accept the Terms of Service and use Reva; no signature is needed. If this DPA and the Terms disagree about personal data, this DPA wins.

2. What we process, and why

• Purpose: to provide Reva: send your appointment confirmations, reminders and recall messages on WhatsApp or Telegram, process your patients' replies, and show your schedule and message history.
• People concerned: your patients (and, for minors, their parents or guardians) and the members of your team who use Reva.
• Data: patient names, WhatsApp numbers or Telegram chat identifiers, preferred language, notes you add, appointment dates, times, durations, reasons and statuses, the messages sent and the replies received; for your team, names, email addresses and roles.
• Health-related data: the fact that someone is a patient of a clinic, and the reason for a visit, can be health data. Add only what you need. WhatsApp appointment messages contain only the patient's first name, your clinic's name and the appointment date and time.
• Duration: for as long as your clinic uses Reva, then until the data is deleted as described in section 8.

3. Our commitments

• We process your patients' data only on your documented instructions: the Terms, this DPA, and what you do in Reva (adding patients, booking appointments, choosing settings). If we think an instruction breaks data protection law, we tell you.
• Everyone at Velon LLC who can access the data is bound by confidentiality.
• We never sell your patients' data, and never use it for advertising or for any purpose of our own.
• We tell you if a law requires us to process the data differently, unless that law forbids telling you.

4. Security

We protect the data with technical and organisational measures that fit the risk, including:

• encryption in transit (HTTPS) for every connection to Reva;
• the credentials that connect your WhatsApp or Telegram account encrypted at rest (AES-256-GCM);
• passwords stored only as salted scrypt hashes, never readable;
• each clinic's data kept separate: every request is checked against the signed-in clinic;
• roles inside your clinic (owner, manager, front desk), two-factor sign-in available for every user, limits on login attempts, and an activity log;
• incoming message events from WhatsApp and Telegram verified with secrets or signatures;
• message history deleted automatically after 12 months.

5. Sub-processors

You allow us to use the sub-processors below. Each one is bound by data protection terms that protect the data at least as much as this DPA, and we remain responsible to you for them.

Meta (WhatsApp) and Telegram also act under their own terms and privacy policies for the operation of their platforms.

Before we add or replace a sub-processor that handles your patients' data, we update this page and email your clinic's owner at least 30 days in advance. You can object by emailing support@revafast.com. If we can't resolve your objection, you can stop using Reva and close your account.

6. International transfers

Reva's servers and database are in the United States. When data from the European Economic Area, the United Kingdom or Switzerland is transferred there, the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two: controller to processor) apply and are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum and the changes required for Swiss data. Our sub-processors' own transfers are covered by their safeguards, such as Standard Contractual Clauses.

7. Helping you meet your obligations

• Patients' requests: you can view, correct and delete any patient in Reva, and the clinic owner can download all of the clinic's data. A patient who replies STOP stops receiving messages automatically. If a patient writes to us directly, we pass the request to you.
• Data breaches: if a personal data breach affects your clinic's data, we tell you without undue delay after we become aware of it, with the information we have and what we are doing about it.
• Impact assessments: on request, we give you the information you reasonably need for a data protection impact assessment or a consultation with a data protection authority.

8. Deleting and returning data

The clinic owner can download all of the clinic's data at any time from Reva. Message history is deleted automatically after 12 months. When your clinic closes its account, we delete its patient data within 30 days, unless a law requires us to keep some of it, in which case we keep only that part, protected, for as long as the law requires.

9. Information and audits

We give you the information you reasonably need to show that this DPA is respected, and answer your written questions. If that isn't enough, or a data protection authority requires it, you or an independent auditor bound by confidentiality may audit our compliance, with at least 30 days' notice, during business hours, at your cost, and no more than once a year unless a breach or an authority requires it.

10. Liability and duration

Each party's liability under this DPA follows the limits in the Terms of Service, to the extent data protection law allows. This DPA lasts as long as we process personal data for your clinic.

11. Contact

Velon LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. Email: support@revafast.com.