Data processing agreement
This agreement sits alongside the subscription and Telemed agreements. It names who is the controller and who is the processor of personal data, and the duties each side carries under Oman's Personal Data Protection Law.
Draft, pending legal review
This document is an in-house draft, prepared for review by legal counsel in Oman. It is not legal advice, is not yet in force, and may change.
Who controls, who processes
- For a patient's clinical record from a consultation, the clinic and its treating doctor are the controller. Afya processes that record on the clinic's instructions, to host and deliver the consultation tools.
- For the public directory, reviews, and account data, Afya is the controller in its own right.
Afya's duties as processor
- Process clinical data only on the clinic's documented instructions, and only to provide the service.
- Keep the data confidential, and bind staff to confidentiality, with access on a break-glass basis only.
- Protect the data with encryption in transit and at rest.
- Store the data on servers inside the Gulf, and not move health data outside the region without the lawful safeguards.
- Help the clinic answer a patient's request to see, correct, or erase their data.
- Tell the clinic without undue delay if a breach affects its patients' data.
- Return or delete the data when the service ends, at the clinic's choice.
- Use only sub-processors that carry the same duties.
The clinic's duties as controller
- Have a lawful basis, including the patient's consent, before a consultation.
- Give patients the privacy information they are owed, and handle their requests.
- Use the platform's sharing controls only on a lawful basis, and never instruct an unlawful disclosure.
Related documents
How long data is kept is in the data-retention schedule, and how a breach is handled is in the breach-response procedure.
This document is published in Arabic and English. If the two versions ever differ, the Arabic version is the one that applies.