Data Processing Agreement

The Practitioner is the data controller under Article 4(7) GDPR. They determine the purposes and means of processing their patients' data, and remain solely responsible for clinical content, therapeutic decisions and compliance with their professional code.

Playfield SRL (company number 0833.702.033), with its registered office at Chemin de Toune 4, 1325 Chaumont-Gistoux, Belgium, publisher of Theramate, is the processor under Article 4(8). It processes that data on the Practitioner's behalf and on their instructions.

This agreement constitutes the legal act required by Article 28(3) GDPR. It is annexed to the Terms of Service and accepted together with them. A countersigned copy is provided on request.

Subject matter: the provision of Theramate, a practice management, clinical record and writing assistance tool. Duration: that of the main contract, then the periods set out in Article 8.

Playfield SRL processes the data only on the Practitioner's documented instructions. These terms, this agreement and the Practitioner's use of the features constitute those instructions.

Playfield SRL informs the Practitioner without undue delay if it considers an instruction to infringe the GDPR or Belgian law, and may suspend its execution until clarified.

Where a legal obligation requires processing outside those instructions, the Practitioner is informed beforehand, unless the law forbids it.

Every person authorised to process the data is bound by a duty of confidentiality, contractual or statutory, which survives the end of their engagement.

Commitment not to read: the Theramate team does not read clinical content. Technical access required for operations, support or security is restricted to a limited number of people, logged, and is not used to read records, except at your express request, for instance when you ask for help on a specific record, or under a valid legal obligation.

Playfield SRL implements the measures described in Annex II, in accordance with Article 32 GDPR. Annex II describes the current state of those measures. They evolve with technology and infrastructure, and may be replaced by different measures offering an at least equivalent level of protection.

The Practitioner gives general authorisation for the sub-processors listed in Annex III.

Addition or replacement: Playfield SRL informs the Practitioner at least 30 days before the change goes live, by email and by updating the published list. It further undertakes to announce any new sub-processor handling clinical content, even where the change seems minor.

Urgent replacement: where a sub-processor becomes unavailable or presents a confirmed security risk, Playfield SRL may replace it without notice in order to keep the service running or to protect the data. The Practitioner is informed without delay, and their right to object then applies after the fact, on the same terms.

Objection: the Practitioner may object, with reasons, within 30 days. The parties then seek a solution in good faith. Failing that, the Practitioner may terminate without penalty, with a pro-rata refund of the paid and unused period.

Flow-down: Playfield SRL imposes equivalent obligations on each sub-processor by contract and remains fully liable for their performance.

Playfield SRL provides the Practitioner with the features needed to answer their patients' requests for access, rectification, erasure, restriction, portability and objection.

Where a request cannot be met through those features, Playfield SRL assists the Practitioner within a reasonable time and at no cost. In line with Article 12(5) GDPR, a contribution to costs may be asked for requests that are manifestly unfounded or repetitive, or whose scale clearly exceeds ordinary assistance.

A request addressed directly to Playfield SRL by a patient is forwarded to the Practitioner without delay; Playfield SRL does not answer it itself.

Playfield SRL notifies the Practitioner within 48 hours of becoming certain that a breach has occurred. That period runs from confirmation, not from the first alert.

The notification sets out, as far as possible: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken. Missing information follows as it becomes available, rather than waiting for a complete picture.

Playfield SRL assists the Practitioner with their own obligations under Articles 32 to 36, in particular their notification to the supervisory authority within 72 hours.

On termination, the Practitioner keeps read and export access to all of their data for twelve (12) months, at no extra cost. Where termination follows a serious breach on their part, that period may be shortened, never below the time reasonably needed to export their records, of which they are notified. That access covers reading and exporting only: creation, audio recording, artificial intelligence, online booking and invoicing are switched off.

Early deletion: the Practitioner may request immediate deletion at any time, without giving a reason. That request prevails over the twelve-month period.

Reminders: Playfield SRL informs the Practitioner 60 days and then 7 days before final deletion.

What "deleted" means precisely. In the live system, deletion is immediate: the data stops being accessible and stops being processed. It then remains in the encrypted backups taken before the deletion, for the length of their rotation cycle, currently thirty days, after which it is gone for good. No backup is ever restored in order to retrieve deleted data. A certificate of deletion is issued on request.

Accounting documents: invoices, credit notes and payments remain on file, to preserve the unbroken accounting numbering the law requires. They hold neither clinical content nor identifying data: the patient's name is never stored on them. When a record is deleted, an archive of those documents, completed with the patient's name, is handed to the Practitioner, who keeps it in line with their accounting and tax obligations.

Warning: in Belgium the patient record must be kept for at least 30 years from the last contact with the patient (Act of 22 April 2019 on the quality of healthcare practice, Article 35). It is for the Practitioner to export their records before deletion.

Level 1, on written request, free of charge, within 30 days: Playfield SRL provides the documentation needed to demonstrate compliance with Article 28: Annex II, its hosting providers' certificates and attestations, the up-to-date sub-processor list, and written answers to a security questionnaire.

Level 2, audit: where Level 1 is insufficient, the Practitioner may have an audit carried out, with 30 days' notice, once a year at most, by an independent auditor, not a competitor, bound by confidentiality, with no access to other practitioners' data or to technical secrets.

Costs fall to the Practitioner, unless the audit reveals a material failure by Playfield SRL, in which case Playfield SRL bears them. Playfield SRL may satisfy an audit request by producing a recent independent audit report covering the same scope, or by arranging a pooled audit across several requesting practitioners. The once-a-year limit does not apply following a confirmed breach affecting the Practitioner.

The data is hosted and processed within the European Union. Locations are detailed in Annex III. Where processing involves a transfer to a third country, it is covered by an adequacy decision or by the European Commission's standard contractual clauses.

This section is not about the GDPR but about criminal law, and it is the first question a psychologist asks.

Entrusting a record to Theramate is not a disclosure. Playfield SRL acts as a technical processor, on your instructions alone, with no purpose of its own, and its staff are bound by confidentiality. Under Belgian law a provider necessary to the exercise of the profession is regarded as a necessary confidant: passing data to them so that they can let you work is not a breach of Article 458 of the Criminal Code. The secret remains yours, and you remain its keeper.

What we forbid ourselves, beyond the GDPR. We never contact your patients on our own initiative. We answer no third-party request concerning clinical content (insurer, employer, relative, authority) and refer it back to you, the only person entitled to decide. We issue no certificate, no extract and no confirmation that a record exists to anyone other than you.

If the law compels us. A valid judicial order binds us as it binds you. In that case we inform you before responding whenever the law allows, so that you can assert your own professional secrecy, which goes further than ours. We disclose only what is strictly required.

Your clinical content serves one purpose: providing you with the service.

We do not use it to train or improve artificial intelligence models, neither ours nor our providers', who are contractually bound. We do not use it to produce statistics, studies, research or marketing material, including in aggregated or anonymised form. We neither sell it nor share it with a third party for purposes of our own.

Without exception. Your content is used for no test, no evaluation and no benchmark: that work relies on synthetic records, built for the purpose.

What we do measure. How the software behaves: errors, response times, features used, volumes processed. Those measurements are about the tool, never about what you write in it.

You entrust us with records the law requires you to keep for thirty years. You are entitled to know what happens if something happens to us.

Were we to decide to cease operating, you would be informed at least 90 days before the service stops, and full export of your records would remain available throughout that period. We would delete nothing before it ends.

In insolvency proceedings, bankruptcy or judicial reorganisation, one thing does not change: the export of your records remains guaranteed. That is a commitment, not an effort. The records are yours, they export in a single action from the application, and we bring that obligation to the attention of anyone taking control of the business, be it a trustee, an administrator or an acquirer. The export window will in no case be shorter than thirty days, and you are informed as soon as we become aware of the situation.

What may give way in that scenario is the twelve months of read-only access set out in Article 8: that duration assumes a running service, and it is then no longer ours to decide. The export does not give way.

In the event of a sale or change of control, this agreement and all its commitments pass to the acquirer, who cannot weaken them. You are informed, and if you would rather not continue, you may terminate without penalty with a pro-rata refund.

Your data is never a saleable asset in itself. It can only be transferred as part of the service being taken over, on the same terms, and never sold separately.

Each side answers for what it controls. You decide the purposes, the content and the retention; we carry out your instructions and secure the tool. Liability follows that split.

What the Regulation says, and we hold to it: under Article 82(2) GDPR a processor is liable for damage caused by processing only where it has not complied with obligations specifically directed to processors, or where it has acted outside or contrary to your lawful instructions. In those cases we bear our share without seeking to shift it onto you.

What we cannot carry for you: the accuracy and relevance of clinical content, therapeutic decisions, compliance with your professional code, informing your patients and obtaining the agreements required from them. Those are the acts of a controller, and of a health professional.

Limitation: the limitations and exclusions of liability set out in the Terms of Service apply to this agreement. They limit neither liabilities the law declares non-limitable, nor liability for intentional or gross fault.

Data subjects: the Practitioner's patients, people accompanying them when they take part in a session, and the Practitioner themselves.

Categories of data: identity (name, date of birth, language)
• contact (email, phone, where provided)
• appointments (dates, times, short reasons, attendance)
• health data under Article 9 (session notes, transcripts, summaries, clinical synthesis, questionnaires and scores, documents added to the record, handwritten notes)
• session audio, where applicable, deleted after integration
• video consultation stream, live, never recorded
• billing (fees, payments, accounting data)
• technical (connection logs, limited to support and security).

Purposes: keeping the clinical record, managing appointments, assisted transcription and summarisation, questionnaire completion, video consultation, invoicing, and communication with the patient at the Practitioner's initiative.

Automated decisions: none. Content produced by artificial intelligence is a proposal subject to the Practitioner's review and validation.

Encryption: clinical and personal data encrypted with AES-256-GCM before storage, using a key specific to each practitioner, on top of the hosting platform's own encryption. Keys are managed server-side with restricted access. Exchanges are encrypted in transit (TLS).

Access control: practitioner authentication, ownership checks on every access to patient data, client application integrity attestation, named restriction of technical access.

Logging: access and modification events are logged. Technical logs contain no clinical content.

Backups: automatic encrypted database backups, daily and weekly, kept for 30 days, within the European Union.

Audio: the file handed over by the practitioner is converted by the server into an object encrypted with their key, and the original deposit is destroyed at once. The resulting transcript is encrypted with that same key before it is written to the record. The working files needed for transcription and merging sit in private locations that cannot be listed or cached, and are erased automatically within 24 hours, 3 days at most for the original deposit, including where processing has failed. The audio is deleted once integrated into the record.

Video consultation: the server is operated by Playfield SRL on a dedicated machine located in Paris. Session audio and video pass through it live and are never recorded. Room and participant identifiers are cryptographic digests. The display name is the one the practitioner chooses to show the other participant. Administration, patching and logs for that machine are Playfield SRL's responsibility.

Artificial intelligence: providers are contractually bound not to retain the content transmitted and not to train on it.

Continuity: hosting redundancy and monitoring of automated processing.

Google Cloud / Firebase: hosting, database, server functions, authentication, storage. European Union: database replicated in Belgium (Saint-Ghislain) and the Netherlands, processing in Frankfurt, files in EU multi-region. HDS v2.0 certified infrastructure (certificate no. 2022-013, activities 1 to 5).

Scaleway: transactional email and hosting of the video consultation server. Paris, France.

OpenAI: writing assistance, summaries, contextual answers. Non-retention and no training guaranteed by contract.

Google (Gemini): writing assistance, summaries, clinical analysis. Non-retention and no training guaranteed by contract.

Soniox: audio transcription, European endpoint. Non-retention and no training guaranteed by contract.

Stripe: payment processing, where the Practitioner invoices through Theramate. Ireland.

Each is bound to Playfield SRL by a GDPR-compliant data processing agreement. The up-to-date list is published on this page; any change is subject to the prior notice set out in Article 5.