Data processing agreement

This data processing agreement ("DPA") is part of the terms of use of edonto. It applies between the organization that uses edonto (a dental laboratory or a dental practice or clinic – "Customer") and LitoraLab Ltd, company number 13880728, 167–169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom ("edonto").

It covers the personal data that the Customer enters into edonto or receives through it ("Customer Data"). For Customer Data, the Customer is the controller ("controlador" under the LGPD) and edonto is the processor ("operador"). It applies in addition to the UK GDPR, the EU GDPR where applicable and the Brazilian LGPD (Lei 13.709/2018).

edonto processes Customer Data only to provide the Service described in the terms of use: exchanging and managing dental cases between labs and clinics, patients and appointments, production, invoicing and lab portals.

The DPA applies for as long as edonto processes Customer Data for the Customer and ends with the deletion of the Customer Data (section 11).

Data subjects: patients of the Customer or of the clinics a lab works with; users and staff of the Customer; contact persons of customers, labs and clinics.

Types of data: patient name or initials, record number, date of birth or age, sex, appointments, case details such as teeth, materials, shade and notes, files such as intraoral scans and photos (health data – special category data under UK GDPR Art. 9 and sensitive data under LGPD Art. 5, II); names, email addresses, roles and activity of users; contact, address, tax and billing details of organizations; messages.

edonto processes Customer Data only on documented instructions of the Customer. The terms of use, this DPA and the settings the Customer makes in edonto (for example which patient information labs see) are these instructions. Further instructions must be in writing and technically feasible.

edonto informs the Customer without delay if it believes an instruction infringes data protection law, and processes Customer Data otherwise only where required by law, in which case it informs the Customer beforehand unless the law prohibits it.

edonto ensures that persons authorized to process Customer Data are bound to confidentiality and only access Customer Data as far as necessary for operating and supporting the Service.

edonto takes appropriate technical and organizational measures to protect Customer Data, in particular: encrypted connections (TLS) for all access; separation of the data of every organization and access control by roles and policies; files stored privately and only delivered after an access check; passwords stored as secure hashes, two-factor authentication and passkeys, mandatory two-factor authentication for platform staff; rate limits and security headers; a change history for cases; regular backups stored separately from the production system; error monitoring and timely security updates.

edonto may adapt these measures to technical progress as long as the level of protection is not reduced.

The Customer generally authorizes edonto to use sub-processors. edonto imposes data protection obligations on them that are at least as protective as this DPA and remains responsible for them. edonto currently uses:

Cloudflare, Inc. (USA) – DNS, protection and delivery of the Service, hosting of the website and manual, storage of case files (Cloudflare R2, Eastern North America).

Hetzner Online GmbH (Germany; data center in Ashburn, Virginia, USA) – servers running the application and database.

Ploi B.V. (Netherlands) – server management and deployments.

Amazon Web Services EMEA SARL / Amazon Web Services, Inc. – sending of emails (Amazon SES, region us-east-1, USA).

edonto informs the Customer at least 30 days in advance of any new or replaced sub-processor, by email or in the Service. The Customer may object on reasonable data protection grounds; if no solution can be found, the Customer may close its account.

Where Customer Data is transferred outside the United Kingdom, the European Economic Area or Brazil, edonto ensures appropriate safeguards – an adequacy decision, the UK International Data Transfer Agreement or Addendum, the EU standard contractual clauses or the standard contractual clauses of the Brazilian data protection authority (ANPD).

edonto supports the Customer in responding to requests of data subjects, mainly through functions in the Service: patients can be corrected or deleted, the organization's data can be exported, and edonto helps with requests that cannot be handled in the Service.

edonto also supports the Customer, taking into account the nature of the processing and the information available, with security, data protection impact assessments and consultations with supervisory authorities.

edonto notifies the Customer without undue delay, where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notification describes, as far as known, the nature of the breach, the data and data subjects concerned, the likely consequences and the measures taken or proposed.

The Customer can export its data at any time (Organization → Settings → Your data). After the account is closed, edonto deletes the Customer Data within 30 days, unless edonto is required by law to retain it. Copies in backups are overwritten in the regular backup cycle.

Shared cases remain available to the other organization involved (lab or clinic), which is a controller of its own copy.

edonto makes available to the Customer the information necessary to demonstrate compliance with this DPA, in particular this agreement and a description of its security measures. The Customer may carry out an audit, or have one carried out by a bound auditor, after reasonable notice, at most once a year unless required by a supervisory authority or after a personal data breach, during normal business hours and without disproportionate disruption; each party bears its own costs.

The liability provisions of the terms of use apply to this DPA. In case of conflict between this DPA and the terms of use regarding the processing of personal data, this DPA prevails.

Changes to this DPA are made as described in the terms of use. This DPA is governed by the laws of England and Wales; mandatory data protection law of the country where the Customer is established remains unaffected.