Between
Controller (Responsible Party):
[Name of Medical Practice/Clinic], [Legal Form]
[Address of Doctor/Practice]
(Hereinafter: "Controller")
and
Processor (Data Processor):
praxiops.com
[Address of Your Company]
(Hereinafter: "Processor")
§ 1 Subject, Duration and Authority to Issue Instructions
Subject of Processing:
The Processor provides the Controller with the service "Practice Optimization and Reputation Management", which includes the automated collection, analysis, and management of publicly accessible patient feedback and related data.
Duration:
The contract begins on [Service Start Date] and ends automatically upon termination of the main contract for the Practice Optimization Service, unless legal retention obligations apply.
Authority to Issue Instructions:
The Controller is the sole "master of the data" and has the right to issue instructions to the Processor at any time regarding the type, scope, and execution of data processing.
§ 2 Type, Scope and Purpose of Processing
Type of Processing:
Processing includes collecting (retrieval), storing, analyzing, aggregating, evaluating, classifying (e.g., via AI sentiment analysis), and commenting on (responding to) data. Processing is automated.
Purpose of Processing:
The purpose is to identify operational weaknesses in the Controller's practice and to actively manage online reputation by responding to customer reviews on public platforms on behalf of the Controller.
Categories of Data Subjects:
- Patients who have submitted public reviews.
- Possibly their relatives, if mentioned in the review.
- Customers/users of the practice website (through usage analysis).
Types of Personal Data:
- Identity data: Pseudonyms or real names of reviewers (as publicly visible).
- Content data: Textual content of reviews, star ratings given.
- Metadata: Time of publication, platform source (Google, Jameda, etc.).
§ 3 Specific Instructions for Responding to Reviews
The Controller hereby grants the Processor explicit and specific instruction and authorization to perform the following actions on behalf of and for the account of the Controller, within the scope of the mandate granted and in strict compliance with the Controller's instructions:
- Response Generation and Publication: The Processor is authorized to create, transmit, and publish public comments on received patient reviews (both positive and negative) on the captured platforms (Google, Jameda, etc.).
- Response Deletion: The Processor is authorized to subsequently modify or delete comments created by itself.
- Compliance: The Processor undertakes to always comply with GDPR, BDSG, and the respective terms of use of the platforms when creating comments, and not to disclose any patient-specific or confidential information.
This is the legal basis for transferring the practice owner's action rights to your service.
§ 4 Obligations of the Processor (Excerpt)
The Processor undertakes in particular:
- To carry out processing exclusively on documented instructions from the Controller, unless the Processor is required to do so under EU law or the law of the Member States.
- To ensure that persons authorized to process have committed themselves to confidentiality.
- To take all technical and organizational measures (TOMs) required under Art. 32 GDPR to ensure data security.
- To use subcontractors (sub-processors) only with prior written or electronic approval of the Controller. The same data protection obligations apply to sub-processors.
- The Processor supports the Controller in fulfilling its obligations (e.g., data subject rights, in case of data breaches).
§ 5 Obligations of the Controller (Excerpt)
The Controller is responsible for the lawfulness of data processing and undertakes in particular:
- To ensure that the processing of personal data (the submission of the review by the patient) is based on a valid legal basis (e.g., Art. 6(1)(f) GDPR - legitimate interest of the doctor in improving their service).
- To promptly provide the Processor with all information necessary to perform the contract.
- To take note of the TOMs transmitted by the Processor and to review their appropriateness.
[Place, Date]
____________________________________
[Signature of Controller (Doctor/Practice Owner)]
____________________________________
[Signature of Processor (praxiops.com)]