Data Processing Agreement (DPA)

This agreement (the “Agreement”) is concluded under Article 28 of Regulation (EU) 2016/679 (“GDPR”) between:

• the User — the doctor or healthcare professional who creates an account in the Doctor Estimator application, acting as controller of their patients' data; and
• CODEMARS SRL, registered office at 2 Armoniei Street, Șelimbăr, Sibiu County, Romania, tax identification number RO45431372 (“Doctor Estimator”), acting as processor.

For the User's own data (account and billing data), Doctor Estimator acts as controller, in accordance with the Privacy Policy.

Doctor Estimator processes personal data on the User's behalf solely to provide application functions: patient records, scheduling and tracking medical procedures, work calendar, activity statistics and AI-assisted appointment import.

Processing lasts throughout the existence of the User's account and ends when the account is closed, subject to section 9 (Data deletion).

Data subjects: the User's patients.

Categories of data: name (or initials/pseudonyms), telephone number, data concerning appointments and medical procedures performed, and notes entered by the User. These data may constitute health data (a special category under GDPR Article 9). The User, as controller, is responsible for the legal basis for processing these data (normally GDPR Article 9(2)(h) — provision of healthcare subject to professional secrecy).

We recommend entering only strictly necessary data and, where possible, using initials or pseudonyms, in line with the Terms and Conditions.

Doctor Estimator processes data only on the User's documented instructions, embodied in use of the application features, and does not use patient data for its own purposes (including marketing or AI-model training). If we consider an instruction to breach GDPR, we will inform the User without delay.

Persons authorised to process data (Doctor Estimator personnel and collaborators) are bound by contractual or legal confidentiality obligations.

• encryption of data in transit (TLS/SSL) and at rest at database level;
• hosting data in European Union cloud infrastructure;
• passwords stored only as a cryptographic hash (bcrypt);
• HTTP-only cookie authentication, CSRF protection and login-attempt limiting;
• account-level data isolation: every User accesses only their own data;
• technical logging with sensitive parameters redacted; and
• images uploaded for AI import are not stored on our servers; they are processed in memory and deleted immediately after extraction.

The User gives general authorisation for use of the following sub-processors:

• Vercel Inc. — hosting and delivery of web applications (public website and dashboard application);
• Railway Corp. — backend infrastructure (API) hosting;
• Neon Inc. — PostgreSQL database hosting;
• Anthropic — extracting appointments from images (AI Intake). Processing may take place outside the EU under standard contractual clauses / the DPF;
• Twilio SendGrid — operational emails (processing configured in the EU); and
• Sentry (Functional Software, Inc.) — technical-error monitoring (EU region).

We will inform Users of additions or replacements of sub-processors, allowing reasonable objections. Transfers outside the EEA are based on standard contractual clauses or adequacy decisions (including the EU-US Data Privacy Framework).

Taking account of the nature of processing, Doctor Estimator assists the User, where possible, in fulfilling the obligation to respond to data-subject requests (access, rectification, erasure and portability) and in ensuring processing security, including carrying out data protection impact assessments (DPIAs), where applicable.

We notify the User without undue delay after becoming aware of a personal-data breach, providing the information needed for the User to meet their obligation to notify the authority within 72 hours (GDPR Article 33).

When the account is closed or following the User's written request (sent to contact@doctorestimator.ro), we delete or return patient data within no more than 30 days, except where retention is required by law. Backups are deleted in the normal backup-rotation cycle.

On request, we provide the User with the information necessary to demonstrate compliance with the obligations in GDPR Article 28 and permit, under reasonable conditions of confidentiality and scheduling, audits or inspections performed by the User or an appointed auditor.

This Agreement is accepted upon account activation, together with the Terms and Conditions; the accepted date and version are recorded in the User's account. The current version is permanently available on this page; material changes will be notified and may require renewed acceptance.

For questions about this Agreement or data protection, contact us at contact@doctorestimator.ro.