Data Processing Agreement (DPA)

pursuant to Art. 28 (3) of the General Data Protection Regulation (GDPR)

1. Subject matter and duration

The processor (Tempulo / auronet GmbH) processes personal data on behalf of the controller (the practice / account holder) in the course of providing the appointment-scheduling software. This agreement runs for the same term as the user agreement.

2. Nature and purpose of the processing, types of data and categories of data subjects

Purpose of the processing

1. Operation of the controller’s booking page and — where used — the embedded booking widget.
2. Storage and provision of appointments, series, waitlist, client records, prescriptions and messages in the dashboard.
3. Sending confirmations, reminders and confirmation links by email and, where the controller enables it, by SMS.
4. Protection against attacks, abuse and automated bookings.
5. Data export on the controller’s instruction.

Categories of data subjects

• Patients and accompanying or contact persons recorded through the practice’s booking page or dashboard.
• People for whom someone else books an appointment.

Types of personal data

• Master data and contact details: name, email address, phone number, optional address and language.
• Appointment data: time, service, practitioner, room, status (booked, confirmed, cancelled).
• Health data: the chosen service, prescriptions, notes and other details the practice stores in the record (Art. 9 GDPR).
• Messages between practice and patient, where the controller uses that channel.
• Technical access data: IP address solely for delivery and security; it does not enter usage statistics.

The processor processes the controller’s own account, login and payment data as an independent controller; those data are outside this agreement. An optional patient account of the data subject is likewise processed by the processor as an independent controller.

3. Technical and organisational measures

The processor takes all technical and organisational measures required by Art. 32 GDPR to ensure a level of security appropriate to the risk — including with regard to health data and professional secrecy under § 203 of the German Criminal Code.

The hosting infrastructure runs on Microsoft Azure (EU location, West Europe region). Static interfaces may be delivered through Cloudflare; API calls carrying booking and record content terminate in the controller’s Azure region. Data is encrypted in transit and at rest; access to production data is limited to a small number of authorised people who are bound to confidentiality.

No tracking cookies are set for advertising. The booking page does not run an analytics script.

4. Sub-processors

The controller hereby authorises the use of the following sub-processors:

• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (Azure: Functions, databases, storage)
• Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (delivery of static pages, CDN, bot protection/Turnstile)
• Brevo (Sendinblue), EU (sending confirmation and reminder emails and, where enabled, SMS)

We use the content delivery network (CDN) of Cloudflare Inc. (USA) to deliver the static interface and to defend against attacks (DDoS). Cloudflare processes the visitor’s IP address to deliver the page and to detect attacks. Cloudflare ensures an adequate level of protection through Standard Contractual Clauses (SCCs) and certification under the Data Privacy Framework (DPF). We have concluded a data processing agreement with Cloudflare.

To protect forms against abuse by automated programs (bots) we use Cloudflare’s Turnstile service. Turnstile checks whether a human submitted the input. Unlike conventional captchas it does not set tracking cookies or build advertising profiles. Consent (a cookie banner) is not required for this.

Calendar services that the controller connects itself (Google, Microsoft) and the website into which the controller embeds the booking widget are not sub-processors of the processor. The controller is responsible for those connections. Stripe processes the controller’s payment data as an independent controller towards the processor; Tempulo does not collect patients’ card data.

The processor will engage further sub-processors only after informing the controller. The controller may object within 14 days; an objection may end the user agreement if the change is indispensable for operating the service.

5. Obligations of the processor

The processor processes data only on documented instructions from the controller, unless Union law or the law of a Member State requires otherwise. It ensures that persons authorised to process the data have committed themselves to confidentiality — including under § 203 of the German Criminal Code where the controller is a professional bound by secrecy.

The processor will assist with data-subject rights, notification duties and data-protection impact assessments insofar as they concern the processing under this agreement, subject to reasonable notice of the effort involved. The controller answers data-subject requests about the record; the processor supplies the data needed for that.

6. Rights of the controller

The controller may verify compliance with data-protection law and this agreement to the extent required, including through information and, after reasonable notice, audits.

A complete, machine-readable export of the data processed on the controller’s behalf is available at any time and remains free of charge for 90 days after the user agreement ends.

7. Deletion and return

When the user agreement ends or on the controller’s instruction, the processor deletes the data processed on the controller’s behalf, unless a statutory retention duty applies.

Deleting the account in the dashboard takes the booking page offline. The processor deletes client records, appointments and prescriptions only on express instruction or after the periods agreed with the controller (in Germany usually ten years for the record). Short-lived backups (database 7 days) then expire.

---

Electronically signed by: Company/name: {{name}} Address: {{address}} Date: {{date}} Timestamp: {{timestamp}} ID: {{id}}