Orkelia ← Back

Data Processing Agreement (DPA)

Data Processing Agreement — GDPR-compliant (EU 2016/679)

Critical for the healthcare sector · Provided at signature

1. Parties

2. Purpose and scope

In the course of performing the Orkelia services, the Data Processor (Orkelia) processes personal data on behalf of the Data Controller (the Client).

This agreement defines the conditions under which Orkelia processes such data in accordance with Article 28 of the GDPR.

3. Nature of the data processed

Category	Nature	GDPR classification
Patient identity	Last name, first name, phone (for appointment booking)	Ordinary data
Operational metadata	Date/time of contact, request status	Ordinary data
Communications	Inbound/outbound messages from the AI agents	Ordinary data

4. Orkelia's obligations (data processor)

• Process the data only on documented instructions from the Data Controller
• Ensure the confidentiality of the data (confidentiality agreement with staff)
• Implement appropriate technical and organizational security measures (Article 32 GDPR)
• Not engage other sub-processors without prior notice to the Controller
• Assist the Controller in handling the rights of data subjects
• Notify any security incident within 72 hours
• Delete or return the data at the end of the contract
• Provide all information necessary for the Controller's audits

5. Security measures (Article 32 GDPR)

• TLS 1.3 encryption in transit on all communications
• AES-256 encryption at rest (Supabase, eu-west-3 Paris region)
• Per-clinic data isolation via Row Level Security (Supabase)
• Multi-factor authentication for access to production systems
• API keys and secrets stored in server-side environment variables (not exposed)
• Logging of access to production data
• Quarterly security review

6. Sub-processors

Orkelia relies on the following sub-processors, accepted by the Client at signature:

Sub-processor	Use	Country	Safeguard
Supabase Inc.	Database	EU (Paris)	Native GDPR
Vercel Inc.	Application hosting	USA/EU	SCC
Anthropic PBC	AI engine (Claude)	USA	SCC · Zero Data Retention
Stripe Inc.	Payment (financial data)	USA	PCI-DSS L1
Resend Inc.	Transactional emails	USA	SCC

SCC = Standard Contractual Clauses approved by the European Commission.

7. Transfers outside the EU

Some sub-processors (Vercel, Anthropic, Stripe, Resend) are established in the United States. These transfers are governed by Standard Contractual Clauses (SCC) in accordance with the decisions of the European Commission.

Regarding Anthropic: the "Zero Data Retention" policy is enabled — data submitted to the models is not retained for training.

8. Duration and end of processing

This agreement takes effect on the date the Orkelia contract is subscribed and ends upon its termination.

At the end of the contract, Orkelia undertakes to:

• Delete the data within 90 days
• Provide a deletion certificate upon request
• Allow the export of the data before deletion (CSV/JSON format)

9. Incident notification

In the event of a data breach likely to create a risk to the rights and freedoms of individuals, Orkelia notifies the Data Controller within 72 hours via the email registered in the contract.

The notification includes: nature of the incident, data concerned, measures taken, contact for the point of reference.

10. Request a signed DPA

To obtain a PDF version of this agreement, pre-filled and signed by Orkelia:

Request the signed DPA →