1. Parties
This Data Processing Agreement ("DPA") is entered into between:
- Data Processor: Nexus Tech L.L.C-FZ ("Fidelia," "we," "us"), registered in Dubai, UAE, with registered address at The Meydan Hotel, Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
- Data Controller: The clinic owner or authorised representative who has agreed to the Fidelia Terms of Service ("you," "Controller").
This DPA forms part of the Terms of Service and applies to all personal data that Fidelia processes on behalf of the Controller in the course of providing the Service.
2. Scope of Processing
Fidelia processes data on behalf of the Controller solely for the purpose of delivering the Service as described in the Terms of Service. The Controller determines the purposes and means of processing; Fidelia acts only on documented instructions from the Controller, except where required by applicable law.
Processing activities include: ingesting Google reviews associated with the Controller's Google Business Profile, generating AI-drafted review responses, calculating reputation scores, and sending email notifications to the Controller.
3. Categories of Data Processed
Fidelia processes the following categories of data in the course of providing the Service:
- Google review data (publicly available): reviewer display names, star ratings, review text, and review timestamps
- Clinic data: clinic name, address, Google Business Profile identifier, and Google Place ID
- AI-generated content: draft review responses produced by the Service for the Controller's approval
- Account data: the Controller's name, email address, and Google OAuth tokens (encrypted)
- Billing data: subscription status and Stripe customer identifier (full payment card details are held exclusively by Stripe and are never stored by Fidelia)
4. Purpose of Processing
The data described in Section 3 is processed exclusively for the following purposes:
- Generating AI-drafted review responses that comply with jurisdiction-specific clinical confidentiality rules
- Calculating and displaying reputation scores and review analytics
- Sending transactional email notifications (new review alerts, weekly summaries, account communications)
- Managing subscription billing and account administration
Fidelia does not process Controller data for marketing, profiling, or any purpose beyond delivering the Service.
5. Sub-processors
Fidelia engages the following sub-processors to deliver the Service. The Controller consents to the use of these sub-processors by accepting this DPA:
- Cloudflare, Inc. (United States / EU infrastructure) — hosting, CDN, D1 database, Workers compute, and KV store. Data is processed on Cloudflare's global edge network with primary storage in EU data centres.
- Anthropic, PBC (United States) — Claude API for AI draft generation. Review text and clinic context are sent to Anthropic for inference only. Per Anthropic's API terms, data submitted via the API is not used for model training.
- Stripe, Inc. (United States / EU) — payment processing and subscription management. Stripe is PCI DSS Level 1 compliant. Fidelia does not store or access full payment card details.
- Resend / Amazon Web Services (SES) (EU, eu-west-1) — transactional email delivery. Email content is processed in the EU (Ireland) region.
- Google LLC (United States / EU) — Google Places API, Google OAuth, and Google Business Profile API. Used to retrieve review data and publish approved responses on behalf of the Controller.
Fidelia will notify the Controller of any intended changes to sub-processors by updating this page. The Controller may object to a new sub-processor by contacting us within 30 days of notification. If the objection cannot be resolved, the Controller may terminate the Service.
6. Security Measures
Fidelia implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. These measures include:
- All data in transit is encrypted via HTTPS (TLS 1.2 or higher)
- Google OAuth tokens are stored in encrypted form and are never exposed in plaintext
- Authentication cookies are HttpOnly and Secure, preventing client-side script access
- No plaintext credentials are stored in application code or configuration
- Access to production infrastructure is restricted to authorised personnel only
- Sub-processors are selected on the basis of their security certifications and data protection commitments
7. Data Retention
Fidelia retains Controller data as follows:
- Active accounts: data is retained for the duration of the Controller's subscription and is available for export at any time
- Post-cancellation: account data, review drafts, response history, and analytics are retained for 30 days following account closure to allow for data export, after which they are permanently deleted
- Payment records: billing records and invoices may be retained beyond the 30-day period where required by applicable tax or accounting law
- Published responses: responses that have been published to Google are hosted by Google and are not affected by account closure with Fidelia
8. International Data Transfers
Certain sub-processors (Anthropic, Stripe, Google) process data in the United States. Where personal data originating in the European Economic Area, the United Kingdom, or another jurisdiction with transfer restrictions is transferred to the United States, Fidelia ensures that appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
- The UK International Data Transfer Agreement or Addendum, for transfers from the United Kingdom
- Reliance on sub-processor certifications and data protection addenda (e.g., Stripe's and Google's published DPAs)
The Controller may request copies of the relevant transfer mechanism documentation by contacting us at [email protected].
9. Data Subject Rights
The Controller, as the data controller, is responsible for responding to data subject rights requests (access, rectification, erasure, restriction, portability, and objection) in accordance with applicable data protection law.
Fidelia will assist the Controller in fulfilling data subject requests to the extent that such requests relate to data processed by Fidelia. Upon receiving a request from the Controller, Fidelia will provide the requested information or carry out the requested action without undue delay and in any event within 30 days.
If Fidelia receives a data subject request directly, we will promptly redirect the data subject to the Controller and notify the Controller of the request.
10. Breach Notification
In the event of a personal data breach that affects data processed on behalf of the Controller, Fidelia will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach.
The notification will include:
- A description of the nature of the breach, including the categories and approximate number of data subjects and records affected
- The name and contact details of the point of contact for further information
- A description of the likely consequences of the breach
- A description of the measures taken or proposed to address the breach, including measures to mitigate its effects
Fidelia will cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.
11. Audit Rights
The Controller may request compliance documentation to verify that Fidelia is processing data in accordance with this DPA. Fidelia will make available all information reasonably necessary to demonstrate compliance with its obligations.
Audit requests should be submitted in writing to [email protected]. Fidelia will respond to audit requests within 30 days. Where an on-site audit is requested, the parties will agree on the scope, timing, and conditions in advance, and the Controller shall bear the reasonable costs of any such audit.
12. Termination and Data Deletion
This DPA remains in effect for the duration of the Controller's use of the Service. Upon termination of the Service (whether by cancellation, expiry, or breach):
- Fidelia will cease processing Controller data, except as required to fulfil its deletion obligations
- All Controller data will be permanently deleted within 30 days of account closure
- The Controller may request an export of their data at any time prior to deletion
- Data retained for legal or tax compliance purposes (e.g., payment records) will be deleted when the applicable retention period expires
Upon request, Fidelia will provide written confirmation that Controller data has been deleted.
13. Governing Law
This DPA is governed by and construed in accordance with the laws of the Dubai International Financial Centre (DIFC), United Arab Emirates, consistent with the governing law of the Terms of Service. For data subjects in the European Economic Area or the United Kingdom, this DPA does not affect any rights conferred by mandatory data protection legislation in their jurisdiction.
14. Contact
For questions about this Data Processing Agreement, data subject requests, or to request compliance documentation, please contact us:
Email: [email protected]