Data processing agreement for Jentra Clinic

This agreement is between Jentra Labs Sdn. Bhd. (202601044573 (1706668-M)) ("Jentra") and the organisation that subscribes to Jentra Clinic ("the Customer"). It goes with the Jentra Clinic subscription terms. The Customer accepts it when it joins Jentra Clinic or subscribes to it. A larger customer may sign it with an order form instead.

1. 01

   What this agreement covers

   • 1.1 Jentra processes personal data for the Customer when it runs Jentra Clinic ("the App"). Annex 1 lists the people, the data and the purpose.
   • 1.2 The Customer is the data user under the PDPA. It decides why and how the data is used. Jentra is the data processor.
   • 1.3 If this agreement and the subscription terms differ on personal data, this agreement applies.
2. 02

   Jentra's duties

   • 2.1 Jentra processes the data only to run the App, and only on the Customer's documented instructions. The subscription terms and the App's settings are those instructions.
   • 2.2 Jentra does not use the data for its own purposes, sell it, or use it to train AI models.
   • 2.3 Jentra staff who can reach the data are bound to keep it confidential. They open the data only to give support the Customer asks for, or to fix a fault that stops the App working.
   • 2.4 Jentra keeps the security measures in Annex 3.
   • 2.5 Jentra tells the Customer at once if it believes an instruction breaks the PDPA.
3. 03

   Sub-processors

   • 3.1 The Customer agrees to the sub-processors in Annex 2.
   • 3.2 Jentra tells the Customer at least 30 days before it adds or replaces a sub-processor. The Customer may object on reasonable data protection grounds. If the parties cannot agree, the Customer may end the subscription and receive a refund of the full months not yet started.
   • 3.3 Jentra binds each sub-processor to data protection duties no weaker than these, and stays responsible for them.
4. 04

   Data outside Malaysia

   • 4.1 Annex 2 shows where each sub-processor stores or processes the data.
   • 4.2 Jentra transfers data outside Malaysia only as Annex 2 shows, and only on a lawful basis under section 129 of the PDPA.
5. 05

   Data breaches

   • 5.1 Jentra tells the Customer without undue delay, and within 24 hours of becoming aware, of any breach that affects the Customer's data.
   • 5.2 The notice says what happened, what data and how many people are affected, what Jentra has done, and who to contact.
   • 5.3 Jentra helps the Customer notify the Commissioner and the affected people within the times the PDPA requires.
6. 06

   Requests from individuals

   • 6.1 Jentra passes to the Customer any request it receives from a person about their data, and does not answer it without the Customer's instruction.
   • 6.2 Jentra helps the Customer answer requests to see, correct or delete data, through the App's features or by hand.
7. 07

   Return and deletion

   • 7.1 The Customer may have a copy of its data at any time while the account is active or locked, and when the subscription ends. The owner exports the data in the App.
   • 7.2 Jentra deletes the Customer's data within 90 days after the account locks, after written notice, unless the law requires Jentra to keep it. Backups expire within a further 14 weeks.
   • 7.3 Payment receipts and invoices are kept for 7 years under tax and company law.
8. 08

   Checks

   • 8.1 Jentra gives the Customer the information it reasonably needs to show compliance with this agreement.
   • 8.2 The Customer may audit once a year, with 30 days of notice, at its own cost, in a way that does not reach other customers' data.
9. 09

   Term

   This agreement runs for as long as Jentra holds the Customer's data.

10. Annexes

11. A1

    Annex 1. The processing

    • People: clinic owners, staff and locums.
    • Data: names, phone numbers, emails, MMC numbers, rates, shifts, leave and payment receipts.
    • Sensitive data: none.
    • Purpose: rostering and staff management.
    • Jentra Clinic does not take patient data.
12. A2

    Annex 2. Sub-processors

    • Google Cloud (Firebase) stores the data and runs the App. Where: asia-southeast1 (Singapore).
    • Firebase Authentication handles sign-in. Where: Google processes sign-in data only in the United States.
    • Cloudflare runs jentra.my and its forms. It forwards email sent to jentra.my addresses without storing it. Where: Cloudflare's global network.
    • Gmail (Google) receives and keeps Jentra's email with customers. Where: Google's data centres. Gmail does not limit them to one country.
    • Brevo sends Jentra's email. Where: the European Union (France, Germany and Belgium).
    • Anthropic runs the AI assistant that helps Jentra sort its email and draft replies. Jentra staff check each reply before sending it. Where: outside Malaysia, mainly the United States.
13. A3

    Annex 3. Security measures

    • Each user signs in. Access follows the user's role.
    • Database rules keep each customer's data separate.
    • Google Cloud encrypts the data in transit and at rest.
    • Secret keys are kept in a secret manager, never in the App's code.
    • Jentra Clinic console staff cannot read clinic personal data.
    • Jentra staff who handle the data have a written confidentiality duty.