Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Kashfy ("Kashfy", "we", "us") and the clinic, laboratory, or radiology center that uses the Service (each, the "Clinic"). It applies whenever Kashfy processes personal data on the Clinic's behalf while providing the Service.

It is designed to meet the requirements of the Egyptian Personal Data Protection Law (Law No. 151 of 2020) and its executive regulations, and uses the EU General Data Protection Regulation (GDPR) as a reference standard. If this DPA conflicts with the Terms of Service on the protection of personal data, this DPA prevails.

The Clinic (clinic, laboratory, or radiology center) is the controller. It decides why and how its patients' personal data is processed, and is responsible for having a lawful basis for that processing.

Kashfy is the processor. We process patient personal data only to provide the Service to the Clinic and only on the Clinic's documented instructions, which are given by this DPA, the Terms of Service, and the Clinic's configuration and use of the Service.

For data about the Clinic's own account and staff (sign-in, billing, product analytics), Kashfy acts as an independent controller as described in the Privacy Policy.

Subject matter and duration: providing the Service for as long as the Clinic's account is active, plus the deletion period in Section 11.

Nature and purpose: booking and managing appointments; sending confirmations, reminders and follow-ups; answering patients through the Clinic's AI assistant on WhatsApp, Telegram, Messenger, the website chat, and the patient portal; storing and sharing results, prescriptions and reports; clinic check-in by QR code; and the related administration.

Data subjects: the Clinic's patients and their family members or companions, people who contact the Clinic through the Service, and referring doctors.

Categories of personal data: identification and contact data (name, phone number, age, gender); appointment and visit data; message content, including voice notes, images and documents a patient sends; and health data the Clinic or patient records or shares (such as complaints, diagnoses, prescriptions, lab and imaging results).

Special categories: health data is sensitive personal data. It is processed only as needed for the purposes above.

We process patient personal data only on the Clinic's documented instructions, unless the law requires otherwise; in that case we inform the Clinic first, unless the law forbids it.

We do not sell patient data, use it for advertising, or use it to train AI models. We tell the Clinic promptly if, in our opinion, an instruction breaks applicable data protection law.

To help the Clinic meet its consent obligations, the Service asks each patient for consent before the Clinic's AI assistant processes any message from them. Consent is asked separately for each Clinic, in the chat (WhatsApp, Telegram, Messenger, website chat, patient portal) or as an unticked checkbox on the booking page, portal booking, and QR check-in.

If the patient does not agree, the AI does not process their messages, and they receive the Clinic's phone number to book manually. Messages a patient sends before answering are kept for the Clinic and deleted automatically after 7 days if the patient never answers.

Patients can withdraw consent at any time by sending "إلغاء الموافقة" or "withdraw consent" in the chat. After a withdrawal, automated messages (such as reminders and review requests) stop, staff can only reply inside the 24-hour window the patient opens, and the Clinic receives a task to delete or anonymize the patient's data. The Clinic decides what it must keep under its legal duties, such as keeping medical records.

Every decision (agree, decline, withdraw) is recorded with its time, channel and notice version in an append-only record that the Clinic can rely on as evidence.

We help the Clinic answer patients' requests to access, correct, delete, or object to processing of their data, taking into account the nature of the processing. If a patient sends such a request to Kashfy directly, we forward it to the Clinic without undue delay and do not answer it ourselves unless the Clinic asks us to.

Everyone at Kashfy who can access patient personal data is bound by confidentiality obligations and accesses it only as needed to provide, support, or secure the Service.

We implement appropriate technical and organizational measures, including:

- encryption of data in transit (TLS) and at rest in the database and file storage;

- private file storage, with time-limited signed links for access;

- row-level access controls so each Clinic sees only its own data, and role-based access inside the Clinic;

- encryption of stored credentials for connected channels (such as WhatsApp numbers and Telegram bots);

- verification of incoming webhooks, rate limiting of public endpoints, and logging of system activity;

- an incident response process (Section 10).

The Clinic gives general authorization for Kashfy to use sub-processors. Kashfy currently uses the following:

Data is stored on secure servers in the European Union under GDPR: database, files and the web application servers are all in Frankfurt, Germany (eu-central-1).

Some processing happens outside Egypt and outside the European Union, as shown in Section 8: AI processing and message delivery through Meta (WhatsApp, Messenger) and Telegram, in the United States. Where personal data is transferred outside Egypt, we rely on the transfer mechanisms permitted by applicable law, contractual safeguards with each sub-processor, and the security measures in Section 7.

If Kashfy becomes aware of a personal data breach affecting the Clinic's data, we will notify the Clinic without undue delay and in any case within 48 hours, so the Clinic can meet its own notification duties to the Personal Data Protection Center and to affected patients.

The notice will describe, as far as known at the time, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed. We will take reasonable steps to contain the breach and keep the Clinic informed.

When the Service ends, the Clinic may export its data from the dashboard. Within 30 days after the account is closed, Kashfy deletes the Clinic's patient personal data from the Service, unless the law requires us to keep it. Encrypted backups are overwritten in their normal cycle. Security and access logs (which record who created, changed, or opened a record and when, using record identifiers only and no health data) are kept in write-once storage for one year to protect the integrity of the Service, and are then deleted automatically.

On request, we make available the information reasonably needed to show compliance with this DPA, including the consent records in Section 5. We cooperate with reasonable audits by the Clinic or an auditor it appoints, or by a competent authority, on reasonable notice, at most once a year unless a breach or an authority requires otherwise, and in a way that protects other customers' data and our security.

For anything about this DPA, data protection, or a patient request: privacy@kashfy.site

See also our Privacy Policy and Terms of Service.