Personal data processing contract

1 · 1. The parties and how it is signed

This contract is between the clinic that accepts it (“the controller”) and Tsunami Automation Global LLC, with its address at 5900 Balcones Drive STE 100, Austin, TX 78731, United States (“the processor”). It is part of the terms for clinics (/legal/en/terminos-clinicas).

The clinic enters into it by clicking “I accept” in its account, or by signing it. The person who accepts states that they have authority to bind the clinic. If this contract and the terms differ on personal data, this contract prevails.

This text is a template. A lawyer must review it before it is used. It is not a HIPAA agreement: the platform is built for private clinics in Mexico.

Legal basis: Código de Comercio, arts. 89, 89 bis y 93; LFPDPPP (DOF 20-mar-2025), art. 2 fr. XII y XIV

2 · 2. Purpose and instructions

The clinic is the controller of the personal data of its patients and contacts. The processor processes it on the clinic’s behalf, only to provide the Soluciones para Doctores service: scheduling, AI receptionist, reminders, intake forms, patient portal and conversation inbox.

The processor processes the data only on the clinic’s instructions: the terms, this contract, the account settings and the clinic’s written requests. It does not use the data for its own purposes and does not disclose it to anyone, except to its subprocessors or when the law requires it.

If the processor thinks an instruction breaks the law, it tells the clinic. If an authority asks it for the clinic’s data, it tells the clinic, unless the law forbids it. For the processor’s own data (clinic users, visitors, prospects, directory and billing contacts), the processor is the controller and its privacy notice (/privacidad) applies.

Legal basis: Reglamento de la LFPDPPP (2011), arts. 49 a 55; LFPDPPP (DOF 20-mar-2025), art. 2 fr. XII, art. 13

3 · 3. Staff confidentiality

The processor gives access to the data only to people who need it to provide the service. Those people must keep it confidential, also after their relationship with the processor ends.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 20

4 · 4. Security measures

The processor keeps administrative, technical and physical security measures to protect the data against damage, loss, alteration, destruction and unauthorised use or access. These measures are not weaker than those it uses for its own information.

A summary is at /legal/en/seguridad and in Annex B. The processor may update the measures, but may not lower the overall level of protection.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18; Reglamento de la LFPDPPP (2011), arts. 57 a 62

5 · 5. Subprocessors

The clinic gives a general written authorisation for the processor to use subprocessors. The current list is at /legal/en/subencargados and in Annex C.

• Before adding a subprocessor that receives patient data, or changing one, the processor tells the clinic by email and in the application at least 30 calendar days ahead.
• During that time, the clinic may object in writing on data protection grounds. If no solution is found, the clinic may end the service with no penalty.
• The processor requires each subprocessor to meet obligations equivalent to those of this contract, by contract or through the data protection terms of its service. The processor is responsible to the clinic for what its subprocessors do with the data.

To draft replies, the AI receptionist sends a language-model provider the text of the patient’s message and up to 12 earlier turns of the conversation. That text may include health information. This happens before the safety rules decide the final reply. The clinic should reflect this in its privacy notice.

Legal basis: Reglamento de la LFPDPPP (2011), arts. 49 a 55

6 · 6. Hosting outside Mexico and international providers

The application and the database are hosted in Germany. Some subprocessors are in the United States. The processor has its address in the United States and its staff may access the data from outside Mexico.

Under the 2011 Regulation, sending data from the controller to a processor (a “remisión”), domestic or international, needs neither notice to nor consent from the data subject. If the clinic hands data to a third party for that party’s own purposes (for example, a laboratory), that is a transfer and it is the clinic’s responsibility.

The 2011 Regulation cites articles of the previous law. A lawyer must confirm whether it is still in force and how it applies with the 2025 law.

Legal basis: Reglamento de la LFPDPPP (2011), art. 53; LFPDPPP (DOF 20-mar-2025), arts. 35 y 36

7 · 7. ARCO rights

The clinic, as controller, answers requests for access, rectification, cancellation and opposition. It has 20 business days to answer and 15 more business days to carry them out.

• If a data subject writes to the processor, it sends the request to the clinic within 5 business days at most and tells the data subject it did so. The processor does not answer on the merits.
• When the clinic asks, the processor gives it the information or an export of a patient’s data within 5 business days at most, so the clinic can answer in time.
• Cancellation and blocking are a manual procedure: the clinic asks for it in writing at support@tsunamiautomation.com and the processor carries it out in time for the clinic to meet its legal deadline. It says so if it needs more time. The clinic decides whether it may refuse cancellation (for example, because of the clinical record or tax duties).
• Backups keep the data until they are replaced (31 days at most). If there were voice calls, the processor asks the voice provider to delete the audio and the transcript.
• Exercising these rights is free.

Legal basis: LFPDPPP (DOF 20-mar-2025), arts. 21 a 26; LFPDPPP (DOF 20-mar-2025), art. 25 fr. III y VII; LFPDPPP (DOF 20-mar-2025), arts. 28, 31 y 34

8 · 8. Security breaches

If the processor confirms a security breach affecting the clinic’s data, it tells the clinic without undue delay and within 72 hours at most from the time it confirms it. The law sets no number of hours: this period is the processor’s commitment.

• The notice says, as soon as it is known: what happened, which data was affected, when, what measures were taken and who the contact is.
• The processor helps the clinic with the information and records it needs.
• The clinic, as controller, tells data subjects immediately when the breach significantly affects their property or moral rights. The processor does not notify data subjects or the authority on its own, unless the law obliges it.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 19; Reglamento de la LFPDPPP (2011), arts. 63 a 66

9 · 9. Return and deletion at the end

While the account is active, the processor keeps the data until the clinic asks for it to be deleted. Today old messages are not deleted automatically: the clinic decides how long to keep each item. The clinical record must be kept at least 5 years from the last medical act, under NOM-004-SSA3-2012.

When the service ends, the processor delivers an export if the clinic asks for one and deletes the data within 30 calendar days at most from the closing request. This is a manual procedure. If the clinic asks, the processor confirms the deletion in writing.

Backups stop containing the data when they are replaced by newer copies (31 days at most). The processor keeps only what the law requires it to keep, such as its invoicing records (5 years). Before asking to close, the clinic must export any record it has to keep.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 10, art. 12, art. 24; NOM-004-SSA3-2012, numeral 5.4; Código Fiscal de la Federación, art. 30

10 · 10. Information and audits

Once a year, on written request, the processor gives the clinic information about its security measures and its subprocessors, and answers reasonable questionnaires. If there was a breach, the clinic may ask for additional information.

The clinic gives 30 days’ notice. The information is confidential. On-site audits are only done if an authority requires them. Extra requests may have a reasonable cost agreed beforehand.

Legal basis: Reglamento de la LFPDPPP (2011), arts. 57 a 62

11 · 11. Liability

Each party is responsible for breaching this contract and the law. The processor is responsible for its own breaches and those of its subprocessors. The clinic is responsible for its instructions being lawful, for having given its privacy notice, for having the necessary consents and for the quality of the data it enters.

The liability limits in the terms apply to this contract. They do not limit the rights of a data subject, who may claim damages from the controller or the processor, or anything the law does not allow to be limited.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 53

12 · 12. Term and governing law

This contract lasts from acceptance until the processor finishes returning and deleting the data. Confidentiality continues afterwards. It can be changed with 30 days’ notice, like the terms. It is governed by the laws of Mexico and the competent courts of Mexico City.

13 · 13. Acceptance and signature

By clicking “I accept” in the account, the clinic enters into this contract with an electronic signature. If it prefers to sign, it can ask us for a copy to sign at support@tsunamiautomation.com.

Legal basis: Código de Comercio, arts. 89, 89 bis y 93

14 · Annex A. Description of the processing

15 · Annex B. Security measures

16 · Annex C. Subprocessors

This list is kept at /legal/en/subencargados. The booking engine and the error log are run by the processor on its own infrastructure and are not third parties. If another provider is switched on, the list is updated and notice is given beforehand.