Service-provider agreement

1. Roles

This agreement is between [Cedar's legal entity name] ("Cedar") and the clinic that accepts it ("the clinic"), and forms part of Cedar's terms of service.

The clinic is the custodian of, or the organization responsible for, the personal information (including personal health information) about its clients that it puts into Cedar ("Client Information"). Cedar handles Client Information only as the clinic's service provider (an "information manager" or "agent" where the clinic's province's law uses those terms).

2. How Cedar may use Client Information

• Only to provide Cedar to the clinic and as the clinic instructs through its use of Cedar.
• Never for Cedar's own purposes, for marketing, or sold or shared with anyone else.
• Never combined with another clinic's information. Each clinic's data is kept separate, and a client who attends two clinics on Cedar has a separate record at each.
• Disclosed only as this agreement allows, or as the law requires (see section 9).

3. Confidentiality and Cedar's staff

Cedar's staff and contractors who could access Client Information are bound by confidentiality obligations, are trained on them, and have access only as their work requires. In normal operation, Cedar's platform administrators can't open a clinic's client records.

4. Safeguards

Cedar protects Client Information with reasonable security measures, including:

• Hosting in Canada (AWS Canada (Central), Montreal) for the database, files, email, backups and logs;
• Encryption in transit (TLS) and at rest, including backups;
• Two-factor authentication required for every staff login, and session time limits;
• Access by role within the clinic, set by the clinic;
• An append-only audit log of who viewed or changed records, available to the clinic's super admin;
• Signed chart notes that can't be changed, with corrections added as addenda;
• Rate limits and monitoring against unauthorised access; and
• Regular backups.

5. Where Client Information is held

Client Information is stored in Canada. Cedar uses the service providers below. Cedar has a written agreement with each that protects the information at least as well as this agreement, and is responsible for their handling of it. Cedar will give the clinic [30 days'] notice before adding or replacing a provider that handles Client Information.

Stripe receives payment information only, with generic descriptions such as "Clinic services", never health information. SMS messages contain only the clinic's name and the visit's date and time.

6. Breach notification

If Cedar learns of unauthorised access to, or loss or disclosure of, Client Information, Cedar will notify the clinic's incident contact without undue delay and within [72 hours], tell the clinic what is known (what happened, what information and which clients are affected, and what Cedar is doing), contain the breach, and help the clinic meet its own obligations to notify clients and its privacy commissioner.

7. Access and correction requests

If a client asks Cedar for access to or correction of their information, Cedar will pass the request to the clinic promptly and won't answer it directly. Cedar will help the clinic respond, for example by providing a copy of the client's record.

8. Retention, return and deletion

Cedar keeps Client Information for the retention periods the clinic sets to meet its regulators' rules. When the agreement ends, Cedar keeps the clinic's data available read-only for [period], gives the clinic a copy of its data in a documented format, and then securely deletes it, including from backups as they expire.

9. Legal demands

If Cedar receives a court order or other legal demand for Client Information, it will tell the clinic before disclosing anything, unless the law forbids it, and disclose only what is legally required.

10. Audits and information

Cedar will answer the clinic's reasonable questions about its safeguards and give the clinic the information it needs to show that it is meeting its own obligations.

11. Term and contact

This agreement applies while the clinic uses Cedar and for as long afterwards as Cedar holds any Client Information. The clinic accepts it when it opens an account; Cedar records the version, the time and the owner who accepted it. A new version is accepted by the clinic's owner in Cedar.

Cedar's privacy officer: privacy@cedarsuite.ca, [Mailing address].