Data Processing Agreement

Effective date: [EFFECTIVE DATE]

This agreement is between [COMPANY LEGAL NAME] ("we") and the care home or agency ("you") whose staff use Havaspot under the Terms of Service. It forms part of those terms.

US law does not require an agreement like this for most businesses, but it sets out plainly how we treat information you put in the Service. [COUNSEL TO CONFIRM WHETHER ANY STATE LAW, OR UK OR EU LAW, REQUIRES SPECIFIC TERMS FOR SOME CUSTOMERS.]

Roles

• Account information about your staff (names, emails, phone numbers): we decide how it is used, as described in the Privacy Policy.
• Content your staff put in the Service (listings, photos, messages, check-in contacts): we handle it on your behalf, only to provide the Service. Under state privacy laws we act as your service provider; under UK or EU law, as your processor.

Our commitments

• We use your content only to run, secure and support the Service, and as the law requires. We do not sell it or use it for advertising.
• Our staff who can see your content are bound to keep it confidential, and see it only to do their jobs, such as answering a message for a home.
• We keep reasonable security measures in place, including access rules on every database table, encrypted connections, and limited staff access.
• We tell you without undue delay, and within [NOTIFICATION PERIOD], after we confirm a security breach that affects your content.
• We help you answer requests from people about their information, where we can.
• When you close your account we delete or return your content within [DELETION PERIOD], except where the law requires us to keep it.

Subprocessors

We use these providers to run the Service:

• Supabase: database, sign-in and file storage.
• Cloudflare: hosting and network delivery.
• Resend: email delivery.
• PostHog: product measurement.
• Apple iMessage: check-in text messages.

We will tell you [NOTICE PERIOD] before adding a new subprocessor, and you may object. [DATA HOSTING REGION: CONFIRM WHERE EACH PROVIDER STORES DATA.]

Your commitments

• You have the right to give us the information your staff put in the Service, including any contact details for check-in texts, and you have any consent needed for us to text those contacts.
• You do not put resident or patient information in the Service, as the Acceptable Use Policy says.

Health information

Havaspot is not designed to store protected health information and we do not sign business associate agreements under HIPAA for it. [COUNSEL TO CONFIRM.] If you need one, contact us before using the Service for anything beyond what this agreement covers.

Audits

On reasonable written request, no more than once a year, we will answer written questions about how we protect your content. [COUNSEL TO SET AUDIT TERMS.]

Liability and conflicts

Liability under this agreement is subject to the limits in the Terms of Service. If this agreement and the Terms conflict about personal information, this agreement wins.

Contact: [CONTACT EMAIL].