Data Processing Agreement

For personal information you enter about your clients and their families (“Customer Personal Information”), your practice decides what is collected and why, and remains the organization accountable for that information under Canadian privacy law, including when it is transferred to us for processing. DoulaOne is a third-party service provider that handles it on your behalf and only to provide the Service to you. This DPA is the contractual means by which we provide a comparable level of protection while the information is in our care.

DoulaOne is separately responsible for your own account, billing, support, and inquiry information, as described in our Privacy Policy.

Where you record information on behalf of another organization, we handle it as that organization's downstream provider through you, and you remain responsible to them for our involvement.

We handle Customer Personal Information only on your instructions, as set out in this DPA and the Terms, unless we are required to do otherwise by law (in which case we will tell you where we are legally permitted to). Your use of the platform's features constitutes your instructions.

We will not use, disclose, or retain Customer Personal Information for our own purposes, will not sell it, will not use it for advertising or profiling, and will not use it to train artificial intelligence or machine learning models.

• Subject matter: provision of the DoulaOne practice-management platform.
• Duration: the term of your account, plus the limited retention described in Section 11.
• Purpose: storing, organizing, displaying, transmitting, and deleting Customer Personal Information so the Service works for you.
• Types of information: contact details, due dates, appointments (including the time zone a family chose when they booked), care notes, birth preferences, contracts and e-signatures (including signer IP address and browser/user-agent captured for signature audit), intake responses, invoices, receipts and payment references, email consent and unsubscribe status, messages, and uploaded documents.
• Individuals: your clients, their partners, family members, and emergency contacts.
• Sensitive information: health information about pregnancy, birth, and postpartum care that you choose to record.

You are responsible for:

• Identifying your purposes and collecting only what is necessary for them, and obtaining meaningful consent — express consent for health information and other sensitive information.
• Telling your clients that their information is stored in a practice-management platform and handled outside Canada (see Section 8).
• If your practice is in Quebec, completing the privacy impact assessment required before personal information is communicated outside Quebec, and any other obligations under Quebec's private-sector privacy law.
• The accuracy, completeness, and relevance of what you record, and for responding to your clients' access and correction requests.
• Ensuring your instructions to us comply with Canadian privacy law, CASL, and any other law that applies to your practice.
• Managing who in your workspace can see what, including team access, backup access, and owner-only notes.

We ensure that personnel authorized to handle Customer Personal Information are bound by appropriate confidentiality obligations and access it only as needed to provide and support the Service.

We protect Customer Personal Information with physical, organizational, and technological safeguards appropriate to its sensitivity, including:

• Row-level security isolating each workspace's data
• Private, access-controlled file storage with signed URLs
• Encryption in transit (HTTPS/TLS) and encryption at rest
• Server-side authentication, session controls, and idle logout
• Owner-only access controls for sensitive notes
• Consent-gated, reduced access for backup practitioners
• Restricted access to production systems and secrets

You authorize us to engage the providers below to help deliver the Service. Each is bound by written terms requiring it to protect the information and handle it only on our instructions.

• Supabase— database, authentication, and file storage (European Union, Paris region)
• Vercel— application and website hosting
• Brevo— transactional and (where recipients opt in) marketing email delivery
• Stripe— subscription billing, and card processing on the Stripe account you connect for online client payments. Where those payments are charged on your own Stripe account, Stripe is your payment processor and we store payment references only.
• Mapbox— map display on public directory pages
• Google— optional Sign-in and Calendar / Meet integration (only if you connect it)
• Zoom— optional meeting links for appointments (only if you connect it)
• Calendly— optional booking import (only if you connect it)
• OpenAI— optional AI assists (only if a workspace owner enables them). When enabled, the content you choose to process is sent to OpenAI to generate a draft you review, which may include health information. OpenAI does not use data submitted through its API to train its models.

We will give notice of any intended addition or replacement of a provider by updating this page and, where you have subscribed to notices, by email. You may object on reasonable privacy grounds by contacting contact@doulaone.com; if we cannot accommodate your objection, you may stop using the affected feature or terminate.

Customer Personal Information is held outside Canada. The system of record is in the European Union (Supabase, Paris region) and DoulaOne is operated from the United Kingdom. The providers in Section 7 may also handle information in other countries, including the United States. While it is outside Canada, the information is subject to the laws of the country where it is held and may be accessible to that country's courts, law enforcement, and national security authorities.

We protect information transferred to our providers through written agreements requiring them to protect it, handle it only on our instructions, and keep it confidential.

Quebec.On request, we will provide the information reasonably available to us that you need to complete a privacy impact assessment for communicating personal information outside Quebec — including where data is held, the providers involved, and the safeguards described in this DPA — and this DPA serves as the written agreement for that communication.

You must tell your clients about this before you enter their information. If you require Canadian data residency, contact us before storing client information in the Service.

Taking into account the nature of our role, we will give you reasonable assistance to respond to your clients' requests to access, correct, or (in Quebec) receive a portable copy of their information, and to privacy complaints, within the time limits that apply to you. In-product tools cover most cases: you can view and edit records, export your full workspace as JSON, and delete individual clients or your whole account.

If an individual contacts us directly about Customer Personal Information, we will, where permitted by law, refer them to you or forward the request to you rather than responding ourselves.

We will notify you without undue delay after becoming aware of a breach of security safeguards involving Customer Personal Information — including unauthorized access to, disclosure of, or loss of it — and will give you the information reasonably available to us about what happened, when it happened, the kinds of information involved, and the steps we are taking to reduce the risk of harm.

We will cooperate with you so you can determine whether the breach creates a real risk of significant harm (or, in Quebec, a risk of serious injury), report it to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or the Office of the Information and Privacy Commissioner of Alberta as required, notify affected individuals, and keep the breach records the law requires. You are responsible for making those decisions and notifications for information you are accountable for. Notice of an incident is not an admission of fault or liability.

You can export and delete Customer Personal Information through the platform at any time. On termination of your account, we will delete or return Customer Personal Information within a reasonable period, except where retention is required by law. Backups are deleted on our routine backup-expiry cycle.

You are responsible for determining and meeting your own record-keeping obligations, including any professional, insurance, tax, or provincial health-records requirements that apply to your practice, before you delete records.

We may create and retain aggregated or de-identified data that no longer identifies any individual (for example, statistical or performance insights), and may continue to use it after termination to operate and improve the Service. This is not Customer Personal Information.

We will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior request and subject to confidentiality, respond to your privacy and security inquiries. Where available, third-party certifications or reports from our providers may be used to satisfy those inquiries.

DoulaOne is administrative software. We are not a health care provider, we do not provide clinical care, and this DPA does not make us a party to any care relationship between you and your client.

Some provinces have health-information laws — for example, Ontario's Personal Health Information Protection Actand Alberta's Health Information Act— that apply to health information custodians and their agents or service providers. You are responsible for determining whether those laws, or your certifying organization's standards, apply to your practice and for meeting them. Contact us before storing client information if your obligations require controls or terms we do not currently offer.

If your processing also involves personal data protected by the EU or UK GDPR — for example, clients located in the United Kingdom or Europe — our GDPR Data Processing Agreement applies to that data in addition to this DPA, including its international-transfer safeguards.

We may update this DPA from time to time to reflect changes in the Service, our providers, or legal requirements. We will post the revised version on this page and update the effective date, and for material changes will provide notice through the Service or by email where appropriate.

This DPA is subject to the limitations and exclusions of liability set out in the Terms, which are themselves subject to any provincial consumer protection law that cannot be excluded. If there is a conflict between this DPA and the Terms regarding the handling of Customer Personal Information, this DPA prevails.

For privacy inquiries, information for a privacy impact assessment, objections to a service provider, or to request a signed copy of this DPA:

contact@doulaone.com

See also our Privacy Policy and Terms of Service.