Scope
These data processing terms form part of the terms of service. They apply to the patient information a practice records in MedBoox and to the WhatsApp messages MedBoox sends to those patients.
The practice decides which patients it records, what it records and which messages are sent. MedBoox processes that information on the practice’s behalf, only to provide the service and as the practice instructs through its use of MedBoox.
What MedBoox processes
- Categories of people: the practice’s patients, and the people who use the practice’s account.
- Information: name, WhatsApp number, date of birth, language, tags, agreement to WhatsApp messages, appointments and their status, fees and payments, and, if the practice uses them, encrypted session notes and attached files; WhatsApp messages sent, their delivery status and the patients’ replies.
- Purposes: scheduling and reminding patients of their appointments, keeping the practice’s patient files and payments, and giving the practice support.
- Duration: for as long as the practice uses MedBoox, then as described under “End of the service”.
MedBoox’s commitments
MedBoox:
- uses the information only to provide the service to the practice, never for its own purposes, advertising or sale;
- keeps it confidential and ensures that its staff and providers who may access it are bound by confidentiality;
- protects it with measures suited to the risks (Law 81/2018, Article 93): encrypted connections, two-step sign-in, encryption of session notes and uploaded files, separation of each practice’s data, access restricted to what each person needs, regular backups and server protection;
- helps the practice answer patients who ask to see, correct or delete their information, so that the practice can reply within the ten days the law provides (Articles 99 to 101), including by providing an intelligible copy of encrypted notes;
- tells the practice without undue delay, and where possible within 72 hours, after becoming aware of a security incident affecting its patients’ information, and helps it respond;
- gives the practice, on request, the information reasonably needed to show that these commitments are met.
Providers MedBoox uses
The practice agrees that MedBoox uses the providers below. MedBoox requires each to protect the information and only gives them what they need. MedBoox will tell the practice at least [30] days before adding or replacing a provider, so it can object.
| Provider | Role | Location |
|---|---|---|
| Code S.A.R.L | Servers, database and backups | France |
| Meta Platforms (WhatsApp Business Platform, Cloud API) | Delivers WhatsApp messages and their replies | Including outside Lebanon |
| Google (Google Workspace) | Sends emails (sign-in codes, invitations, notices) | Including outside Lebanon |
| CrowdStrike | Server protection | [Region] |
Some of these providers process information outside Lebanon. The practice informs its patients of this, for example with the patient notice.
The practice’s commitments
The practice records patients’ information lawfully and only as needed, informs its patients, obtains their explicit agreement where the law requires it (in particular for health information and WhatsApp messages), and gives MedBoox only lawful instructions.
End of the service
When the practice’s licence ends and is not renewed, its workspace turns read-only and MedBoox keeps its information until it closes the practice, emailing its doctors the date. The practice can export it for [30] days after closing; MedBoox then deletes it. Copies in backups are removed within [90] days. The practice can also delete a patient’s whole file itself at any time.
Draft for legal review. Items in [brackets] must be completed before launch.