This Data Processing Agreement ("DPA") forms part of the agreement between GenNotify ("we", "us") and the clinic using our service ("you", "the Clinic"). It sets out how we handle personal information, including health information, on your behalf while providing the GenNotify service. It's incorporated by reference into our Terms of Service.
If your organisation needs a separately signed or bespoke version of this DPA, contact hello@gennotify.co.nz.
1. Our roles
You are the health agency responsible for your patients' personal and health information under the Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC). GenNotify acts as your agent for the purpose of section 11 of the Privacy Act 2020: we process personal information only to provide the service you've configured (appointment confirmations, reminders, cancellations, intake forms, and related features), and only on your instructions as reflected in your account settings.
We do not use patient information for any purpose other than delivering the service to you, and we do not sell or share it with third parties for marketing purposes.
2. What information we process
The categories of information we process on your behalf are set out in our Privacy Policy, including patient name, contact details, appointment details, and, where you've enabled the intake form, medical history and consent responses submitted by patients.
3. Subprocessors
We use the following subprocessors to provide the service:
- Postmark (Wildbit LLC) - transactional email delivery of appointment and intake communications.
- Stripe - payment processing for your GenNotify subscription. Stripe does not receive patient information.
- Hetzner Online GmbH - infrastructure hosting (EU, Germany). See section 5 for our position on offshore storage.
- Cloudflare - DNS for our website and application domains.
Gensolve is your own practice management system, not a GenNotify subprocessor - we connect to it using credentials you provide, under your existing agreement with Gensolve.
We'll give you reasonable notice by email before adding or replacing a subprocessor that will handle patient information, so you can raise any objection.
4. Security measures
We maintain security measures appropriate to the sensitivity of the information we process, including encryption of practice management system credentials at rest, encryption of data in transit (TLS), signed and encrypted patient intake links, and signature verification on all inbound webhooks. Further detail is in our Privacy Policy. We review and improve these measures on an ongoing basis.
5. Location of data
Our infrastructure is hosted in the European Union (Germany), on a provider subject to EU data protection law (GDPR). We consider this to provide comparable safeguards to those required under the Privacy Act 2020 for information disclosed or stored outside New Zealand. We're happy to discuss this further if your organisation has a specific data residency requirement.
6. Notification of a privacy breach
If we become aware of a privacy or security breach affecting your patients' personal information, we'll notify you without undue delay, and in any case within 48 hours of confirming the breach, with the information available to us at the time. We'll provide reasonable assistance so you can meet your own notification obligations under the Privacy Act 2020, including to the Office of the Privacy Commissioner and affected patients where required.
7. Assisting with patient rights requests
If a patient asks you to access, correct, or delete information we hold on your behalf, contact hello@gennotify.co.nz and we'll help you respond promptly.
8. Retention and deletion
We retain information for as long as your account is active, as described in our Privacy Policy. When your account is closed, we delete patient information from our production systems immediately, subject to removal from backups on our normal backup rotation schedule. Account-level details such as your clinic name and administrator contacts are removed within 90 days.
9. Due diligence
On reasonable request, we'll provide information about our security and privacy practices to help you assess your own compliance obligations. Contact hello@gennotify.co.nz.
10. Term and governing law
This DPA applies for as long as our Terms of Service apply to you. It's governed by New Zealand law. For any questions, contact hello@gennotify.co.nz.
Frequently asked questions
How does GenNotify protect patient data?
Passwords are hashed (bcrypt), never stored in plain text. Practice management system credentials and patient intake form content are encrypted at rest. All traffic runs over HTTPS/TLS. Patient intake form links are both cryptographically signed and encrypted. Every inbound webhook is authenticated before it is processed. Admins can also turn on two-factor authentication for their account.
How do you manage access to our data?
Access requires an authenticated account, with rate limiting on login and password-reset endpoints, and optional two-factor authentication. We keep the number of GenNotify staff with production data access to a minimum needed to operate and support the service.
Where is our data physically stored?
On infrastructure hosted in the European Union (Germany), subject to EU data protection law (GDPR). See section 5 above for our position on why we consider this a comparable safeguard under the Privacy Act 2020.
Which third parties can access our data?
Only the named subprocessors in section 3 above (Postmark, Stripe, Hetzner, Cloudflare), each limited to the specific purpose listed. We do not sell or share your data with anyone for marketing purposes.
How long do you keep patient data, and can we ask for it to be deleted?
We retain data for as long as your account is active. Patient records are deleted from our production systems immediately when you close your account, subject to removal from backups on our normal rotation schedule. You can also ask us to action a specific patient's access or deletion request at any time.
Which privacy regulations does GenNotify comply with?
The New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC). See our Privacy Policy for the full detail.
Do you carry professional indemnity or cyber liability insurance?
We assess our insurance needs on an ongoing basis as the business grows. Contact hello@gennotify.co.nz to discuss your specific requirements.
What happens if there's a data breach?
We notify affected clinics without undue delay, and in any case within 48 hours of confirming a breach (see section 6 above), with reasonable assistance so you can meet your own obligations under the Privacy Act 2020.