Data Processing Agreement

This Data Processing Agreement ("DPA") governs the processing of personal data by KeepTrack Technologies LLC ("KeepTrack") on behalf of its customers in connection with the KeepTrack dental practice management platform.

This DPA applies when KeepTrack processes personal data on behalf of a customer as a data processor. It supplements the main Terms of Service and governs all processing activities carried out in the provision of the platform.

• Personal data is processed only for specified, explicit, and legitimate purposes
• Processing is limited to what is necessary for those purposes
• Data is kept accurate and up to date
• Data is not retained longer than necessary
• Data is protected against unauthorized access, loss, or destruction

Customers acting as data controllers are responsible for ensuring a valid legal basis for processing personal data and for providing appropriate privacy notices to data subjects.

• AES-256 encryption for stored data
• TLS 1.3 encryption for data in transit
• Role-based access controls and multi-factor authentication
• Regular security audits and vulnerability assessments
• Incident response and breach notification procedures

KeepTrack may engage sub-processors to assist in delivering its services. Customers will be notified of material changes to approved sub-processors.

• Amazon Web Services - cloud infrastructure
• Stripe - payment processing
• Twilio - communication services

Data may be transferred to and processed in countries outside the European Economic Area. KeepTrack implements appropriate safeguards, including Standard Contractual Clauses, for all such transfers.

KeepTrack will assist customers in fulfilling data subject requests, including rights of access, rectification, erasure, and data portability within applicable timeframes.

Customers may request a signed copy of the full Data Processing Agreement by contacting: