Data Processing Agreement
Last updated: October 15, 2026 (Section 5.1 now states the new use of Cloudflare and Google for insurer notices, and the last sentence of Section 5.2 was replaced; Section 4.4 was added on October 5 on AI assisted engineering tools; Sections 1.2, 3.2, 4 and 5 were corrected on October 4, 2026 to match how NTL operates). Bracketed items like [CLINIC LEGAL NAME] are filled in per clinic when this agreement is executed as part of onboarding.
This Data Processing Agreement (“DPA”) is entered into between:
NTL Learning Solution Inc. (“NTL”), operator of MyTCM, and
[CLINIC LEGAL NAME] (“Clinic”),
(together, the “Parties”) and forms part of the Terms & Conditions governing the Clinic’s use of MyTCM (the “Service”).
1. Roles of the parties
1.1 For patient, clinical, appointment, and billing data entered into the Service (“Clinic Data”), the Clinic is the data controller and NTL is a data processor / service provider, within the meaning of British Columbia’s Personal Information Protection Act (“PIPA”).
1.2 The Parties acknowledge that MyTCM is provisioned as a dedicated instance: the Clinic’s own hosting account (Cloudflare) and database account (Supabase) hold the Clinic Data, and those accounts belong to the Clinic. Clinic Data is held in the Clinic’s own accounts, not in a database shared with other clinics. However, NTL keeps technical credentials for each Clinic’s instance in its own administration system and uses them to provision, update, repair, back up, migrate and support the Service (Sections 3 and 4). NTL therefore has the technical means to reach the Clinic’s live data after provisioning, and the Clinic accepts this as part of the Service. NTL limits and records that access as set out in Section 4.
1.3 NTL’s privacy officer is Oscar Poon (support@mytcm.ca). The Clinic should send privacy questions and requests about the Service to that address.
2. Subject matter, duration, and purpose
2.1 Subject matter: provisioning, technical support, and maintenance of the Clinic’s dedicated MyTCM instance.
2.2 Duration: for as long as the Clinic maintains an active subscription, plus any period required to fulfill data-return or deletion obligations under Section 6.
2.3 Purpose and nature of processing: initial technical setup of the Clinic’s dedicated hosting and database accounts; software updates and bug fixes to the MyTCM application; technical support and maintenance access under the limits in Section 4; transcription of dictated clinical notes via NTL’s sub-processor (Section 5).
2.4 Categories of data subjects: the Clinic’s patients, and the Clinic’s own practitioners/staff (as system users).
2.5 Categories of personal information: as described in the MyTCM Privacy Policy and Privacy Impact Assessment: patient identifying information, clinical/health information, appointment and billing records, and consent records.
3. Onboarding and provisioning
3.1 NTL will provision the Clinic’s dedicated Service instance using account credentials either (a) provided by the Clinic, or (b) created by NTL on the Clinic’s behalf and handed over to the Clinic promptly upon completion of setup.
3.2 After handoff, NTL keeps the technical credentials it needs to operate the Service for the Clinic, such as the database service key, hosting and update tokens, and the passphrase for the encrypted nightly backup. NTL stores these credentials encrypted, keeps only what the Service needs, restricts who can use them (Section 4), and revokes or deletes them when the Clinic leaves the Service. NTL does not keep a copy of any personal password the Clinic’s staff use to sign in to the Service.
3.3 The Clinic is responsible for securing the credentials once received, including changing any password NTL may have set during account creation.
4. Support access
4.1 After initial provisioning, NTL accesses the Clinic’s live Service instance in two ways: (a) automated and administrator-run operations that the Service needs, namely software updates, repairs, backup set-up and checks, and configuration sync, which use the stored credentials described in Section 3 and run without a separate request from the Clinic; and (b) support, migration or data work that the Clinic requests. NTL will not read or change Clinic Data except as these operations or a Clinic request require.
4.2 Access to the stored credentials is limited to named NTL administrator accounts, which sign in with a passkey or an emailed one-time code. NTL will keep that list short and will use time-limited or revocable credentials for any access that does not need to be continuous.
4.3 NTL records administrative actions such as updates, repairs and set-up, and each time a stored credential is revealed, in an action log, and will give the Clinic the entries that relate to its instance on request. The log does not record every access, and NTL does not represent that it does.
4.4 NTL staff use AI assisted engineering tools with administrator access. While an engineer or tool works on the Service, information it reads (which may include Clinic Data) can be processed by the tool’s provider under that provider’s terms. NTL limits this use to what the work requires and records each use in a written log.
5. Sub-processors
5.1 The Clinic authorizes NTL’s use of the following sub-processors as part of the Service, each engaged only for the purpose stated:
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Supabase | Clinic’s own database, authentication, and backend functions | All Clinic Data (held in the Clinic’s own Supabase project, Canadian region by default) |
| Cloudflare | Hosting and content delivery for the Clinic’s own application instance; Workers AI as a fallback for translation; and, as a new use from October 2026, Email Routing and Workers that read the insurer notices a Clinic forwards to NTL | No Clinic Data at rest. Clinical note text, with identifiers removed, when the translation fallback is used. For insurer notices: claim and reference numbers, patient initials, amounts and decisions, and the email subject line pass through in transit; the email itself is not stored by NTL |
| AWS S3 | Storage of patient files attached by the Clinic | Files attached to patient records, stored in Canada (Montreal, with a backup copy in Calgary) |
| Square | Point-of-sale card payment processing, if used by the Clinic | Payment transaction data; card numbers are handled by Square directly |
| Deepgram | Real-time transcription of dictated clinical notes | Audio is processed transiently; the provider states it does not retain the audio after transcription |
| DeepSeek | AI translation of clinical notes | Clinical note text, free text only, with identifiers removed before it is sent |
| Twilio | SMS appointment confirmations and reminders | Patient phone numbers and message text |
| Resend | Email confirmations, reminders, receipts and staff alerts | Recipient email addresses and email content |
| Calendar sync to a practitioner’s own Google account; encrypted nightly backup files stored in the Clinic owner’s own Google Drive; and, as a new use from October 2026, forwarding of insurer notices from the Clinic’s own Gmail account to NTL | Appointment details; an encrypted backup file; the insurer email as it was before forwarding | |
| Apple (iCloud Calendar) | Optional calendar sync, for practitioners who use it | Appointment details |
| GitHub | Runs the nightly backup job, which holds a copy of the database while it encrypts it before upload | A full copy of the Clinic database, for the length of the job |
5.2 NTL will give the Clinic at least 30 days’ written notice before adding or replacing a sub-processor that would materially change how Clinic Data is handled, and the Clinic may object on reasonable privacy grounds within that period. If the parties cannot resolve the objection, the Clinic may end the Service without penalty. The list in section 5.1 is current as of the October 15, 2026 revision. The notice in this section applies to every sub-processor added or replaced after that revision.
5.3 Several of the sub-processors above are US companies, or process information in the United States or on global networks. Information handled there may be subject to the laws of that country, and its courts, law enforcement and national security authorities may be able to obtain it. The Clinic’s own database and patient files are stored in Canada. Encrypted backups are kept in the Clinic owner’s Google Drive, whose location is set by that Google account, and a temporary copy exists on GitHub’s US servers while the nightly backup runs. NTL is confirming each sub-processor’s processing region and contract terms.
6. Data location, return, and deletion
6.1 The Clinic’s Supabase project region is selected during provisioning. For BC clinics, the default is a Canadian region.
6.2 On termination of the Service, NTL will provide reasonable assistance for the Clinic to export its Clinic Data in a usable format.
6.3 Because Clinic Data resides in the Clinic’s own infrastructure accounts, the Clinic retains direct control over deletion timing and is responsible for complying with its own retention obligations (Section 8) before deleting any data.
7. Security
7.1 NTL will provision the Service with industry-standard technical safeguards, including encryption in transit, access controls, and row-level security scoping (where applicable to the Clinic’s configuration).
7.2 In the event NTL becomes aware of a security incident affecting Clinic Data, NTL will notify the Clinic without undue delay, and will cooperate with the Clinic’s own breach-assessment and notification obligations under PIPA.
8. Clinic’s own regulatory obligations
8.1 The Clinic acknowledges it remains solely responsible for its own compliance with applicable health-information, privacy, and professional-regulatory requirements, including but not limited to:
- Retention of patient health care records, appointment logs, and billing records for the period required by its regulatory college (currently a minimum of 16 years from the date of last entry, or from the age of majority, whichever is later, under CCHPBC’s Professional Standard: Record-Keeping, for BC TCM/acupuncture licensees; the Clinic should confirm current requirements directly with its college);
- Obtaining and documenting patient informed consent;
- Notifying patients and/or its college of any transfer of records on practice closure or transfer, where applicable.
8.2 Nothing in this DPA or the Service relieves the Clinic of these obligations; the Service is a tool to help the Clinic meet them, not a substitute for the Clinic’s own compliance program.
9. Term and termination
This DPA remains in effect for as long as the Terms & Conditions between the Parties remain in effect, and survives termination with respect to any ongoing data-return, deletion, or confidentiality obligations.
10. Governing law
This DPA is governed by the laws of British Columbia, Canada.
11. Data Migration Services
11.1 Migration Services & Right of Refusal. If the Clinic elects to use NTL’s Data Migration Service (“Migration Service”) to transfer existing historical data (including Personal Health Information) from a legacy system or third party into the Clinic’s MyTCM instance, NTL will perform such services subject to the payment of applicable migration fees. NTL reserves the explicit right, at its sole discretion, to decline, pause, or permanently unwind the Migration Service without penalty or breach of this Agreement if NTL reasonably suspects the provided files contain unauthorized Personal Health Information, co-mingled records belonging to a third-party clinic, or if the data substantially deviates from the format and scope represented by the Clinic prior to migration.
11.2 Clinic Representations and Consents. The Clinic represents and warrants that it possesses all necessary rights, legal authority, and explicit patient consents required under applicable privacy laws (including but not limited to PIPA) to extract its historical data and transfer it to NTL. The Clinic is solely responsible for providing any required statutory notices to patients regarding the transfer of their records to a new service provider.
11.3 “As-Is” Migration Disclaimer. The Migration Service is provided strictly on an “AS-IS” and “AS-AVAILABLE” basis. While NTL will use commercially reasonable efforts to map and import the provided files, NTL explicitly disclaims all implied warranties regarding the Migration Service, including but not limited to warranties of accuracy, completeness, or seamless interoperability of the legacy data within the Service. The Clinic is solely responsible for verifying the accuracy and integrity of all migrated Clinic Data upon completion.
11.4 Indemnification by the Clinic. The Clinic shall indemnify, defend, and hold harmless NTL, its affiliates, directors, and employees from and against any and all third-party claims, damages, liabilities, costs, and expenses (including reasonable legal fees) arising from or related to (a) the Clinic’s breach of Section 11.2; (b) the underlying legality, accuracy, or authorization of the historical data provided to NTL; or (c) any regulatory investigation, inquiry, or enforcement action (including by the BC Office of the Information and Privacy Commissioner) resulting from the Clinic’s failure to obtain lawful consent for the data transfer.
11.5 Limitation of Liability for Migration Services. Notwithstanding anything to the contrary in this Agreement, NTL’s total, aggregate liability arising out of or in connection with the Migration Service – whether in contract, tort (including negligence), or otherwise – shall not exceed the total amount of fees actually paid by the Clinic specifically for the Migration Service. This cap operates independently of any other liability caps in this Agreement. However, this limitation shall not apply to damages resulting directly from NTL’s gross negligence, willful misconduct, or fraud.
11.6 Audit Trail and Agreement Alignment. For the avoidance of doubt, all data handling, extraction, and formatting performed by NTL personnel during the Migration Service constitutes processing under this Agreement. NTL shall apply the record-keeping described in Section 4.3 to all Migration Service activities, so that NTL keeps a record of its access to the Clinic’s historical data prior to it becoming live Clinic Data.
Signed for NTL Learning Solution Inc.: ______________________ Date: __________
Signed for [CLINIC LEGAL NAME]: ______________________ Date: __________