← Frontdesk Agents

Data Processing Agreement (GDPR Art. 28)

Last updated: 17 October 2026, version 1.0

Between the Clinic identified at checkout ("Controller") and Andrés Martínez Gómez, trading as Frontdesk Agents, Avda. de la Fama, 19, 30008 Murcia, Spain, hello@frontdeskagentshq.com ("Processor"). This DPA forms part of the Terms of Service and Pilot Terms ("Main Agreement").

1. Subject matter, duration, nature and purpose

• Subject matter: Processor provides an AI front-desk service: it answers patient calls and messages, answers FAQs, and books, reschedules or cancels appointments.
• Duration: the term of the Main Agreement, plus the deletion period in §10.
• Nature: collection, recording, transcription, storage, structuring, retrieval, transmission to the Controller's systems, deletion.
• Data subjects: the Controller's patients, prospective patients, callers and their representatives, and the Controller's staff.
• Personal data (patients): name, phone number, requested service and appointment date/time only, plus the call audio, transcripts and messages in which these are exchanged.
• Health data minimisation: the agent is designed to refuse and not ask for health details (symptoms, diagnoses, medical history, reason for visit) and not to collect date of birth. The requested service and the fact of an appointment with a clinic may still reveal health-related information, and patients may volunteer details. The parties therefore treat the data as potentially special-category data (GDPR Art. 9). The Controller is responsible for a valid Art. 9 condition and for patient notices.

2. Instructions

Processor processes personal data only on the Controller's documented instructions: this DPA, the Main Agreement and the configuration the Controller sets, including with regard to transfers, unless Union or Member State law requires otherwise, in which case Processor informs the Controller unless the law prohibits it. Processor tells the Controller immediately if it believes an instruction infringes data protection law.

3. Confidentiality

Everyone authorised to process the data is bound by confidentiality and gets access on a need-to-know basis.

4. Security

Processor implements the measures in Annex 1 (Art. 32) and may update them, provided protection is not reduced.

5. Subprocessors

The Controller gives general authorisation for the subprocessors listed in Annex 2. Processor gives at least 10 days' notice of additions or replacements. The Controller may object on reasonable data protection grounds; if the objection can't be resolved, the Controller may terminate the affected service. Processor puts equivalent data protection obligations on each subprocessor and remains liable for them.

6. International transfers

Transfers outside the EEA/UK go only to countries with an adequacy decision, under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2 or Module 3 as applicable) and the UK Addendum, or to recipients certified under the EU-US Data Privacy Framework. Transfer impact assessments are available on request.

7. Data subject requests

Processor promptly forwards requests it receives and, taking into account the nature of the processing, helps the Controller respond through appropriate technical and organisational measures.

8. Personal data breach

Processor notifies the Controller without undue delay, and in any case within 72 hours of becoming aware of a personal data breach. The notice includes the nature of the breach, the categories and approximate number of people and records affected, likely consequences, the measures taken and a contact point. Processor helps the Controller meet its Art. 33 and 34 obligations.

9. Assistance

Processor helps the Controller with its Art. 32–36 obligations (security, breach notification, data protection impact assessments, prior consultation), taking into account the nature of the processing and the information available to it.

10. Deletion or return

At the end of the services, at the Controller's choice, Processor deletes or returns all personal data within 30 days after termination and deletes existing copies, unless law requires them to be kept.

Default retention, which the Controller can shorten in its configuration:

Subprocessor-side deletion follows each vendor's retention settings, which Processor sets to the shortest practical value.

11. Audits

Processor makes available all information needed to demonstrate compliance with Art. 28 and allows and contributes to audits, including inspections, by the Controller or an auditor it mandates. Audits require 30 days' notice, take place during business hours, at most once a year unless there's a breach or a regulator requires one, are subject to confidentiality, and are at the Controller's cost. Third-party certifications or reports may be used where they're sufficient.

12. Governing law and precedence

• Governing law: this DPA follows the governing law and jurisdiction of the Main Agreement (laws of England and Wales; courts of England and Wales), including the 30-day good-faith negotiation step. Exception: where the EU Standard Contractual Clauses apply, the SCCs are governed by the law of Ireland (Clause 17), and disputes arising from them are resolved by the courts of Ireland (Clause 18). The UK Addendum follows its own terms. Mandatory data protection law still applies.
• Liability: liability follows the Main Agreement, to the extent the law allows.
• Precedence: on data protection matters, this DPA prevails over the Main Agreement.

Conclusion: this DPA is concluded electronically when the Controller ticks the acceptance checkbox at checkout (GDPR Art. 28(9): "in writing, including in electronic form"). Processor keeps acceptance records (timestamp, IP address, account, version). Optional countersignature on request: Controller ________ Processor ________ Date ____

Annex 1: Technical and organisational measures

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or the provider's equivalent).
• Role-based access, least privilege, multi-factor authentication on all admin and vendor consoles, joiners/leavers process.
• Logical separation of each clinic's data.
• Processor does not use Controller data to train AI models. Google Cloud Vertex AI does not train on customer data under Google Cloud's terms. Vapi's terms allow it to use call content in de-identified form to improve its service.
• Logging and monitoring of access; logs kept for 12 months.
• Data minimisation in agent prompts (only what's needed for booking); short retention defaults.
• Backups with tested restore; documented incident response plan.
• Vendor due diligence.
• Staff confidentiality agreements and privacy/security training.
• Secure development: secrets management, dependency updates, change review.

Annex 2: Authorised subprocessors

Not subprocessors: Stripe processes only the Clinic's own billing and payment data (no patient data). Processor's email service provider and intake-form tools receive only clinic contact data, never patient data; if that changes, they will be added here with notice under §5.

Questions: hello@frontdeskagentshq.com · Terms · Pilot agreement · Refund · Privacy · DPA · Imprint