Data Processing Addendum

1. Scope

This Data Processing Addendum ("DPA") forms part of the agreement between you (the "Controller") and AdvancedCare, Inc. dba AdClinica ("AdClinica", the "Processor") for the AdClinica marketing-intelligence and content service. It applies to the processing of personal data carried out by AdClinica on your behalf.

Terms used but not defined here have the meaning given in the agreement between the parties.

2. Business contact data only

AdClinica processes business contact data only. The personal data processed under this DPA is limited to the professional contact details of your prospects and business contacts (such as name, business email, company, job title and public social profile), together with the account and usage data of your own authorised users.

AdClinica is not designed to receive protected health information or any other clinical, patient or special-category data. You must not upload or submit patient data, and no clinical data may be sent through the Service.

3. Processing on your instructions

AdClinica will process personal data only on your documented instructions and only to provide the Service: building and running outreach, collecting public market intelligence, drafting and publishing content, and reporting on results. AdClinica will not sell personal data or use it for its own purposes.

4. Security

AdClinica implements appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, credential encryption, tenant isolation, least-privilege access, audit logging and bounded data-retention.

5. Subprocessors

You authorise AdClinica to engage the subprocessors listed on our subprocessor page to process personal data for the purposes stated. AdClinica remains responsible for their performance.

• HeyReach — LinkedIn outreach: campaigns, connection and message automation (hosted: EU / US)
• Mautic — Email marketing automation for outreach sequences (hosted: Self-hosted (EU))
• Chatwoot — Shared inbox for prospect and client replies (hosted: Self-hosted (EU))
• Twenty — CRM: business contact and company records (hosted: Self-hosted (EU))
• Shlink — Link shortening and click attribution for tracked links (hosted: Self-hosted (EU))
• Apify — Collection of public web and social data for market intelligence (hosted: EU / US)
• PostHog — Product analytics on the AdClinica application (hosted: EU / US)
• Stripe — Subscription billing and payment processing (hosted: US)
• Microsoft Azure — Application hosting, managed database and file storage (hosted: US)
• MXroute — Mailbox hosting for client outreach addresses (hosted: US)
• Anthropic — Large language model drafting of outreach and content copy (hosted: US)
• Resend — Transactional and lifecycle email delivery (hosted: US)

The current list is published at https://adclinica.com/subprocessors. AdClinica will give notice before adding or replacing a subprocessor so you have an opportunity to object.

6. International transfers

Where personal data is transferred outside your jurisdiction, AdClinica relies on lawful transfer mechanisms (such as standard contractual clauses) and requires its subprocessors to do the same.

7. Data subject rights and assistance

AdClinica will assist you, taking into account the nature of the processing, in responding to requests from data subjects and in meeting your obligations under applicable data-protection law, including security, breach notification, and data-protection impact assessments.

8. Retention, export and deletion

We retain personal data for as long as your account is active and as needed to provide the Service. On termination you may export your data in a machine-readable format and request deletion; AdClinica will delete or return personal data as instructed, save where law requires retention.

9. Contact

For any question about this DPA, including subprocessor changes or a signed copy, contact us at [email protected].