Data processing agreement (Dua eKlinike)

Version 2026-11-05

Each clinic reads and accepts this agreement inside Dua eKlinike (Settings › Subscription), filled in with its own name, NIPT and address, and downloads a copy. This page shows the same text for reference.

This agreement is between the clinic or dental practice that subscribes to Dua eKlinike, "the Clinic", which is the controller of the personal data it keeps in Dua eKlinike, and DM Consulting Services SHPK (NUIS M61810052H, Rr. "Luigj Gurakuqi", Pallati 4, Kati 1, Ap. 7, Tiranë, Albania), "DM Consulting Services", which provides Dua eKlinike and is the processor of that data. It forms part of the Clinic's Dua eKlinike subscription and follows the law of the Republic of Albania on the protection of personal data and, where it applies, the EU General Data Protection Regulation.

1. What DM Consulting Services processes, and why

• Purpose: only to provide Dua eKlinike to the Clinic: keeping, showing, searching, printing and sending the Clinic's data as the Clinic uses the software, backing it up and keeping it secure.
• Data subjects: the Clinic's patients (including children, with their parents or guardians) and their contacts, people who book appointments or write through the Clinic's website, the Clinic's staff.
• Kinds of data: names, ID numbers, dates of birth, contact details, appointments and the reason for the visit, the medical file (allergies, conditions, medicines, blood group, notes), treatments, X-rays, results and other documents, notes, messages, invoices and payments, and the Clinic's staff accounts. Health data is a special category of personal data: DM Consulting Services stores the medical file and the reason for the visit encrypted, and treats all of it as confidential.
• Duration: as long as the subscription lasts, and afterwards as described in section 9.

2. Only on the Clinic's instructions

DM Consulting Services processes the data only on the Clinic's documented instructions: this agreement, the settings the Clinic chooses in Dua eKlinike and what the Clinic's staff do in it. DM Consulting Services never uses the data for its own purposes, never sells it and never uses it to train artificial intelligence. If the law requires DM Consulting Services to do otherwise, it tells the Clinic first, unless the law forbids that.

3. Confidentiality and medical secrecy

DM Consulting Services knows that the Clinic's doctors and staff are bound by medical secrecy. DM Consulting Services never puts patient names or health data in alerts, staff emails, Telegram messages or its own logs. Only the few DM Consulting Services people who need it to run, secure or support Dua eKlinike can reach the data, and each of them is bound to confidentiality. DM Consulting Services staff open a Clinic's admin only to help it, through a "support sign-in" that the Clinic sees on screen and that is written to the Clinic's activity log with the person's email.

4. Security

DM Consulting Services keeps appropriate technical and organisational measures, including:

• encrypted connections (HTTPS) everywhere, and passwords, keys and secrets stored encrypted;
• each clinic's data kept apart from every other clinic's;
• a second sign-in step (an emailed code, or an authenticator app) for staff, and roles that limit who sees what, down to restricted treatments, and a log of who opened each patient's medical file;
• an activity log of who did what;
• regular backups, kept apart from the main server, and restore tests;
• updates and security fixes applied promptly.

5. Sub-processors

The Clinic allows DM Consulting Services to use the sub-processors listed below. DM Consulting Services binds each one to data protection duties at least as strict as these, and stays responsible for them. DM Consulting Services tells the Clinic about a new or replaced sub-processor at least 30 days before, by email and in Dua eKlinike, and the Clinic may object for a reasonable cause; if no solution is found, the Clinic may end its subscription and is refunded for the unused period. Services marked "only if switched on" receive data only when the Clinic switches them on in Settings › Integrations.

6. Helping the Clinic

DM Consulting Services helps the Clinic, as far as it can, to answer requests from data subjects (access, correction, deletion, restriction, portability), to keep its data secure, to assess data protection risks and to deal with the supervisory authority (the Commissioner for the Right to Information and the Protection of Personal Data). Most of this the Clinic can do itself in Dua eKlinike.

7. Personal data breaches

If DM Consulting Services becomes aware of a breach affecting the Clinic's data, it tells the Clinic without undue delay and at the latest within 48 hours, with what is known (what happened, which data, likely consequences, what is being done), and keeps it informed. Notifying the authority and the people affected remains the Clinic's decision as controller; DM Consulting Services helps.

8. Where the data is kept

The data is kept on servers in the European Union and in Albania. If DM Consulting Services ever transfers data elsewhere, it does so only with safeguards the law accepts, and it tells the Clinic first.

9. At the end of the subscription

• If a payment is missed, Dua eKlinike first keeps working, then becomes read-only for the period shown on Settings › Subscription: the Clinic can still sign in, see, print and download everything.
• During that period, and on request, DM Consulting Services gives the Clinic a copy of its data in a common format.
• After that period, DM Consulting Services deletes the Clinic's data, including from backups as they cycle (within 30 days), unless the law requires DM Consulting Services to keep some of it. Invoices DM Consulting Services issued to the Clinic are kept as tax law requires.

10. Audits

DM Consulting Services gives the Clinic the information needed to show it keeps to this agreement. The Clinic, or an auditor bound to confidentiality, may audit it once a year with 30 days' notice, at the Clinic's cost, without seeing other clinics' data.

11. Liability, changes and law

Liability follows the Clinic's subscription terms. DM Consulting Services may update this agreement, for example for a change in the law; the Clinic is told 30 days before, and the new version is shown in Dua eKlinike to be accepted. This agreement is governed by the law of the Republic of Albania, and the courts of Tirana decide disputes.

Contact for data protection: [email protected]