Canada · Version Oct 11, 2026
Data Processing Agreement
This Data Processing Agreement is between Clara and the practice accepting it (Customer). It applies when Clara processes personal information or personal health information for Customer.
1. Roles and instructions
Customer determines why client information is processed and remains responsible for its collection and use. Clara processes that information only to provide, secure, support, and improve the services under applicable law.
2. AI and delegated processing
When Customer enables an AI-assisted or delegated administrative feature, Clara may process the minimum Customer data needed to draft, transcribe, summarize, communicate, schedule, or complete that configured task. When Customer enables direct billing, Clara may process the minimum client, coverage, and service information needed to prepare, submit, track, and reconcile claims on Customer’s behalf. Clara does not use Customer data, Client data, personal health information, communications, audio, transcripts, or notes to train or fine-tune general-purpose or Clara AI models.
3. Confidentiality and safeguards
Clara limits access to authorized personnel and subprocessors subject to confidentiality duties. Clara maintains administrative and technical safeguards appropriate to the sensitivity of the information, including access controls, TLS-protected connections to Clara and hosting-provider encryption of stored data, audit logging, and recovery procedures.
4. Subprocessors and location
Customer authorizes Clara to use subprocessors needed to provide the services. Clara remains responsible for their processing. Clara will provide notice of material subprocessor changes. Primary application data is hosted in the country selected during signup. Clara uses Twilio for phone and messaging services, with communications data processed and stored in the US under contractual privacy and security safeguards.
5. Security incidents
Clara will notify Customer at the first reasonable opportunity after becoming aware of theft, loss, or unauthorized use or disclosure of Customer data, and will provide available information and updates reasonably needed for Customer’s investigation, notice, and remediation duties.
6. Individual requests
Taking into account the nature of the processing, Clara will reasonably assist Customer with access, correction, portability, restriction, deletion, consent withdrawal, complaint, and regulator requests that concern Customer data.
7. Retention, return, and deletion
Customer may export Customer data during the subscription. At termination, Clara will return or delete Customer data according to the Terms, legal holds, backup cycles, and any health-record retention instructions Customer is legally required to apply.
8. Evidence and cooperation
Clara will make available information reasonably necessary to demonstrate compliance with this Agreement and will reasonably provide proportionate privacy or security assessments, subject to confidentiality, security, and cost controls.
9. Order and duration
This Agreement begins when Customer accepts it and continues while Clara processes Customer data. If it conflicts with the Terms on privacy or data-processing matters, this Agreement controls. Mandatory privacy and health-information law always applies.
Electronic acceptance during Clara signup records the practice, authorized owner, country, agreement kind, version, and acceptance time.