Last updated: August 31, 2026. Bracketed items like [CLINIC LEGAL NAME] are filled in per clinic when this agreement is executed as part of onboarding.
This Data Processing Agreement (“DPA”) is entered into between:
NTL Learning Solution Inc. (“NTL”), operator of TCM CRM, and
[CLINIC LEGAL NAME] (“Clinic”),
(together, the “Parties”) and forms part of the Terms & Conditions governing the Clinic’s use of TCM CRM (the “Service”).
1. Roles of the parties
1.1 For patient, clinical, appointment, and billing data entered into the Service (“Clinic Data”), the Clinic is the data controller and NTL is a data processor / service provider, within the meaning of British Columbia’s Personal Information Protection Act (“PIPA”).
1.2 The Parties acknowledge that TCM CRM is provisioned as a dedicated instance: the Clinic’s own hosting account (Cloudflare) and database account (Supabase) hold the Clinic Data, established under credentials that belong to the Clinic, not to NTL. As a result, NTL’s ordinary-course access to Clinic Data is limited to the provisioning process described in Section 3 and does not extend to routine, ongoing access to the Clinic’s live data. This is a deliberate architectural choice distinguishing TCM CRM from a conventional shared-infrastructure SaaS processor.
2. Subject matter, duration, and purpose
2.1 Subject matter: provisioning, technical support, and maintenance of the Clinic’s dedicated TCM CRM instance.
2.2 Duration: for as long as the Clinic maintains an active subscription, plus any period required to fulfill data-return or deletion obligations under Section 6.
2.3 Purpose and nature of processing: initial technical setup of the Clinic’s dedicated hosting and database accounts; software updates and bug fixes to the TCM CRM application; time-boxed technical support access explicitly requested by the Clinic (Section 4); transcription of dictated clinical notes via NTL’s sub-processor (Section 5).
2.4 Categories of data subjects: the Clinic’s patients, and the Clinic’s own practitioners/staff (as system users).
2.5 Categories of personal information: as described in the TCM CRM Privacy Policy and Privacy Impact Assessment — patient identifying information, clinical/health information, appointment and billing records, and consent records.
3. Onboarding and provisioning
3.1 NTL will provision the Clinic’s dedicated Service instance using account credentials either (a) provided by the Clinic, or (b) created by NTL on the Clinic’s behalf and handed over to the Clinic promptly upon completion of setup.
3.2 NTL will not retain a copy of any password or account credential after handoff is complete, except any credential the Clinic explicitly asks NTL to retain for ongoing support purposes.
3.3 The Clinic is responsible for securing the credentials once received, including changing any password NTL may have set during account creation.
4. Support access
4.1 Following initial provisioning, NTL will not access the Clinic’s live Service instance or Clinic Data unless the Clinic explicitly requests support that requires it.
4.2 Any such access will be limited to the scope and duration necessary to resolve the specific support request, and NTL will, where practicable, use time-limited or revocable credentials rather than standing access.
4.3 NTL will maintain a record of support-access events (date, reason, scope) sufficient for the Clinic to review on request.
5. Sub-processors
5.1 The Clinic authorizes NTL’s use of the following sub-processors as part of the Service, each engaged only for the purpose stated:
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Supabase | Clinic’s own database, authentication, and backend functions | All Clinic Data (held in the Clinic’s own Supabase project) |
| Cloudflare | Hosting and content delivery for the Clinic’s own application instance | No Clinic Data at rest |
| Square | Point-of-sale card payment processing, if used by the Clinic | Payment transaction data; card numbers are handled by Square directly |
| Groq | Real-time transcription of dictated clinical notes | Audio is processed transiently and is not retained after transcription |
5.2 NTL will provide reasonable advance notice before adding or replacing a sub-processor that would materially change how Clinic Data is handled, and the Clinic may object on reasonable privacy grounds.
6. Data location, return, and deletion
6.1 The Clinic’s Supabase project region is selected during provisioning. For BC clinics, the default is a Canadian region.
6.2 On termination of the Service, NTL will provide reasonable assistance for the Clinic to export its Clinic Data in a usable format.
6.3 Because Clinic Data resides in the Clinic’s own infrastructure accounts, the Clinic retains direct control over deletion timing and is responsible for complying with its own retention obligations (Section 8) before deleting any data.
7. Security
7.1 NTL will provision the Service with industry-standard technical safeguards, including encryption in transit, access controls, and row-level security scoping (where applicable to the Clinic’s configuration).
7.2 In the event NTL becomes aware of a security incident affecting Clinic Data, NTL will notify the Clinic without undue delay, and will cooperate with the Clinic’s own breach-assessment and notification obligations under PIPA.
8. Clinic’s own regulatory obligations
8.1 The Clinic acknowledges it remains solely responsible for its own compliance with applicable health-information, privacy, and professional-regulatory requirements, including but not limited to:
- Retention of patient health care records, appointment logs, and billing records for the period required by its regulatory college (currently a minimum of 16 years from the date of last entry, or from the age of majority, whichever is later, under CCHPBC’s Professional Standard: Record-Keeping, for BC TCM/acupuncture licensees — the Clinic should confirm current requirements directly with its college);
- Obtaining and documenting patient informed consent;
- Notifying patients and/or its college of any transfer of records on practice closure or transfer, where applicable.
8.2 Nothing in this DPA or the Service relieves the Clinic of these obligations; the Service is a tool to help the Clinic meet them, not a substitute for the Clinic’s own compliance program.
9. Term and termination
This DPA remains in effect for as long as the Terms & Conditions between the Parties remain in effect, and survives termination with respect to any ongoing data-return, deletion, or confidentiality obligations.
10. Governing law
This DPA is governed by the laws of British Columbia, Canada.
Signed for NTL Learning Solution Inc.: ______________________ Date: __________
Signed for [CLINIC LEGAL NAME]: ______________________ Date: __________