Data Processing Agreement (DPA)

1. Scope and roles

This DPA applies to every therapist account on Echilibru International at global.echilibru.app, irrespective of plan, and supplements the Terms accepted when the account is created.

The therapist is the controller of client data entered in the platform. SC Arta Monumentală SRL is the processor and processes data only on documented instructions and to provide the service.

2. Subject matter, duration and nature of processing

Processing covers the management of clients, appointments, documents, agreements, private notes, homework, questionnaires, communications and invoices in the International workspace.

Data is processed while the account is active and during retention or archiving periods required by law or instructed by the controller. Operations include collection, storage, organisation, display, transmission on instruction, backup, export and deletion.

Data may include identification, contact and administrative information, appointment and document data, and health data under Article 9 GDPR. Data subjects are adult or minor clients and, where applicable, their legal representatives.

3. Processor obligations

• process only on documented instructions and bind authorised personnel to confidentiality;
• apply appropriate Article 32 technical and organisational measures;
• assist with data-subject rights, incidents, impact assessments and audits;
• flag apparently unlawful instructions and report incidents without undue delay;
• delete or return data at termination unless law or a documented lawful instruction requires retention.

4. Authorised subprocessors

The controller grants general authorisation for the providers below, only where the corresponding service is used. The provider will impose equivalent data-protection duties and give at least 14 days’ notice before adding or replacing a subprocessor.

5. Optional integrations selected by the therapist

Google Calendar and Google Meet. When the therapist connects a Google account, Echilibru sends the client name, date and time, duration, time zone, appointment type/location and, where applicable, conference link to Google services. Echilibru stores the OAuth token encrypted, together with the event identifier and Meet link.

Zoom. When the therapist connects a Zoom account, Echilibru sends the client name, date and time, duration and time zone to Zoom to create or update the meeting. Echilibru stores the OAuth token encrypted, together with the meeting identifier and join link.

These integrations are disabled by default and enabled on the therapist’s explicit instruction in the therapist’s own account. The therapist must review the terms, privacy settings and processing agreement applicable to that Google or Zoom account. Depending on the account contract and data category, the external provider may act as a processor or in its own role for certain service data.

Official documents: Google Cloud Data Processing Addendum · Zoom Privacy & Global DPA.

6. Data location and international transfers

The platform and its databases are hosted in Romania, within the European Union. This statement concerns Echilibru infrastructure, not the infrastructure of the optional Google and Zoom providers.

Where a provider may process data outside the EEA, Chapter V GDPR safeguards apply, including adequacy decisions and/or Standard Contractual Clauses under the relevant contract. Enabling Google or Zoom is the controller’s instruction to send the required data to the selected provider; the controller is responsible for checking the contract configuration suitable for the practice.

7. Therapist obligations

• establish a lawful basis and provide Articles 13–14 notices;
• meet the conditions for health data and minors’ data;
• enter only necessary data and protect account access;
• enable external integrations only after assessing the provider and informing clients;
• answer data-subject requests, with Echilibru’s assistance where required.

8. Technical and organisational measures

• HTTPS/TLS 1.2+ in transit;
• primary hosting and storage in Romania/EU, backups and access controls;
• separate authentication and workspaces for therapists and clients;
• AES-256-GCM encryption for Google and Zoom OAuth tokens;
• HttpOnly, Secure and SameSite session cookies and technical audit logs;
• private therapist notes remain separate from the client portal and are not sent to video providers.

9. Incidents, assistance and audit

The provider informs the controller without undue delay after becoming aware of a personal-data breach and supports Articles 33–34 duties. Reasonable audits may be requested with 30 working days’ notice, without access to other controllers’ data.

10. Termination and data

At termination, the controller may request export of available data. Data is then deleted or returned on documented instructions, except where law or a documented lawful archiving request requires retention.

11. Amendments and objections

Material DPA changes and subprocessor changes are communicated before taking effect. The controller may raise a reasoned objection; if no reasonable solution is available, the affected service may be terminated.

12. Contact

Questions about this DPA or processing: contact@echilibru.app · +40 760 676 990. Clients normally exercise GDPR rights with their therapist as controller.