PLACEHOLDER. This is draft wording for review by counsel. It is not legal advice and is not yet a binding agreement.
Parties and roles
Between your department (the "controller" of its information) and us (the "processor"), who runs the service on the department's behalf.
What we process and why
Personal information about the department's members and contacts that the department enters, only to provide the service as the department directs.
Our commitments
- Process the information only on the department's instructions and for providing the service.
- Keep it confidential and limit our staff's access to what's needed, with the department's support access for help.
- Protect it with appropriate security: encryption in transit and at rest, access controls, audit logs and backups.
- Use subprocessors (hosting, email) only under written terms at least as protective, and list them on request.
- Tell the department without undue delay about a security incident affecting its information.
- Help the department answer requests from the people its records are about.
- Let the department export its information at any time, and delete it on the published schedule when the department leaves.
No patient information
The department agrees not to put patient care records or protected health information in the service.
Location
Information is stored in the United States [to be confirmed with hosting].
Contact
[Contact details to be added.]