Data processing.
Your patients data is yours. We process it only to run your follow-up, under the rules below.
| Roles | Your practice is the controller. Kept is the processor for callback data: caller name, callback number, callback reason, call logs, booking details. List-based win-back only moves under a signed order with proper safeguards. |
|---|---|
| BAA | Where your setup involves patient health information and a business-associate relationship exists, we sign a business associate agreement before that work starts. The standard callback workflow is designed to avoid collecting health information. No PHI moves before the ink dries. |
| Scope | Processing only to deliver the install: answering, text-back, follow-up, booking, reminders, consent-based win-back, reviews, reporting. Nothing else, never for our own purposes. |
| Instructions | We act on your documented instructions in the signed order. If an instruction looks unlawful, we pause and tell you before proceeding. |
| Confidentiality | Everyone handling data is bound to confidentiality. Access is limited to the people running your install. |
| Security | Encryption in transit and at rest, least-privilege access, and logging on production systems. Measures scale with the sensitivity of what is held. |
| Sub-processors | Carriers for calls and texts, schedulers for booking, and hosting for logs. Categories are fixed here; named vendors sit in your signed order, and changes come with 14 days notice and a right to object. |
| Your patients rights | We help you answer access, correction, deletion, and opt-out requests within your deadlines, including state law timelines. |
| Breach notice | Confirmed personal data breaches reach you without undue delay, with what happened, what is affected, and what we did. We assist with regulator and individual notices. |
| Deletion and return | At the end of the engagement, data is returned or deleted within 30 days, backups aging out on cycle, unless law requires retention. Your wording exports are always yours. |
| Audits | An annual security summary is available on request. Larger reviews are scoped and quoted before work starts. |
| International transfers | Processing happens in the US. Cross-border transfers, if ever needed, use lawful mechanisms with equivalent protection. |
| Precedence | This page is the plain summary. The signed DPA in your order governs where they differ. |
| Contact | hello@keptpractice.com |