Data Processing Agreement

Version and effective date: September 15, 2026

This agreement forms part of the Terms between Nottifai LLC (Separalo) and a business customer. It governs personal information we process on the business's behalf. Separalo's own account, billing and security processing is described in the Privacy Policy.

Instructions, scope and responsibilities

The business determines the purposes of its customer and staff processing and instructs Separalo to provide scheduling, storage, authorized access, related service communications and support. Processing lasts for the service relationship and limited return/deletion period. Individuals include booking contacts, staff and business representatives. Information includes contact details, appointment and service records, staff schedules, and related operational metadata. Clinical/patient information and other unsupported sensitive information are outside the permitted scope.

The business must have lawful authority to issue instructions, provide appropriate notices and obtain required authorizations. Separalo will process information only under documented instructions, this agreement and applicable law; notify the business if an instruction appears unlawful; and protect confidentiality. Required legal processing beyond instructions will be disclosed where legally permitted.

Security and assistance

Separalo maintains safeguards appropriate to the service and risks, including authenticated and role-scoped access, encrypted transport, restricted administration, provider-managed storage safeguards, and operational monitoring. Personnel access is limited to authorized duties. The parties will cooperate on data-subject requests, security inquiries and legally required assessments within their respective responsibilities. Separalo will provide reasonably available information needed to demonstrate its performance and cooperate with proportionate, confidential reviews that do not expose other customers' information or compromise security.

Separalo will notify the business without undue delay after becoming aware of a personal-data breach affecting information processed on its behalf and provide available information and reasonable cooperation. Further notifications follow the parties' legal responsibilities; no universal 72-hour notice to every recipient is promised.

Providers and international transmission

The business authorizes the providers on the provider list, subject to contractual protections appropriate to their functions. Separalo remains responsible for its processor obligations when using subcontractors. We will give advance notice of material additions or replacements where required, ordinarily at least 30 days where practicable, and consider reasonable data-protection objections. If an objection cannot be resolved, the parties will discuss an alternative or termination of the affected service. Urgent security or continuity changes will be explained promptly.

For Colombian personal-data transmissions to Separalo as an overseas processor, the business instructs processing for the purposes and scope above. Separalo undertakes to apply the business's lawful processing instructions, applicable data-protection principles, security measures and confidentiality obligations. Any onward processing must remain subject to appropriate protections. Transfers to an independent controller require their own applicable legal basis or mechanism; this agreement is not blanket consent to every international transfer.

Return, deletion and exceptions

The business can export booking records during service and the normal 30-day window after service ends. Contact support for other return, correction or deletion requests. Separalo will then delete or anonymize operational information, subject to applicable law, documented holds and provider backup expiry. Verified rights requests are handled within their applicable deadlines. Any retained information remains protected and restricted to its remaining purpose. The normal booking retention limit is 12 months after the appointment.

General

The Terms govern liability and disputes, subject to mandatory law. This agreement prevails over conflicting Terms concerning processing on the business's behalf. Contact [email protected] for instructions, requests and provider notices.