Processing terms

Roles

The practice decides which of its clients are asked for a review and on what terms. Kudos acts on the practice's instructions when it sends.

Both the practice and Kudos have obligations under the Privacy Act in their own right. Neither party's obligations are transferred by these terms.

What Kudos will do

Use a practice's client information only to run the service: to decide when to send, to send, to record the outcome, and to honour an unsubscribe.

Keep each practice's data isolated from every other practice's.

Store and process the information in Australia, with the providers named in the privacy policy.

Honour an unsubscribe, including after the practice stops using Kudos.

Delete a practice's client contact details within 90 days of the practice leaving, except the one-way scrambled record of an unsubscribe or a failed delivery, which is kept so the request can go on being honoured.

Tell the practice without undue delay if we become aware of a data breach affecting their clients, and cooperate with any assessment they must make.

Return or delete a practice's data on request.

What the practice confirms

That the clients it loads into Kudos are its existing clients, that it holds their consent to be emailed about its business, and that the addresses were provided for correspondence.

That it will pass on any request from a client to stop being contacted.

That the information it provides is accurate, and that it will correct it when it is not.

Sub-processors

Kudos uses Supabase, Vercel, Amazon Web Services and Google Cloud, as described in the privacy policy. We will tell practices before we add a sub-processor that handles their clients' personal information.

Stripe handles subscription payments. It is a processor of the practice's own billing information and is not a sub-processor of client information: no client name, email address, review or feedback is sent to it, and none is readable from anything that is.

For a practice that chooses WhatsApp, Meta Platforms, Inc. (the WhatsApp Business Platform) is a sub-processor of that practice's clients' mobile numbers and review requests, in the United States and other countries. A practice that does not choose WhatsApp has no information sent to Meta.

A note on naming

These are APP-aligned processing terms, not a GDPR data processing agreement. If a practice has clients who are residents of the European Union or the United Kingdom, tell us, because a different instrument is needed.