Data Processing Agreement

Last updated: May 31, 2026

This DPA forms part of the Service Agreement between Alvero Dental Systems Inc. ("Processor") and the customer ("Controller") and governs the processing of Personal Information and Protected Health Information.

1. Scope

Alvero processes Personal Information and PHI strictly to provide the contracted service, in accordance with the Controller's documented instructions and applicable law (including PIPEDA, PHIPA, and provincial health-privacy statutes).

2. Categories of data

Patient demographic data, contact information, appointment history, treatment summaries, financial transaction history, and any other data the Controller connects via integrations or uploads to the platform.

3. Categories of data subjects

The Controller's patients, staff, and associated parties.

4. Sub-processors

A current list of sub-processors is provided on request. Alvero will notify Controllers of changes with reasonable notice and provide a right to object.

5. Security measures

See Privacy Policy §4 ("How we protect it") and Schedule A of the executed DPA, which includes tenant isolation with row-level security; encryption in transit and at rest; RBAC with full audit trail; annual third-party security review; and a documented incident response plan.

6. Breach notification

Alvero will notify the Controller without undue delay (and within 72 hours of confirmed knowledge) of any Personal Information or PHI breach affecting the Controller's data.

7. Audit rights

The Controller may audit Alvero's compliance with this DPA on reasonable written notice, no more than once per year, subject to confidentiality.

8. International transfers

By default, all data is processed in Canadian data centres. Any cross-border transfer is documented in Schedule A.

9. Term and termination

This DPA remains in force for the duration of the Service Agreement. Upon termination, Alvero will return or securely delete Controller data in accordance with Privacy Policy §7.

10. Contact

DPA questions: [email protected]
Security incidents: [email protected]

This page is a public-facing summary. The executed DPA is a signed addendum to your Service Agreement. To request the executable version, email [email protected].