Permanent link to this version: /dpa/2026-10-27.1
Version 2026-10-27.1 · Effective: 29 October 2026
This Data Processing Addendum (“DPA”) applies between Sumext, based in the United Arab Emirates (contact: support@sumext.com) (“Sumext”, “we”), and the organisation using Sumext (“the clinic”, “you”). It forms part of the Sumext Terms of Service and applies when the clinic uses Sumext's contractor invoice review features with invoices that may contain patient information.
Acceptance
An authorised owner of the clinic's Sumext account accepts this DPA, together with the Health Information Privacy Addendum, inside the Sumext app before these features are switched on. The owner confirms they have authority to accept for the clinic. We record the organisation, the person who accepted, the date and time, and the document versions. If we make a material change, we will publish a new version and ask for acceptance again before it applies to new features.
1. Roles and instructions
The clinic decides why invoices are submitted, who has access, and has the lawful basis for collecting health information and for the transfers described in the Processing and Retention Schedule. Sumext processes this information only to provide the service, on the clinic's documented instructions: extracting and checking contractor invoices and, where switched on, matching them with appointment records. We will tell the clinic if we believe an instruction conflicts with applicable privacy law. Each party remains responsible for its own legal obligations.
2. Information covered
People: patients, contractors and the clinic's users. Information: invoice details, service dates and types, the patient identity needed to check a line, contractor identity, amounts, and appointment identifiers and status. Sumext does not need clinical notes, diagnoses, dates of birth, addresses or Medicare numbers, and the clinic should keep these out of invoices and exports. The clinic's booking systems (such as Noterro or Jobber) remain its source of record.
3. Access and confidentiality
Access is limited by organisation and role. Each user has an individual account. In normal review, patient names are replaced with initials and a protected token. An owner or admin can reveal a single name when needed to check a line; each reveal is logged (who, when, which invoice and line) without recording the name itself. Sumext staff access client data only when necessary for support, security or incidents, and that access is logged. People who access the data are bound by confidentiality.
4. Security and use
We protect data in transit and at rest, keep original files in private storage, and protect matching keys. Patient names are kept out of accounting descriptions, attachments sent to your accounting software, and routine notifications. A person must review and approve every invoice before it is posted. We do not use clinic data for advertising, unrelated product development or training AI models.
5. Service providers (subprocessors) and locations
The clinic authorises the providers, purposes and locations listed in the Processing and Retention Schedule. We have agreements in place with these providers and remain responsible for the processing they do on our behalf. We will give at least 14 days' notice before adding or changing a provider or location that affects this information, where practical. If the clinic objects on reasonable grounds and we cannot resolve it, we will suspend the affected processing. We do not promise that data stays in Australia. If we are legally required to disclose information, we will limit the disclosure and tell the clinic unless the law prevents it.
6. Retention, return and deletion
We follow the Processing and Retention Schedule and any shorter period the clinic asks for in writing. When the clinic stops using these features, or asks us to, we will return or delete the source invoices, derived files and appointment matching records within 30 days, unless a legal obligation requires us to keep something; in that case we keep only what is required, restrict access to it, and tell the clinic what and why. Name-free audit records are kept for 12 months. Encrypted backups expire on the schedule's timetable. If a backup is ever restored, we re-apply earlier deletions before the data is used.
7. Requests from patients
We will help the clinic respond promptly to verified requests for access, correction or deletion, and to complaints. If a patient contacts us directly, we will refer them to the clinic unless the law requires otherwise. On reasonable request, we will provide information about our security and deletion measures, without disclosing other customers' data.
8. Incidents
If we become aware of a suspected incident affecting the clinic's information, we will notify the clinic without undue delay, aiming to send an initial notice within 24 hours, even if the facts are still incomplete. The notice will describe what we know: scope, type of information, timing, containment steps and a contact person. We will investigate, keep the clinic updated, provide a closing report, and cooperate with any required notices to patients or the OAIC. The clinic leads communication with its patients unless agreed otherwise.
9. End of use
When the clinic stops using these features, we switch off access and integrations for them, return or delete data as set out in section 6, and confirm completion in writing. We do not reuse patient information for testing or demonstrations.