Data processing agreement

1. The processing

• Purpose: to provide AssistFai under the customer agreement: schedules, time, Försäkringskassan, municipalities, payroll, finances, the journal, quality, messages, documents, the client portal, the app and support.
• Data subjects: the provider's staff, clients who receive assistance, their representatives and relatives, and others the provider gives access.
• Data: name, personal identity number, contact details, employment, schedule and hours worked, absence, pay, tax and bank account, decisions, data for Försäkringskassan, Skatteverket and municipalities, agreements, messages and files. Journals, care plans, deviations and sick leave are health data.
• Duration: as long as the customer agreement applies and thereafter until the data has been deleted under section 7.

2. The provider's instructions

We process the data only on the provider's documented instructions. The customer agreement, this agreement and what the provider does in AssistFai are the instructions. If we believe an instruction breaks data protection rules, we say so.

3. Security and confidentiality

• Everyone at our end who processes the data is bound by confidentiality and has access only as far as the work requires. Our support never reads journals, deviations, Lex Sarah cases or messages, and every time support opens the provider's account it is logged.
• Traffic is encrypted. Personal identity numbers, journals, deviations, messages, bank accounts and files are stored encrypted. Login is with BankID or a password and a code for new browsers, permissions follow the roles and events are logged.
• The data is stored on servers in the EU.

4. Sub-processors

The provider gives us a general authorisation to use sub-processors, who have agreements with us with the same obligations as here. Today:

• Hetzner Online GmbH, Germany: servers and backups in the EU.
• Finansiell ID-Teknik BID AB, Sweden: BankID, through our own identity service.
• Apple and Google: notifications to the app, without journals, pay or personal identity numbers.
• OpenAI: interprets the text of schedules the provider imports from other systems. Names and personal identity numbers are replaced by codes before the text is sent.

We tell the provider at least 30 days before we change or add a sub-processor. If the provider objects, the customer agreement can be terminated before the change.

5. Help to the provider

• We help the provider answer when a data subject wants access to, correction or deletion of their data.
• If we discover a personal data breach affecting the provider's data, we tell the provider without undue delay, at the latest within 48 hours, with what the provider needs for its report to the Swedish Authority for Privacy Protection.
• We help with impact assessments and prior consultations when needed, and give the provider the information needed to show that the agreement is followed.

6. Transfers outside the EU

The data is stored and processed in the EU/EEA. Notifications are delivered by Apple and Google under their terms, and OpenAI may process the coded schedule text outside the EU/EEA with the safeguards the GDPR requires.

7. When the agreement ends

The provider can take out its data as an export. After the notice period we delete the provider's data; what the law requires to be kept, such as pay, invoices and accounting records, is kept as long as the requirement applies.