Data Processing Agreement
Last Updated: September 1, 2026
This Data Processing Agreement (“DPA”) serves as a Business Associate Agreement / Information Manager Agreement addendum to the Master Service Agreement between 15336732 CANADA INC. d/b/a Moonlight AI™ (“Data Processor” or “Processor”) and the Business (“Data Controller” or “Controller”). It forms part of the Terms of Service and is entered into when the Controller subscribes to the Service; for the In-Room Clinical Transcription Add-On, Schedule B must also be separately executed (see below) before that Add-On is enabled.
This agreement addresses compliance with PIPEDA, PHIPA, HIPAA, and GDPR data processing regulations regarding the Processor’s storage and processing of Personally Identifiable Information (PII), as described in Section 3. The standard Service (voice AI receptionist / appointment booking) does not involve storage of Personal Health Information (PHI) — see Section 3.1. The optional In-Room Clinical Transcription Add-On does involve the processing and limited storage of PHI and is governed by Schedule B, which applies only where that Add-On is enabled for the Controller and a Business Associate Agreement has been executed.
Note on Schedule B. Schedule B (Business Associate terms for the In-Room Clinical Transcription Add-On) and the transcription-related sub-processor entries in Section 5 are being finalized with legal counsel. They are published here for transparency and vendor review. The Add-On is not enabled for any Controller until Schedule B, or an equivalent standalone Business Associate Agreement, is signed by both parties.
1. Definitions
1.1 “Personal Data” means any information relating to an identified or identifiable natural person, including but not limited to names, phone numbers, email addresses, and appointment details.
1.2 “PHI” (Protected Health Information) means any individually identifiable health information transmitted or maintained by the Controller, as defined under PHIPA (Ontario) or HIPAA (US).
1.3 “Processing” means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, erasure, or destruction.
1.4 “Sub-Processor” means any third-party entity engaged by the Processor to process Personal Data on behalf of the Controller.
1.5 “Data Breach” means any unauthorized access, acquisition, use, or disclosure of Personal Data that compromises the security, confidentiality, or integrity of such data.
2. Scope of Processing
2.1 The Processor provides an automated Voice AI Receptionist service. In facilitating this service, the Processor processes and stores the Controller’s client data (names, phone numbers, appointment details, and service preferences), as described in Section 3, exclusively to facilitate conversational scheduling, appointment management, and related administrative inquiries.
2.2 Permitted Purposes: The Processor shall process Personal Data only for the following purposes:
- Answering inbound phone calls and facilitating appointment bookings.
- Checking and managing calendar availability.
- Sending SMS appointment confirmations and reminders.
- Executing waitlist notifications and outbound reactivation calls.
- Generating anonymized analytics and billing reports.
2.3 Prohibited Purposes: The Processor shall NOT process Personal Data for:
- Direct marketing or advertising on behalf of the Processor or any third party.
- Selling, renting, or sharing Personal Data with any third party.
- Profiling individuals for purposes unrelated to the Service.
3. Data Storage & Retention
3.1 Persistent Storage, No PHI (Standard Service): The Processor stores customer names, phone numbers, appointment history, and business configuration data (services, staff, blacklist/waitlist entries) in its own database, for the duration of the Controller’s active account. The Processor does not store Protected Health Information (PHI) as part of the standard appointment-booking Service. The In-Room Clinical Transcription Add-On does involve the processing and limited storage of PHI and is governed by Schedule B of this Agreement, not by this Section — see Schedule B for its scope, storage, and retention terms. Other optional vertical-specific features involving health-related information (e.g., pharmacy prescription intake) are subject to additional terms and safeguards to be defined separately, and are not covered by this Agreement until those terms are executed.
3.2 Security Controls: Data is encrypted at rest and in transit. Database access is restricted per-Controller via row-level tenant isolation — the Processor’s database enforces that queries scoped to one Controller’s tenant ID cannot return another Controller’s data.
3.3 Data Residency: Database infrastructure is hosted in ca-central-1 (Canada). Google Calendar data remains within the Controller’s own Google Workspace account, outside the Processor’s infrastructure.
3.4 Conversation Session Data: In-progress conversation state (used for multi-turn dialogue continuity) is stored in encrypted, ephemeral storage (AWS DynamoDB with TTL) and is automatically and irrevocably deleted within 2 hours of each call ending.
3.5 Audit Records: Structured audit records (call timestamps, booking confirmation references, and anonymized session identifiers) are retained for up to 90 days for billing verification and service quality monitoring. These records do not contain health information, medical notes, or conversation transcripts.
3.6 Operational Logs: Service monitoring and error diagnostic logs are retained for up to 30 days. These logs may contain caller phone numbers as session identifiers but do not contain conversation content, health information, or appointment details.
3.7 Termination Retention & Deletion: Upon termination of the underlying Agreement, the Controller may request an export of their client records, appointment history, and configuration data within 30 days of the termination date. The Processor will delete all Controller data described in Section 3.1 from its database within 30 days following the export window (or immediately upon Controller request, whichever is sooner), except where retention is required by law. This mirrors, and does not supersede, Section 6 of the Terms and Conditions.
4. AI Model & Training Restrictions
4.1 No AI Training — Ever: The Processor unconditionally and irrevocably commits that no customer data — including voice audio, text transcripts, caller metadata, appointment details, or any other Personal Data — will be used to train, fine-tune, evaluate, benchmark, or improve any Large Language Model (LLM), artificial intelligence foundation model, or machine learning system.
4.2 Context Window Only: Client data is utilized strictly as ephemeral context window inputs to facilitate the immediate transaction. Data is discarded from the AI model’s context upon session termination.
4.3 Sub-Processor AI Restrictions: The Processor shall make commercially reasonable efforts to engage Sub-Processors under terms that restrict the use of Personal Data for AI model training. With respect to Google Cloud Platform (Gemini Live), the Processor accesses the service under API terms that prohibit Google from using inputs and outputs to train general-purpose AI models by default. The Processor does not warrant that all Sub-Processors maintain contractually identical restrictions; each Sub-Processor’s data use is governed by their respective enterprise agreements and compliance programs, which the Processor reviews prior to engagement.
5. Sub-Processors
5.1 The Controller authorizes the Processor to engage the following Sub-Processors:
| Sub-Processor | Purpose | Data Region |
|---|---|---|
| Amazon Web Services (AWS) | Core compute (Lambda, Fargate, ECS), persistent client-data database (RDS/Aurora PostgreSQL, per Section 3), DynamoDB session storage, SES email | ca-central-1 (Canada) |
| Twilio Inc. | Voice gateway, PSTN call routing, real-time audio Media Streams (WSS), SMS delivery | United States |
| Google Cloud Platform (Gemini Live) | Real-time AI language model inference for voice conversations | United States |
| Google Workspace (Calendar & Sheets) | Appointment calendar management; client CRM data (Subscriber-owned) | North America |
| Stripe, Inc. | Subscription billing & payment processing | United States |
| Langfuse | Call trace logging, observability, and prompt version management (voice receptionist only — not used by the In-Room Clinical Transcription Add-On) | European Union / United States |
| SignWell | Electronic signature processing for legal document execution | United States |
| Amazon Transcribe (AWS) | Real-time speech-to-text for the In-Room Clinical Transcription Add-On only (Schedule B). Streaming API — audio is not stored by the service. | United States (us-east-1) |
| Amazon Bedrock (AWS) — Anthropic Claude | Generation of the structured clinical note from the transcript, for the In-Room Clinical Transcription Add-On only (Schedule B). Inputs and outputs are not stored by the service and are not used to train models. | United States (cross-region inference) |
| Google Workspace (Google Drive & Docs) | Storage of the clinical note and verbatim transcript in the Controller’s own Google Workspace account (Add-On only). The Controller, not the Processor, controls and retains these files. | Controller’s Google Workspace region |
5.2 Prior Notice: The Processor shall provide the Controller with at least thirty (30) days’ written notice before engaging any new Sub-Processor. The Controller may object in writing within fifteen (15) days, and the Processor shall use commercially reasonable efforts to address the objection or provide an alternative.
5.3 Sub-Processor Obligations: The Processor shall ensure that each Sub-Processor is bound by data protection obligations no less protective than those set forth in this DPA.
6. Security Measures
6.1 Encryption in Transit: All API transmissions between telecom providers (Twilio), AI providers (Google Gemini Live), and the Controller’s Google Workspace are encrypted using HTTPS/TLS 1.3. Real-time call audio is streamed exclusively over WSS (WebSocket Secure / TLS 1.3).
6.2 Encryption at Rest: All ephemeral session data stored in DynamoDB is encrypted at rest using AWS-managed encryption keys (AES-256).
6.3 Access Controls: Access to the Processor’s production infrastructure is restricted to authorized personnel via multi-factor authentication (MFA), role-based access control (RBAC), and least-privilege principles.
6.4 Service Account Isolation: Each Controller’s Google Service Account credentials are stored in AWS Secrets Manager with per-tenant isolation. Cross-tenant data access is architecturally impossible.
6.5 Vulnerability Management: The Processor shall maintain a vulnerability management program that includes regular patching of dependencies, automated security scanning, and periodic review of access controls.
7. Data Breach Notification
7.1 Notification Timeline: In the event of a confirmed Data Breach affecting the Controller’s Personal Data, the Processor shall notify the Controller without undue delay and in no event later than 72 hours after becoming aware of the breach.
7.2 Notification Content: Breach notifications shall include:
- A description of the nature of the breach, including categories and approximate number of data subjects affected.
- The name and contact details of the Processor’s designated privacy contact.
- A description of the likely consequences of the breach.
- A description of the measures taken or proposed to address the breach and mitigate its effects.
7.3 Cooperation: The Processor shall cooperate with the Controller in investigating and remediating any Data Breach and in meeting any regulatory notification obligations.
7.4 Exposure Mitigation: As described in Section 3, the Processor maintains a persistent database of the Controller’s Personal Data. Exposure in a Processor-side breach is mitigated, not eliminated, by the tenant-isolation and encryption controls described in Section 3.2 — a breach affecting the Processor’s database could expose data across multiple Controllers’ tenants if those controls were themselves compromised, and the Processor shall disclose the actual scope of any confirmed breach, not a presumed-limited one, under Section 7.2.
8. Data Subject Rights
8.1 The Processor shall assist the Controller in responding to data subject requests for access, rectification, erasure, portability, or objection, to the extent that such data exists within the Processor’s systems, as described in Section 3.
8.2 The Processor will support the Controller in fulfilling data subject requests (access, correction, deletion) for data held in the Processor’s database within 10 business days of a Controller request, via the Tenant Portal (self-serve export/deletion where available) or direct request to support@moonlightai.ca.
9. Audits & Compliance
9.1 Upon reasonable written request (no more than once per calendar year), the Processor shall make available to the Controller information necessary to demonstrate compliance with this DPA.
9.2 The Processor shall permit and contribute to audits conducted by the Controller or a qualified third-party auditor appointed by the Controller, subject to reasonable advance notice and confidentiality obligations.
9.3 Audit costs shall be borne by the Controller, unless the audit reveals a material non-compliance by the Processor.
10. Cross-Border Data Transfers
10.1 The Controller acknowledges that certain Sub-Processors (specifically Twilio, Google Gemini Live, and Stripe) may process data outside of Canada (in the United States). The Processor ensures that all cross-border transfers are protected by contractual safeguards equivalent to those required under PIPEDA and, where applicable, Standard Contractual Clauses (SCCs) under GDPR. Where the In-Room Clinical Transcription Add-On is enabled, additional cross-border processing of PHI occurs as described in Schedule B, Section B.6.
10.2 The Processor shall not transfer Personal Data to any jurisdiction that does not provide an adequate level of data protection without the Controller’s prior written consent.
11. Term & Termination
11.1 This DPA shall remain in effect for the duration of the Master Service Agreement.
11.2 Upon termination, the Processor shall, within thirty (30) days, delete or return all Personal Data in its possession, except as required by law or as permitted under Section 3 (retention periods for audit records and operational logs).
11.3 The Processor shall provide written certification of data deletion upon the Controller’s request.
12. Governing Law
12.1 This DPA shall be governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein.
12.2 For Controllers subject to GDPR, the provisions of GDPR shall take precedence over any conflicting provisions in this DPA to the extent required by law.
Schedule B — In-Room Clinical Transcription Add-On (Business Associate Terms)
This Schedule creates PHI-processing obligations materially broader than the body of this DPA and is being finalized with legal counsel. It is written to match the system described in the Company’s internal HIPAA transcription compliance reference. The Add-On is not enabled for any Controller until this Schedule, or an equivalent standalone Business Associate Agreement, is executed by both parties.
B.1 Applicability. This Schedule applies only where (a) the Controller has enabled the In-Room Clinical Transcription Add-On (the “Add-On”), and (b) the parties have executed this Schedule (or a standalone Business Associate Agreement incorporating equivalent terms). Absent (b), the Add-On shall not be enabled and no PHI shall be processed under it.
B.2 Roles. For the Add-On, the Controller is the Covered Entity (HIPAA) and/or Health Information Custodian (PHIPA). The Processor is a Business Associate and, where the Controller contracts on behalf of downstream clinics (e.g. a dental support organization or managed-service provider), the Processor is a subcontractor Business Associate, and this Schedule flows the Covered Entity’s protections down to the Processor. The Controller is responsible for having a Business Associate Agreement in place with each downstream Covered Entity whose PHI is processed through the Controller’s account.
B.3 Permitted uses and disclosures. The Processor shall use and disclose PHI processed under the Add-On solely to perform the Add-On for the Controller — namely: real-time transcription of a provider-recorded consultation, generation of a structured clinical note, delivery of that note and the verbatim transcript to the Controller’s Google Workspace, and maintenance of a limited index record (B.5). The Processor shall not use or disclose PHI for any other purpose, including its own product development, analytics beyond aggregate service metrics that contain no PHI, marketing, or the training, fine-tuning, evaluation, or improvement of any AI or machine learning model (this prohibition is absolute and mirrors Section 4.1).
B.4 PHI processed. The Add-On processes: consultation audio; the resulting transcript text; the AI-generated clinical note; and patient identifiers associated with the visit (patient name, telephone number, appointment date, treating provider, session duration).
B.5 Storage, location, and retention.
| Data | Where it is stored | Retention |
|---|---|---|
| Consultation audio | Not stored by the Processor or its sub-processors. Held in server memory only during the session and discarded immediately after transcription. | None |
| Transcript text (in transit for processing) | AWS Simple Queue Service (ca-central-1), transiently, pending note generation | Auto-deleted within 24 hours (7 days in the dead-letter queue on processing failure) |
| Clinical note + verbatim transcript | The Controller’s own Google Workspace (Google Drive) — owned and controlled by the Controller | Controlled by the Controller; the Processor does not delete these files |
| Index record (patient name, phone, appointment date, provider, duration, note-document URL, status) | The Processor’s PostgreSQL database (ca-central-1), encrypted at rest, isolated per-Controller by database row-level security | Retained for the Controller-configured period (“Clinical Notes Retention Days”), which the parties set to match the Controller’s own legal records-retention requirement (commonly several years; default 365 days if not set); automatically deleted after that period. The Controller may also delete individual records earlier via the Tenant Portal or by request. |
| Service audit events (patient name, provider, event reference) | The Processor’s DynamoDB audit store (ca-central-1), encrypted at rest | Auto-deleted after 90 days |
B.6 Cross-border processing. The Controller acknowledges that consultation audio is transcribed by Amazon Transcribe in the United States (us-east-1) and the transcript is processed by Amazon Bedrock in the United States (via AWS cross-region inference). Both are HIPAA-eligible AWS services operated under the AWS Business Associate Addendum; neither stores inputs after processing nor uses them to train models. All persistent storage of PHI by the Processor (B.5) remains in Canada (ca-central-1). Where the Controller requires that no PHI be processed outside Canada, the parties shall agree in writing to a Canada-only processing configuration before the Add-On is enabled.
B.7 Safeguards. The Processor shall maintain administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, including: encryption of PHI at rest (AWS KMS) and in transit (TLS 1.2+); database row-level tenant isolation enforced by the database engine for the index record; private-network database access with no public endpoint; least-privilege, MFA-protected production access; and provider-initiated-only recording (the Processor’s systems cannot start a recording).
B.8 Sub-contractors. The Processor shall ensure that each sub-processor that creates, receives, maintains, or transmits PHI under the Add-On (Section 5.1: AWS, including Transcribe and Bedrock; Google Workspace as the Controller’s own environment) is bound by written terms no less protective than this Schedule, including via the AWS Business Associate Addendum. The Processor shall obtain and maintain the AWS Business Associate Addendum before enabling the Add-On for any Controller.
B.9 Breach notification. In addition to Section 7, upon discovery of a Breach of Unsecured PHI processed under the Add-On, the Processor shall notify the Controller without unreasonable delay and no later than the shorter of (i) seventy-two (72) hours or (ii) the period the Controller reasonably requires to meet its own notification obligations to affected individuals, the U.S. Department of Health and Human Services, and/or the applicable Canadian regulator. The notification shall include the information in Section 7.2 plus, to the extent known, the identification of each individual whose PHI was or is reasonably believed to have been involved.
B.10 Individual rights. The Processor shall, within ten (10) business days of a Controller request: provide the Controller access to the index record for the relevant individual; incorporate an amendment the Controller directs; and provide information needed for the Controller’s accounting of disclosures. The Controller may access and amend the clinical note and transcript directly in its own Google Workspace. For deletion, the Tenant Portal provides a self-service action that permanently removes the selected index record(s) and the corresponding clinical-note document(s) from the Controller’s Google Drive in a single step; the Processor will also action a deletion request received directly. The Controller is responsible for ensuring any deletion is consistent with its own records-retention obligations.
B.11 Consent and point-of-care notice. The Controller is solely responsible for informing patients, before recording begins, that an AI-assisted tool is used to transcribe the consultation and generate the clinical note, and for retaining evidence of that notice, as set out in the Client Disclosure Directive, Section 5. The Processor is responsible for ensuring recording cannot begin without the provider’s explicit trigger and for discarding a session’s data where the provider cancels the session before completion.
B.12 Return or destruction on termination. On termination of the Add-On or this DPA, the Processor shall, within thirty (30) days, delete all index records and any residual processing copies of PHI in its systems, and shall certify the deletion in writing on request. The clinical notes and transcripts in the Controller’s Google Workspace are unaffected and remain the Controller’s. The Controller shall revoke the Processor’s Google Drive authorization on termination.
B.13 No independent right. The Processor has no right to use or disclose PHI processed under the Add-On except as this Schedule permits or as Required by Law.
How This Agreement Is Entered Into
The body of this DPA (Sections 1–12) is incorporated into and forms part of the Master Service Agreement / Terms of Service, and is accepted when the Controller subscribes to the Service. Where required, the Company will also execute a countersigned copy on request.
Schedule B is executed separately, per Controller, before the In-Room Clinical Transcription Add-On is enabled — by electronic signature (via our e-signature sub-processor) or as a standalone Business Associate Agreement. Contact support@moonlightai.ca to request Schedule B or a standalone BAA.
15336732 CANADA INC. d/b/a Moonlight AI™
35 Limnos Lane, Stittsville, ON, Canada K2S 0V5
GST/HST: 791350556 RT0001 · support@moonlightai.ca