Data processing agreement (eKlinika)

Version 2026-11-05

Each clinic reads and accepts this agreement inside eKlinika (Settings › Subscription), filled in with its own name, NIPT and address, and downloads a copy. This page shows the same text for reference.

This agreement is between the clinic or dental practice that subscribes to eKlinika, "the Clinic", which is the controller of the personal data it keeps in eKlinika, and TeamByte SHPK (NUIS M61810052H, Rr. Thoma Koxhaj, Tiranë, Albania), "TeamByte", which provides eKlinika and is the processor of that data. It forms part of the Clinic's eKlinika subscription and follows the law of the Republic of Albania on the protection of personal data and, where it applies, the EU General Data Protection Regulation.

1. What TeamByte processes, and why

• Purpose: only to provide eKlinika to the Clinic: keeping, showing, searching, printing and sending the Clinic's data as the Clinic uses the software, backing it up and keeping it secure.
• Data subjects: the Clinic's patients (including children, with their parents or guardians) and their contacts, people who book appointments or write through the Clinic's website, the Clinic's staff.
• Kinds of data: names, ID numbers, dates of birth, contact details, appointments and the reason for the visit, the medical file (allergies, conditions, medicines, blood group, notes), treatments, X-rays, results and other documents, notes, messages, invoices and payments, and the Clinic's staff accounts. Health data is a special category of personal data: TeamByte stores the medical file and the reason for the visit encrypted, and treats all of it as confidential.
• Duration: as long as the subscription lasts, and afterwards as described in section 9.

2. Only on the Clinic's instructions

TeamByte processes the data only on the Clinic's documented instructions: this agreement, the settings the Clinic chooses in eKlinika and what the Clinic's staff do in it. TeamByte never uses the data for its own purposes, never sells it and never uses it to train artificial intelligence. If the law requires TeamByte to do otherwise, it tells the Clinic first, unless the law forbids that.

3. Confidentiality and medical secrecy

TeamByte knows that the Clinic's doctors and staff are bound by medical secrecy. TeamByte never puts patient names or health data in alerts, staff emails, Telegram messages or its own logs. Only the few TeamByte people who need it to run, secure or support eKlinika can reach the data, and each of them is bound to confidentiality. TeamByte staff open a Clinic's admin only to help it, through a "support sign-in" that the Clinic sees on screen and that is written to the Clinic's activity log with the person's email.

4. Security

TeamByte keeps appropriate technical and organisational measures, including:

• encrypted connections (HTTPS) everywhere, and passwords, keys and secrets stored encrypted;
• each clinic's data kept apart from every other clinic's;
• a second sign-in step (an emailed code, or an authenticator app) for staff, and roles that limit who sees what, down to restricted treatments, and a log of who opened each patient's medical file;
• an activity log of who did what;
• regular backups, kept apart from the main server, and restore tests;
• updates and security fixes applied promptly.

5. Sub-processors

The Clinic allows TeamByte to use the sub-processors listed below. TeamByte binds each one to data protection duties at least as strict as these, and stays responsible for them. TeamByte tells the Clinic about a new or replaced sub-processor at least 30 days before, by email and in eKlinika, and the Clinic may object for a reasonable cause; if no solution is found, the Clinic may end its subscription and is refunded for the unused period. Services marked "only if switched on" receive data only when the Clinic switches them on in Settings › Integrations.

6. Helping the Clinic

TeamByte helps the Clinic, as far as it can, to answer requests from data subjects (access, correction, deletion, restriction, portability), to keep its data secure, to assess data protection risks and to deal with the supervisory authority (the Commissioner for the Right to Information and the Protection of Personal Data). Most of this the Clinic can do itself in eKlinika.

7. Personal data breaches

If TeamByte becomes aware of a breach affecting the Clinic's data, it tells the Clinic without undue delay and at the latest within 48 hours, with what is known (what happened, which data, likely consequences, what is being done), and keeps it informed. Notifying the authority and the people affected remains the Clinic's decision as controller; TeamByte helps.

8. Where the data is kept

The data is kept on servers in the European Union and in Albania. If TeamByte ever transfers data elsewhere, it does so only with safeguards the law accepts, and it tells the Clinic first.

9. At the end of the subscription

• If a payment is missed, eKlinika first keeps working, then becomes read-only for the period shown on Settings › Subscription: the Clinic can still sign in, see, print and download everything.
• During that period, and on request, TeamByte gives the Clinic a copy of its data in a common format.
• After that period, TeamByte deletes the Clinic's data, including from backups as they cycle (within 30 days), unless the law requires TeamByte to keep some of it. Invoices TeamByte issued to the Clinic are kept as tax law requires.

10. Audits

TeamByte gives the Clinic the information needed to show it keeps to this agreement. The Clinic, or an auditor bound to confidentiality, may audit it once a year with 30 days' notice, at the Clinic's cost, without seeing other clinics' data.

11. Liability, changes and law

Liability follows the Clinic's subscription terms. TeamByte may update this agreement, for example for a change in the law; the Clinic is told 30 days before, and the new version is shown in eKlinika to be accepted. This agreement is governed by the law of the Republic of Albania, and the courts of Tirana decide disputes.

Contact for data protection: [email protected]