# GDPR and data protection roles (/docs/en/trust/gdpr)



This page summarises the published [privacy policy](https://salisan.com/legal/privacy) and [Terms of Service](https://salisan.com/legal/terms). If this page and those documents differ, the documents apply.

## Who is responsible for what [#roles]

For patient data, and for records a practice keeps about its own team, such as audit logs, the practice is the controller. Salisan, Inc. is the practice's processor under a data processing agreement. The Terms say the DPA prevails over the Terms for personal data.

Salisan is the controller for its own data: website visits, sales and demo requests, accounts, billing, support, marketplace publishers and contract records. The privacy policy lists the purpose, legal basis and retention for each.

Patients who contact Salisan are sent back to their practice. Salisan forwards the request.

## Data processing agreement [#dpa]

The Terms state that the DPA forms part of the agreement. The page at [salisan.com/legal/dpa](https://salisan.com/legal/dpa) exists, but its text is not published yet. It is marked as pending legal review and not authoritative.

Salisan has not published the DPA text, its date or its version. To request the current draft or the agreement that applies to your practice, write to [privacy@salisan.com](mailto:privacy@salisan.com).

## Subprocessors [#subprocessors]

The register at [salisan.com/legal/subprocessors](https://salisan.com/legal/subprocessors) is published as pending review with no entries. Salisan has not published an approved subprocessor list yet.

The privacy policy names these service providers:

| Provider                      | Service                                                         | Location                                   |
| ----------------------------- | --------------------------------------------------------------- | ------------------------------------------ |
| Amazon Web Services EMEA SARL | Hosting, storage, email delivery and translation                | EU (Germany)                               |
| Requesty                      | AI processing, routing requests to AI model providers in the EU | EU endpoint; company in the United Kingdom |
| Stripe                        | Payments and invoicing                                          | EU and United States                       |
| Google Workspace              | Company email                                                   | EU and United States                       |
| Cal.com                       | Demo scheduling                                                 | EU and United States                       |

The policy says Requesty's model providers act as its subprocessors. Stripe, Google Workspace and Cal.com are listed for payments, company email and demo scheduling. For the model providers behind Requesty, see [How the AI works](/docs/en/trust/how-the-ai-works#providers).

## Your duties as controller [#controller-duties]

The Terms leave these to the practice:

* Having a lawful basis for processing patient data, informing patients, and meeting record-keeping and professional secrecy obligations.
* Checking whether national rules on cloud services in healthcare apply, and following them.
* Informing participants and getting any consent the law requires before recording or transcribing a conversation. Salisan does not collect or record consent for you.
* Telling patients and others where the law requires it that AI is used in their care documentation or in communications they receive.

## Contact and complaints [#contact]

For privacy questions and rights requests, write to [privacy@salisan.com](mailto:privacy@salisan.com). Salisan replies within one month and may ask you to verify your identity.

The privacy policy names an EU representative under Article 27 GDPR and gives a postal address for Salisan, Inc. It does not name a data protection officer. A person can complain to a data protection authority, for example the Autoriteit Persoonsgegevens in the Netherlands.

For a suspected personal data breach, the policy says Salisan will notify those affected and the authorities as the law requires. Report suspected unauthorised access to your account to [privacy@salisan.com](mailto:privacy@salisan.com) without delay.