Umowa o przetwarzaniu danych

This agreement is made between the center or specialist entering data into ProABA (the "Controller") and individual entrepreneur (Ukrainian FOP) Yuliia Anatoliivna Lastovetska, providing the ProABA service (the "Processor"), contact address julia.lastovetska@gmail.com.

The Controller decides whose data is entered and for what purpose. The Processor stores and displays that data on the Controller's instructions and does not use it for its own purposes.

The agreement takes effect when the owner of the center accepts it in the application and remains in force for as long as the center uses ProABA.

The Processor stores and processes data solely to allow the Controller to run development programs for its students: creating targets, recording probes, keeping a behavior log, preparing reports and running online sessions.

Processing continues for as long as the Controller holds an account in ProABA. After termination the data remains available for export for a further 90 days, after which it is deleted at the Controller's request.

The Processor makes no decisions concerning children, delivers no therapy and does not interfere with the content of programs.

Data subjects: children receiving therapy from the Controller; their parents or guardians; the Controller's specialists and curators.

Children's data: name and surname or code, date of birth, sex, diagnosis and clinical notes, address and parents' contact details, therapy targets, probe results, observations, photo and audio material, and video of online sessions while they take place.

Specialists' data: email address, name and surname, role within the center, selected language, technical sign-in records.

Data concerning a child's health falls under the special categories of Article 9 GDPR. The Controller confirms that it holds written consent from the parents or guardians for its processing.

The Processor undertakes to:

process data only on the Controller's documented instructions and only to the extent required to operate the service;

ensure that access is limited to personnel who need it and that they are bound by confidentiality;

assist the Controller in responding to requests from parents exercising their rights: access, rectification, erasure and receiving a copy;

give the Controller the ability to export all of its data in ordinary files at any time, without contacting the Processor;

inform the Controller if, in the Processor's opinion, an instruction infringes data protection law.

The Controller gives general authorization for the engagement of subprocessors. The Processor remains liable for their acts as for its own and concludes with each of them an agreement no less strict than this one.

As of the revision of this agreement, the following are engaged:

Supabase Inc. (USA; data hosted in the EU region, Ireland) - database, file storage and authentication. Receives all data entered by the Controller.

Vercel Inc. (USA) - application hosting. Receives technical request data: IP address, browser type, pages opened.

Daily.co (USA; servers in the EU and USA depending on the connection) - video and audio for online sessions. Receives the session stream while it is running. Recording is enabled only with separate consent from participants.

Resend Inc. (USA) - delivery of service emails. Receives the recipient's email address and name.

The AI assistant (Google, Gemini API) receives only the text of users' questions and the name of the screen; it does not receive data entered by the Controller.

The Processor informs the Controller of any replacement or addition of a subprocessor at least 30 days in advance by email to the organization owner. Within that period the Controller may object; if the parties do not reach agreement, the Controller may terminate this agreement.

The Processor applies technical and organizational measures appropriate to the risk:

encryption of data in transit (TLS/HTTPS) and at rest;

access control enforced at row level in the database, so that a specialist sees only the students they have been granted access to;

an audit log showing who changed clinical records and when;

daily backups with integrity verification;

a separate read-only mode for parents, enforced at database level and not only in the interface.

In the event of a personal data breach the Processor notifies the Controller without undue delay and no later than 48 hours after becoming aware of it.

The notification states the nature of the breach, the approximate number of data subjects and records affected, the likely consequences and the measures taken.

The obligation to notify the supervisory authority and the parents rests with the Controller. The Processor provides all information required for such notification.

The Controller may at any time export all of its data from the application: prepared documents for each student, the original uploaded files and a complete machine-readable dump.

After termination the data remains available for export for a further 90 days. Thereafter, at the Controller's choice, the Processor returns or deletes it.

Backup copies are retained for a limited period and overwritten on a schedule. Data is not restored from them after deletion at the Controller's request, except where retention is required by law.

Separately: the Controller may move a student to the archive. Archived data is retained for as long as the ethical code of the behavior analyst requires and does not count towards the plan limit.

The Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement.

The Controller may carry out an audit no more than once a year, giving 30 days' notice, or mandate an independent auditor to do so. An audit must not compromise the confidentiality of other clients' data.

The cost of the audit is borne by the Controller, except where the audit reveals a breach by the Processor.

Clinical data is stored in the EU region. Certain subprocessors listed in section 5 are established in the USA and receive part of the data.

Such transfers take place on the basis of the European Commission's Standard Contractual Clauses or, for services certified under the EU-U.S. Data Privacy Framework, on the basis of that adequacy decision.

The Processor does not disclose data to public authorities of third countries except where required by law, and informs the Controller of any such requirement unless prohibited from doing so.