The contract that governs how ClinicalRIS processes patient data on behalf of your organization — with annexes for Ghana, Nigeria, the EU/UK, and a HIPAA Business Associate Agreement for US clients.
Version 1.0 · Effective October 16, 2026
Your organization (the hospital or imaging center) is the Data Controller: you decide why patient data is collected. ClinicalRIS, operated by Claridad Health Solutions, is the Data Processor: we process that data only on your documented instructions. The DPA sets out both parties' obligations — security, sub-processors, international transfers, breach notification, patient rights support, and what happens to the data when the contract ends.
The full agreement is available for download above. The summary below highlights the key commitments.
We process patient data only to deliver the service, never for our own purposes. No data selling, no marketing use, no AI training on your studies.
A published sub-processor list, notice before changes, and objection rights.
Security incidents affecting patient data are reported to you without undue delay — target within 48 hours — with the details you need for your own regulatory deadlines.
The agreement states where data is processed (currently the US primary region, EU available) and the transfer safeguards that apply, including standard-clause terms where required.
When a center administrator first logs in, the platform presents this agreement for acceptance before the dashboard becomes available, and records who accepted which version and when. Signed paper copies can be recorded by our team against your center. Version 2026-10-16 (v1.0) is the current text; material changes re-prompt for acceptance.
| Version | Date | Notes |
|---|---|---|
| 1.0 | October 16, 2026 | Initial publication — core terms and Annexes A–F. |
This page is a summary for information. The downloaded agreement text is the authoritative version. Have your counsel review it — we will gladly discuss edits for enterprise agreements.