Data Processing Agreement

This DPA governs Wilma's processing of personal data — including PHI — on behalf of Customer in connection with the Wilma platform. It incorporates the Standard Contractual Clauses where required and the HIPAA Business Associate terms required by 45 CFR § 164.504(e).

Customer is the Controller of personal data and the Covered Entity under HIPAA. Wilma is the Processor and Business Associate.

• Subject matter: answering patient phone calls and text messages, scheduling, insurance verification, recall outreach, intake.
• Duration: the term of the underlying subscription, plus any limited period required for export and deletion.
• Nature & purpose: operating the front desk of the dental practice on its behalf.
• Data subjects: patients of the practice, practice staff, authorized callers.
• Categories of data: contact information, appointment history, insurance and benefits, clinical notes shared by the practice, call audio, transcripts.

• Process personal data only on documented instructions from Customer.
• Ensure that personnel are bound by confidentiality.
• Implement the security measures described in our Security page.
• Assist Customer in responding to data subject requests.
• Notify Customer without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach.
• Make available all information necessary to demonstrate compliance.

Customer authorizes Wilma to engage subprocessors as listed on our Subprocessors page. Wilma imposes terms on each subprocessor that are no less protective than this DPA. We'll give Customer at least 30 days' notice of any change to subprocessors handling PHI.

We process personal data in U.S. regions. Where Customer is located in the EEA, UK, or Switzerland, the Standard Contractual Clauses (SCCs) apply by reference.

Customer may, no more than once per calendar year and with reasonable notice, audit Wilma's compliance. We'll generally satisfy this requirement by providing our SOC 2 Type II report, penetration test summary, and HIPAA security rule assessment.

At the end of the term, Wilma will (at Customer's choice) return or delete all personal data within 60 days, subject to legal-hold obligations.

If you're evaluating Wilma and need the executable DPA for legal review,email our legal team or ask your sales contact. Existing customers can find their signed copy in the dashboard under Settings → Legal.