Data processing agreement (DPA)
Updated 4 September 2026
This DPA describes the processing Revydo performs for your practice once Google is connected. A signed copy is available before you subscribe. Write to privacy@revydo.com.
Roles
You (the practice) are controller of the reviews and replies on your Google Business Profile.
Revydo is a processor under Article 28 GDPR for processing needed to run the service: reading public reviews, classification, drafting, publishing under your rules, logging, alerts.
Instructions
Revydo acts only on your documented instructions: Google connection, autonomy settings, and actions you approve. We do not reuse this data for other customers or for advertising.
Data in scope
Google reviews (public text, rating, date, technical ids), replies, practice settings, action logs, emails of account users.
No health data is collected as a category. If a review incidentally contains some, processing stays limited to public moderation and escalation to you. No patient file is created.
Security
Encryption in transit, organisation-level access control, audit log, EU hosting, minimisation (no email or review text in product analytics tools).
Sub-processors
Infrastructure: Vercel, EU database. Email: Resend. Payments: Stripe. Analytics: PostHog EU. Review platform: Google, via your OAuth.
We inform the practice before adding a sub-processor that handles service data, except an emergency replacement to keep the service secure.
Assistance, incidents, end of contract
We help you with data-subject requests and with security-incident notice within legal deadlines.
At the end of the contract: Google access is revoked, practice data is deleted or returned within a reasonable time, except legal archiving (invoices).