Data processing

1. Two roles, two contexts

For the data you provide through this website (e.g. the diagnosis form), Alky Club LTD is the data controller. Read more in our privacy policy.

When we deploy NORA at a clinic and the system processes data about the clinic's patients — names, contact details, appointments and enquiries — Alky Club LTD acts as data processor on the clinic's behalf. The clinic remains the data controller and determines the purpose of the processing.

2. The data processing agreement (Art. 28 GDPR)

Before NORA goes live at a clinic, we sign a written data processing agreement with the clinic. Among other things, the agreement sets out:

• The subject matter, duration, nature and purpose of the processing, as well as the type of personal data and categories of data subjects.
• That we only process personal data on documented instructions from the clinic.
• That persons with access to the data are subject to a duty of confidentiality.
• That we implement appropriate technical and organisational security measures.
• That we assist the clinic in responding to data subjects' rights and in complying with obligations under Articles 32–36 GDPR.
• That all data is deleted or returned, at the clinic's choice, when the collaboration ends.

3. Health data

Patient enquiries may contain health information covered by Article 9 GDPR. We process such data exclusively on the clinic's instructions and with the enhanced security measures required by law. We never use patient data for our own purposes.

4. Sub-processors

We use sub-processors for hosting, email, telephony and infrastructure. All sub-processors are covered by data processing agreements with guarantees equivalent to those we offer the clinic, and an up-to-date list is made available to the clinic on request.

The clinic is notified before a sub-processor is added or replaced, and the clinic has the opportunity to object.

5. Location and transfers

Our infrastructure is hosted in the EU. Should a transfer to a third country ever become necessary, it will only take place under an adequacy decision or the European Commission's standard contractual clauses, and the clinic will be informed in advance.

6. Security measures

• Encryption of data in transit and at rest.
• Role-based access control with least-privilege access.
• Event logging (audit log) and traceability of the system's actions.
• Procedures for handling and notifying personal data breaches without undue delay.

7. Artificial intelligence and transparency

NORA expressly identifies itself as a digital assistant, as required by Regulation (EU) 2024/1689 on Artificial Intelligence. Workflows are designed with transparency, logging and the ability for the clinic's staff to take over the conversation at any time.

8. Contact

Questions about data processing, or a request for a draft data processing agreement: write to team@resolcia.com.