# Data Processing Agreement (DPA)
This DPA applies when Vaidya Marketplace processes personal data on behalf of a consultant (controller) or when we act as controller for marketplace accounts.
**Roles:** Patients’ account data — platform as controller. Clinical reports created by a vaidya — vaidya as controller, platform as processor.
**Instructions:** process only to host, display, export, and backup reports; send transactional messages; apply tax/invoicing.
**Security:** encryption in transit, access controls, audit logs of administrative access.
**Sub-processors:** hosting, Stripe, email, optional Twilio WhatsApp, optional Google/Microsoft/Zoom when the vaidya connects them.
**International transfers:** standard contractual clauses where required.
**Deletion:** upon written request after the end of the service, subject to tax retention.
For signatures and country addenda, contact legal@vaidyamarket.com.