Every clinic gets a signable Data Processing Agreement (DPA), and it isn't just a document between you and us. The same accountability chain extends down to every subprocessor that touches call data. Here's what that chain actually looks like, one link at a time.
One note on terminology: some clinics ask us for a "BAA" (Business Associate Agreement) — the U.S. HIPAA-specific instrument. We're a Canadian company operating under PIPEDA/PHIPA/BC PIPA, so the equivalent document we provide is a Data Processing Agreement (DPA), structured for Canadian privacy law rather than U.S. HIPAA. If your clinic specifically requires a HIPAA BAA, ask us directly — we'll give you a straight answer rather than relabel a Canadian document as something it isn't.
What's in the DPA Between ZeroMiss and Your Clinic
- Roles are explicit: your clinic is the custodian of patient information; ZeroMiss is your service provider (an "agent" under Ontario's PHIPA terminology).
- Purpose limitation: data is used only to deliver the reception service — never resold, never repurposed.
- No training on your data: contractually locked, not just a website claim.
- Retention and deletion terms: your configured schedule, plus secure deletion within 30 days of contract end.
- Breach notification: a specific commitment — your named privacy contact is told by phone and email at the first reasonable opportunity, and no later than 72 hours after we become aware of an incident, including one a provider reports to us.
Why the Chain Doesn't Stop at ZeroMiss
A DPA between your clinic and ZeroMiss means nothing if the infrastructure we rely on isn't bound by equivalent commitments. So every subprocessor in our chain — the systems whose infrastructure actually touches call data — operates under their own agreement with us, covering the same core commitments: no training on the data that passes through, contractual confidentiality, and documented data handling.
Why We Don't Name Our Infrastructure Partners Publicly
Every subprocessor we use is a large, established provider of the kind hospitals and financial institutions already trust with sensitive data — with Canadian data residency options and a Data Processing Addendum of their own that we operate under. We don't publish which specific companies make up our stack on our public website; that's architecture detail we'd rather not hand to competitors doing due diligence on us. It doesn't change what you're entitled to: the full, named subprocessor register — who, what role, what agreement — is available to any clinic evaluating us, under our mutual DPA.
The Full Subprocessor Picture
Our published subprocessor register — by role, location and agreement type rather than company name — covers AI speech processing, real-time call media infrastructure, and Canadian telephony routing, each documented individually rather than bundled into a vague "we use cloud services" statement. The current register is on our Privacy & Compliance page, and updates come with 30 days' notice to clinics before any change.
Frequently Asked Questions
Can our clinic's lawyer review the DPA before we sign?
Yes — that's exactly what it's for. Ask for it any time during evaluation, not just at signup.
Do you sign HIPAA Business Associate Agreements?
We're a Canadian company built around PIPEDA/PHIPA/BC PIPA, not U.S. HIPAA. Our standard agreement is a DPA structured for that framework. If a HIPAA BAA specifically is a hard requirement for your organization, ask us directly for an honest answer on whether we're the right fit.
Why won't you tell us which companies process our data?
We will — to a clinic evaluating us under a mutual DPA, not on a public web page a competitor can read for free. The role, location, and agreement type for every subprocessor is public; the specific company names are shared directly with clinics who ask.
Does our AI infrastructure provider ever get access to identifiable patient information beyond processing the call?
Our AI speech processing subprocessor handles data strictly to power the AI's speech understanding and hosts stored data in Canadian regions — under our Data Processing Addendum with them, with no training on that data. It isn't used for any purpose beyond running your clinic's reception.
What happens if you add a new subprocessor later?
You get 30 days' notice before the change takes effect, with the updated register published on our compliance page — not a silent change buried in a terms update.
Bottom Line
A DPA is only as strong as the chain behind it. Ours extends from your clinic through us to every subprocessor that touches call data — reputable, documented infrastructure, not an unnamed patchwork — with the paperwork to prove it at every link, available directly to any clinic that asks.