Data processing agreement

The HC Sync DPA applies to every customer, including Free, and is incorporated into the Terms. It covers processing customer health records, security, assistance, subprocessors, deletion and international transfers. Records expire 13 months after their start time unless deleted earlier. This DPA prevails over conflicting Terms on personal data.

Last updated: 2026-11-04. Source for the 2026 service details: HC Sync page details.

Effective 3 November 2026. This DPA is incorporated into the Terms for every customer, including Free. The customer accepting the Terms is the controller (or processor acting for its controller); Shahar Frish, operating HC Sync, Israel, is the processor (or subprocessor). Contact: shaharfrish6@gmail.com. This DPA prevails over conflicting Terms on personal data; mandatory transfer clauses prevail over both.

What processing and instructions does the DPA cover?

The subject matter is hosting, syncing, storing, retrieving, exporting and deleting customer health records and delivering webhooks for the duration of the project. Processing is continuous as the customer uses the service. Data subjects are the customer's app users. Data includes pseudonymous user ids, Health Connect record ids, timestamps, sources and selected health values including steps, sleep, exercise and heart rate. Health values are special category data. No direct identifiers should be placed in user ids. The customer determines purposes, types, users, recipients and retention within service limits and is responsible for a lawful basis, explicit consent where required, and notices.

We process personal data only on documented customer instructions, including API calls, configuration and instructions about transfers, unless applicable law requires otherwise. We inform the customer of a legal requirement before processing unless prohibited by law. We immediately inform the customer if we believe an instruction infringes applicable data protection law. We do not sell health data, use it for advertising or train models on it.

What confidentiality and security duties apply?

We ensure anyone authorized to process customer data is bound to confidentiality. We implement and maintain technical and organizational measures appropriate to risk under Article 32: HTTPS transport, project-scoped authorization, per-user write tokens, hashed secret keys, controlled access to hosting and database systems, and deletion controls. The security page describes current measures and limitations. We restrict access to what is needed to operate the service or resolve a reported problem, and review measures as risks change. These duties are not a claim of independent certification.

How are breaches and assistance handled?

We notify the customer without undue delay after becoming aware of a personal data breach, using the project's contact email, providing the known nature, affected categories and approximate numbers, likely consequences, contact details and mitigation measures. We provide further information as it becomes available and cooperate with containment and notification duties.

Taking account of the nature of processing and information available, we assist the customer with access, rectification, erasure, restriction, portability, objection and other data subject rights through appropriate technical and organizational measures. We forward requests about customer data to the customer and do not answer on its behalf without instructions unless required by law. We assist with security duties, breach notifications, impact assessments and supervisory authority consultations under Articles 32–36.

Which subprocessors support HC Sync?

The customer generally authorizes the listed subprocessors. We bind them to written obligations providing equivalent data protection, including appropriate transfer safeguards, and remain responsible for their performance. We give at least 30 days' advance notice by project contact email of an intended addition or replacement. The customer may object on reasonable data protection grounds during that period by emailing us. We will work to resolve the objection; if unresolved before the change, the customer may end the affected service and receive a prorated refund of unused prepaid fees. We will not use the disputed subprocessor for that customer's data before resolution or termination.

How do export, deletion and audits work?

Customers must self-export before termination: page through GET /v1/users, then page through GET /v1/records for each user_id with explicit from and to dates covering their retention window; the default records query covers only seven days. There is no project-wide export endpoint. On termination we delete remaining personal data unless law requires retention. Complete export before DELETE /v1/project, which immediately removes access and is irreversible. Records expire 13 months after their start time unless deleted earlier. We instruct subprocessors to delete or return relevant data and disclose any legally required retention and its duration.

We provide information needed to demonstrate compliance with this DPA and Article 28, and allow and contribute to audits and inspections by the customer or its mandated independent auditor. Arrange scope and timing by email to protect other customers and service security; these arrangements do not prevent legally required audits or urgent investigations. We notify the customer if an audit instruction would infringe data protection law.

What safeguards apply to international transfers?

Data is stored in the US; HC Sync is operated from Israel. Where a transfer requires safeguards, the EU Standard Contractual Clauses, Decision 2021/914 are incorporated by reference without modification: Module Two for controller-to-processor transfers or Module Three where the customer is a processor. Clause 7 applies; Clause 9 uses general authorization with 30 days' notice; the optional wording in Clause 11 does not apply. Irish law and Irish courts apply under Clauses 17 and 18. The competent supervisory authority is determined by Clause 13.

For the SCC Appendix: the exporter is the customer identified by its project and account contact; the importer is Shahar Frish, Israel, at the contact above. Acceptance of the Terms constitutes signature and date. Annex I processing and sensitive-data details are those above; Annex II measures are the security duties above; Annex III is the subprocessor list. Purpose limitation, restricted access and retention and deletion duties apply to sensitive data. Parties will supply further necessary particulars and assess transfer risks and supplementary measures before a transfer requiring them; a reference alone is not a completed transfer assessment.

For UK restricted transfers, the ICO International Data Transfer Addendum, version B1.0 is incorporated: Table 1 uses the parties above; Table 2 uses these SCC modules and selections; Table 3 uses the Appendix details above. For Table 4, neither party may end the Addendum under Section 19. Its mandatory clauses apply and prevail for UK transfers. We cooperate with necessary transfer assessments and do not proceed if required safeguards cannot be met.