Data Processing Agreement

Roles and scope

The organization is the controller of the personal information it directs into the platform — applicant details, hiring decisions, internal notes, close-out outcomes. LocuPedia acts as a processor/service provider for that data, processing it only to operate the platform and as these terms instruct. Each side is responsible for the lawfulness of its own use.

What processing covers

Hosting and displaying coverage posts; receiving and delivering applications and messages; credential verification status; team, role and audit records; posting-fee billing records. Processing lasts for the life of the account plus the retention periods in the privacy policy — including the 12-month purge of individual application records after a post closes.

Security measures

Individual accounts with role-based access; secure document handling; a reviewable audit record of sensitive actions (role changes, suspensions, ownership transfers); access to clinician identity documents restricted to verification review. The current state of these measures is described on the security & privacy page.

Sub-processors

We use a small number of service providers (for example, hosting and payment processing for posting fees). Each is bound by contractual protections consistent with Canadian privacy law, and payment card details are handled by the payment processor — LocuPedia stores only brand, last four digits and expiry. We’ll update this page if material sub-processors change.

Breach notification

If a security incident affects personal information we process for your organization, we will notify you without undue delay, describe what happened and what we’re doing, and cooperate on any notification obligations you have.

Location, retention and deletion

Data is stored and processed in Canada. On account closure, organization and applicant data is deleted or de-identified according to the privacy policy’s retention schedule, subject to legal holds and billing-record requirements under Canadian tax law.

Assistance and audit

We’ll reasonably assist with access, correction and deletion requests that reach you as controller — most are self-serve in the product. Questions about this DPA, or requests for a countersigned copy for your records: contact us.