Policy updates

Adapted from the Basecamp open-source policies (https://github.com/basecamp/policies, commit 05fb1f9ddaaf604fc5816990fa66f3ffd7f0a462) / CC BY 4.0. Source file: updates/index.md, with the change rules in terms/index.md and privacy/regulations/dpa/Data_Processing_Addendum_current.pdf section 5. See Changes from the template.

This page says how and when we tell clinics that a policy or a subprocessor has changed.

True today, and what applies to real clinics

Today there are no clinics to notify. The policies live as Markdown files in this repository, and every change is a git commit. The notification channel and the notice periods below are open items. They must be set before the first clinic signs.

Where the current version lives

The current version of each document is the one in docs/legal/ on the main branch, listed in README.md. Each document shows its "Last updated" date. The git history of each file is the change log.

Clinics will not have access to this repository. Before the first clinic signs, we publish the documents at [POLICY PAGE URL] (open item L28).

How we notify clinics

We send a notice by email to the account owner of every client clinic, and to [ADDITIONAL CONTACT] if the clinic names one (open item L26). The notice says:

• which document changed
• what changed, in plain words
• the date the change takes effect
• what the clinic can do if it disagrees

When we notify

A change that the law requires, or that responds to a security incident, can take effect sooner. We say why in the notice.

If a clinic disagrees

• Subprocessor change. A new subprocessor needs the clinic's written agreement. If the clinic refuses, we do not use it for that clinic, or either party may end the contract without a charge. For a change an upstream provider announces, we forward the notice within 1 working day and ask for the clinic's answer within 5 calendar days. Section 8 of the Data Processing Addendum sets out the rest.
• Other changes. The clinic may end the Agreement before the change takes effect, as set out in the Terms of Service.

Patient-facing documents

When a change affects what callers are told, for example a new subprocessor in another country or a change to recording, we tell the clinic in the same notice. The clinic updates its patient privacy notice and, where needed, the agent's opening message. Drafts are in privacy-notice-pt-pt.md and ai-disclosure-wording.md.

Changes from the template

• Replaced the notice that 37signals moved its updates to a website with our own notification process.
• Added who is notified, what a notice contains, the notice table and the objection route, drawn from the change rules in the 37signals Terms and DPA.
• Added the effect of changes on patient-facing documents.
• Made the channel, the periods and the public URL open items.