Roles
The practice acts as controller; Consential acts as processor.
Scope of processing
Consent events only — Consential never receives or stores clinical/PHI data itself.
Subprocessors & cross-border transfer
AWS (HIPAA-eligible services) as primary infrastructure; no cross-border transfer by default.
Security measures
Encryption at rest and in transit, append-only audit tables, multi-tenant isolation enforced at the query layer.
Breach notification timeline
Notification commitments to be finalized with counsel.
Audit rights
What a practice can request to verify compliance.