Project Line (קו פרויקטים), business No. 310333984 (D-U-N-S 532247086), Keren ha-Yesod 23, 1st floor, office 9, Ashdod 7740412, South District, Israel. Privacy contact: support@projectlineil.com.
Each clinic that signs the Data Processing Agreement (DPA) is an independent controller. The list of controllers and their contact details is maintained in Project Line's internal CRM and is available on supervisory-authority request.
| # | Operation | Categories of data | Categories of recipients | Retention | Transfer outside EU / UK |
|---|---|---|---|---|---|
| 1 | Clinic onboarding | Clinic name, owner identity, billing address | Azure (hosting), payment/invoicing sub-processors (see Sub-processors page) | Contract + 7 years | Azure Israel Central — Israel is covered by the UK adequacy regulations |
| 2 | Patient record storage | Name, DOB, contact, medical record, prescriptions | Azure (storage), payment/invoicing sub-processors (see Sub-processors page) | UK statutory retention (NHS Records Management Code 2023): adult records 8 years after last treatment; children's records to the age of 25 or 26; up to 30 years for specific record types — measured from last clinical activity, then securely purged | Azure region per clinic |
| 3 | AI voice receptionist | Caller phone, call intent, appointment details (no audio or transcript stored) | OpenAI (transient), Twilio (call route) | Call metadata only (number, time, duration); audio and transcript NOT stored | OpenAI: SCC + UK Addendum (ICO) + zero-retention API; Twilio: US-EU SCCs + UK Addendum |
| 4 | Outbound reminders (SMS / WhatsApp) | Phone, name, appointment time | Twilio (SMS), Meta (WhatsApp Cloud API) | Sent log: 1 year | Meta: SCCs + UK Addendum; Twilio: SCCs + UK Addendum |
| 5 | Card-on-file auto-charge | Tokenised payment method (pm_...), not PAN | Stripe (card-on-file is Stripe-only) | Per Stripe DPA; deleted on clinic detach | Stripe: SCCs + UK Addendum + DPF (UK Extension) |
| 6 | Audit logging | Action + tenant id + timestamp | Azure SQL (in-tenant) | At least 7 years | Same region as clinic |
| 7 | Backup / disaster recovery | Encrypted DB snapshot | Azure Backup (in-region) | 7-day rolling PITR | Same region |
Revised whenever a sub-processor is added/replaced (see sub-processors) or when a new processing operation begins. Significant changes are announced to all clinics on at least 30 days' notice (UK GDPR Art. 28(2)).
© 2026 Project Line. All rights reserved.