Trust & compliance
Agreements
nou is built for clinicians worldwide. Product controls are global; signed legal papers depend on where the practice is and whether real patient data will be hosted. Templates below are for counsel — they are not binding until both parties sign.
What applies where
| Region | If real patient data is hosted | Paper to sign |
|---|---|---|
| United States | HIPAA covered entity / PHI | Business Associate Agreement (BAA) |
| United Kingdom | UK GDPR health data | Data Processing Agreement (DPA) + DPIA by controller |
| EU / EEA | GDPR special-category data | Art. 28 DPA + DPIA by controller; SCCs if needed |
| Australia | APP / health information | Service agreement + privacy terms; local counsel |
| Canada | PIPEDA / provincial health privacy | Service + BA-style terms; provincial rules |
| Other | Local health privacy law | Counsel-led addendum using nou templates as base |
Always true (product)
- Clinician (or their organisation) remains controller of case content
- Invite-only access; no open registration
- AI drafts are provisional and clinician-owned
- Transactional email never contains clinical case content
- Until the right paper is countersigned, use de-identified / demo data only for hosted PHI/health data
How to get a signed paper
- Pick your region tab (US BAA or UK/EU DPA) and copy the template.
- Send it to your healthcare / privacy counsel.
- Use Request signed pack so nou ops can countersign after redlines.
- Both parties sign (DocuSign, Adobe Sign, or wet ink).
- nou records the effective date and unlocks hosted production use for that organisation.
DPIA: the controller (practice/clinician organisation) owns the DPIA under UK/EU rules. nou can supply a processor questionnaire and security pack to support it — request via ops.
Not legal advice. Final agreements must be reviewed by qualified counsel in the relevant jurisdiction(s).