Legal & Compliance

Working artefacts for the legal and regulatory side of the platform. This is not the source of truth for platform-side technical compliance — that lives under /security/ (GDPR mechanics, consent flows, data classification) and /reference/ (developer-facing GDPR reference).

This directory holds the artefacts that cross the boundary between RestartiX SRL (the legal entity) and the outside world — counsel briefs, ROPA, DPA templates, DPIAs, sub-processor lists, breach playbooks. They get drafted in-repo, reviewed by counsel, then either ship as platform artefacts (DPA template seeded into the codebase, privacy notice template body in 1B.10) or live here as living legal documents.

Who does what

Actor	Owns
Developer (platform)	Drafting, schema/template/code changes that operationalise legal findings, keeping docs in sync with implementation
RestartiX SRL	Signing engagement letters, paying counsel, designating the DPO, signing DPAs, filing with ANSPDCP when required
Romanian DP counsel	Legal review, binding language, regulator-facing answers (Law 190/2018, Law 95/2006, Ministry of Health orders, ANSPDCP guidance)

Status — 2026-09-06

Nothing here is counsel-reviewed, and the platform is live

All v1 drafts landed 2026-05-15 in advance of the F11.0.5 counsel engagement. That engagement has not run, so every document below is developer-drafted and none is signed. Meanwhile production has served real patients since 2026-06-05, and the September 2026 launch brings the ~20,000-patient legacy population onto the platform.

Every control asserted across this pack was checked against the source code and Terraform on 2026-09-06. Where a control does not exist, the document says so in place; the absent ones are collected under Verified gaps below. What a reviewer should know before reading further:

• The video sub-processor. Live consultations relay Art. 9 media to a US provider — sub-processor #6, TIA T4, DPIA R11, ROPA A8. Nothing is recorded and the media servers are EU-pinned; the Art. 28 contract and the Art. 46 transfer tool are in force by incorporation in the provider's terms. What is open is the shared provider account: video runs on the same account as the legacy system, so the two are un-segregated and the contracting entity is unconfirmed.
• A data-export defect, found and closed. DPIA R13 — the export took its subject from an unauthorised request header and read on a pool RLS does not cover, so any patient could obtain another's archive, including a decrypted CNP. Now resolved from the calling login, with an integration test. The endpoint writes no audit row by design, so whether it was exercised before the fix cannot be determined from logs.
• CNP is built ahead of its legal answer. Encrypted, masked, audited on read, and writable only on a patient-audience path — though that path includes the token-authorised form session a clinic runs on its own tablet, so it does not guarantee the patient typed it. Counsel's answer on collection at sign-up is still owed.
• The backup archive is immutable for 7 years, so an erasure cannot reach it. The position is stated explicitly in the DPA and at DPIA R12 rather than implied.
• The platform is a registered Class I medical device (May 2026), recorded in the DPIA.
• The Romanian set is behind. Only the DPIA has been brought in line; the other twelve carry a divergence banner and must not be sent onward until retranslated.

Verified gaps

Every row below was a control one of these documents asserted as being in place, checked against the code or infrastructure on 2026-09-04, and found absent. They are recorded here because a DPA that claims a control it does not have is worse than one that admits the gap: the first is a misrepresentation to a controller, the second is a roadmap.

Gap	Claimed in	Decision needed
Audit-log archival and purge. No export, no checksummed S3 archive, no purge job. The table grows without bound; the scheduled task creates partitions forward only.	DPA B7, ROPA A6	Build it, or keep the 6-year retention as policy-only and say so to controllers. Becomes load-bearing when the legacy migration lands or the oldest partition turns six
Cross-region backup replication. Not configured in any environment.	DPIA R8, ROPA, sub-processors, TIA T3	Build it, or accept single-region DR. Note the archive is already Object-Locked, so the risk is regional loss, not deletion
DPO designation. Not appointed, ANSPDCP filing not made, dpo@restartix.pro not provisioned. Blocks the quarterly break-glass review and the bi-annual telemetry review, both of which several documents promise.	DPA B15/B12, DPIA R2/R6	Appoint. Two independent Art. 37 triggers apply, so this is not optional
Image scanning, dependency alerting, penetration testing. Only the dependency-inventory CI gate exists.	DPA B11	Schedule a pentest and add scanning, or state the posture honestly to controllers
Under-16 handling. The age-of-majority (18) test is built and governs caregiver consent authority. GDPR Art. 8's age-16 threshold for consent-basis processing has no sign-up gate.	DPIA R5	Counsel §3.2, then build whichever flow they specify
Algorithm versioning on telemetry rows. No version column, so a change in how a metric is derived is not reconstructable.	DPIA R6	Add the column before the metric definitions change, or accept it
Telemetry and media log redaction. The redaction list is installed on the API only.	DPA B8, DPIA R9	One-line wiring per service
Error tracking coverage. Deployed on the Portal only; five services unwired.	sub-processors, cookie inventory	Wire the rest, or keep scope honest
FGO listed as an active sub-processor. The invoicing capability is interface-only; the implementation ships with F12, which is out of scope. Nothing reaches it.	sub-processors, DPA Annex C	None — corrected by moving it out of the active table

Active documents

Each is developer-drafted; counsel red-pencils and final-signs.

Worksheet

• Placeholder worksheet (CONTEXT) — single source of truth for every {{PLACEHOLDER}} across the legal docs. Fill once; copy into each document at send time. Internal — never send externally.

Start here

• Action Plan — who does what, by when. Start at Current position; the W1–W4 timeline below it is the historical record of a countdown that expired without running.

The counsel engagement itself

• Counsel engagement brief — RFP-style artefact sent to 2–3 Romanian data-protection firms to quote on the pre-launch review.

Patient-facing text

• Document bodies (RO source text) — the Romanian bodies for all eight published legal documents: platform terms and privacy notice, the two clinic templates, and the four clinical consent instruments. Drafted from the six legacy restartix-leo documents; drafted, not published, and two of the four must not be published yet.

Inventory and disclosure

• Sub-processor list — every third party processing personal data on the platform's behalf. Public transparency page + DPA Annex C.
• Cookie & tracking inventory — every cookie, local-storage value, and tracking surface across the three apps. Drives the cookie-banner design.

Registers and assessments

• ROPA — Records of Processing Activities (Art. 30) — Part A: RestartiX SRL as controller for RestartiX-the-clinic's patient data. Part B: as processor for tenant clinics' patient data.
• DPIA — Data Protection Impact Assessment (Art. 35) — platform-wide assessment with F9 telerehab, F10 adherence-telemetry and F5.5 video-consultation appendices.
• TIA — Transfer Impact Assessment — EDPB six-step methodology applied to Clerk (US), Cloudflare (global edge), AWS (parent-access surface), and Daily.co (US — the only transfer carrying Art. 9 data).

Contractual artefacts

• DPA template — tenant clinic ↔ platform — Art. 28-compliant; SCC modules where required; TOMs in Annex B.
• Inner DPA — RestartiX-the-clinic ↔ RestartiX-the-platform — internal controller / processor instrument mirroring the tenant DPA; locks the architectural commitment in writing.

Operational artefacts

• DPO designation memo — DPO required under Art. 37 (two independent triggers apply); decision: external DPO service.
• Breach notification playbook — operational procedure for Art. 33 / 34 personal data breach handling, with 48-hour Controller-notice and 72-hour ANSPDCP-notice timelines, decision tree, and notification templates.

What ships with counsel involvement

Counsel deliverables D1–D7 (per the engagement brief §5) feed back into these documents — red-lined wording, binding answers to open questions, an enforcement-scan memo, a close letter. Each document carries a counsel-review status admonition near its top; when counsel sign-off lands, that admonition is updated and the change log records the version.

Operational artefacts still to provision

These follow counsel sign-off and are not themselves drafts. None is done:

• dpo@restartix.pro mailbox provisioned and monitored
• security@restartix.pro mailbox provisioned for incident reports
• support@restartix.pro mailbox provisioned for general support
• ANSPDCP DPO designation submitted; confirmation reference recorded in DPO designation memo
• AWS BAA accepted in AWS Artifact
• Sub-processor list published at restartix.pro/legal/sub-processors (public)
• Video moved to a platform-owned provider account, and the entity holding the current account confirmed — before any third-party clinic is onboarded with video consultations
• Privacy notice template content seeded into legal_document_templates v2 with counsel-reviewed body (1B.10 mechanism already shipped)
• Cookie banner UI built per the cookie inventory § "Cookie banner design"
• DPO engagement letter signed; counsel engagement letter signed; one-time setup completed

Related

• Production launch readiness — operational gate that depends on these artefacts being signed off
• June launch plan, Stream A — Legal / Compliance — the launch-critical subset
• F11.0.5 — Romanian compliance pass — feature-spec view of the same work
• Decisions: clinic is controller, platform is processor — the architectural commitment these documents enforce