Legal & Compliance Action Plan
Every other legal document describes what and why; this one says who does what, by when. v1 drafted 2026-05-15 as a countdown to a 2026-06-10 launch. Revised 2026-09-04.
The W1–W4 timeline below expired without running — read this section first
The pre-launch timeline in this document was built backwards from 2026-06-10 and assumed a counsel engagement starting the same week it was written. That engagement never started. Every deliverable in it — D1 through D7 — is still outstanding, and the deadlines below are historical rather than actionable.
What did happen in the meantime is that the platform went further than the plan assumed: production has been live and serving real patients since 2026-06-05, the platform was registered as a CE-marked Class I medical device in May 2026, and features the v1 plan recorded as deferred — video consultations above all — were built and shipped.
Keep the W1–W4 tables as the record of what was scoped. Work from the current position below.
Current position — 2026-09-04
Ordered by exposure, not by effort. The first two are the only items where processing is live and the paperwork is absent.
| # | Item | Owner | Why it is first | Where |
|---|---|---|---|---|
| 1 | Move video onto a platform-owned provider account, and confirm which entity holds the current one | YOU + SRL | Live video consultations relay Art. 9 health data through the same provider account as the legacy restartix-leo system. Two systems in one tenancy is an Art. 32 segregation problem, and it leaves the entity on the in-force DPA unconfirmed | TIA T4 |
| 2 | Start the counsel engagement | SRL | D1–D7 gate the sign-off on every document in this directory. Nothing here is counsel-reviewed; every document still carries its developer-drafted warning | counsel brief |
| 3 | Designate the DPO and file with ANSPDCP | SRL | Two independent Art. 37 triggers apply. The designation memo is drafted; the filing is not made | DPO designation |
| 4 | Publish the sub-processor list at restartix.pro/legal/sub-processors | SRL | Art. 28(2) transparency, and the mechanism by which the video sub-processor entry reaches controllers | sub-processors |
| 5 | Send enable_recording: off explicitly on room creation | YOU | Recording is off, but by the provider's default rather than by our request. A control we assert in a privacy notice should be one we send | video/daily.go |
| 6 | Write the restore-side erasure re-application runbook | YOU | The backup archive is immutable for 7 years, so the erasure position depends entirely on re-applying erasures after a restore. That commitment is now written into the DPA; the runbook behind it is not | R12 |
| 7 | Counsel answers still owed: §3.1 CNP at sign-up, §3.2 under-16, §3.4 retention table, §3.5 biometric signature scope | Counsel | CNP shipped conservatively ahead of the answer; the other three are unresolved in code as well as on paper | counsel brief §3 |
Items 2–4 are administrative and none is blocked by engineering. Item 1 is what stands between the platform and onboarding a third-party clinic that wants video consultations — the contract is in force, but the account is not ours alone.
Actors
| Code | Actor | Scope |
|---|---|---|
| YOU | Developer of the platform (you, operating the codebase) | All in-repo work: drafts, code, schema, documentation, IaC, deploys |
| SRL | RestartiX SRL — the legal entity, acting through {{SIGNATORY}} | Decisions, signatures, payments, regulator-facing acts, hiring counsel and DPO |
| Counsel | Selected Romanian data-protection firm ({{COUNSEL_FIRM}}) | Legal review, binding answers, red-pencil of templates, close letter |
| DPO | External DPO service ({{DPO_PROVIDER}}) | Independent oversight, sign-offs, ANSPDCP interaction, quarterly reviews |
| ANSPDCP | Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal | Receives DPO designation; receives any future breach notifications; potential audits |
Status values
todo · in progress · done · blocked · n/a
Update the Status column in place as work moves forward.
Pre-launch timeline (historical — see banner above)
Week 1 — 2026-05-15 to 2026-05-21
Goal: Counsel and DPO engagements lined up; placeholders filled; F9.3 column shape decided.
| Action | Owner | Deadline | Status | Where |
|---|---|---|---|---|
| Fill the placeholder worksheet — legal entity name, CUI, address, signatory, contact email, jurisdiction city, budget ceiling | SRL | 2026-05-16 | todo | /legal/context |
| Apply filled placeholders to the legal docs (search-and-replace) | YOU | 2026-05-17 | todo | All /legal/*.md |
| Identify 2–3 Romanian DP firms; request fixed-fee quotes against the brief | SRL | 2026-05-18 | todo | |
| Identify 2–3 external DPO service providers; request quotes | SRL | 2026-05-18 | todo | |
| Strip the internal-only "Implementation note" from the brief before sending | YOU | 2026-05-18 | todo | counsel brief §10 |
| Decide WAF approach: Cloudflare WAF-for-SaaS vs. AWS WAF on ALB | SRL + YOU | 2026-05-21 | todo | June launch — open decisions |
Decide public landing page URL (restartix.pro root vs. portal.restartix.pro/join) | SRL | 2026-05-21 | todo | June launch — open decisions |
| Settle F9.3 column shape (per-session vs per-exercise instruments) — blocks F9.3 migration | YOU | 2026-05-21 | todo | June launch — open decisions |
Decide on {{MAILBOX_PROVIDER}} for support / DPO / security mailboxes | SRL | 2026-05-21 | todo | ROPA A5 |
| Select counsel firm and DPO provider; communicate selection | SRL | 2026-05-21 | todo | — |
Week 2 — 2026-05-22 to 2026-05-28
Goal: Engagements signed; materials handed over; production infrastructure starts; mailboxes provisioned.
| Action | Owner | Deadline | Status | Where |
|---|---|---|---|---|
| Sign counsel engagement letter | SRL | 2026-05-22 | todo | — |
| Sign DPO engagement letter | SRL | 2026-05-22 | todo | /legal/dpo-designation |
| Hand over the materials pack to counsel (the 10 items listed in brief §4) | YOU | 2026-05-22 | todo | Email + repo link |
Provision the three mailboxes — dpo@, security@, support@ on restartix.pro | YOU | 2026-05-24 | todo | DNS + provider |
Submit DPO designation notification to ANSPDCP; record {{ANSPDCP_NOTIFICATION_REF}} | DPO + SRL | 2026-05-26 | todo | ANSPDCP portal |
Begin production Terraform under infra/envs/production (Multi-AZ RDS, NAT, KMS prod keys) | YOU | 2026-05-28 | todo | iac-layout.md |
| Accept AWS BAA in AWS Artifact | SRL | 2026-05-28 | todo | AWS Artifact |
| Begin F9 migrations (treatment_plans, treatment_plan_sessions, etc.) once column shape is settled | YOU | 2026-05-28 | todo | June launch — Stream C |
| Begin F10 telemetry service scaffold | YOU | 2026-05-28 | todo | June launch — Stream C |
Week 3 — 2026-05-29 to 2026-06-04
Goal: Counsel mid-engagement check-in; production infra hardened; F9/F10 builds complete; backup drill executed.
| Action | Owner | Deadline | Status | Where |
|---|---|---|---|---|
| Counsel D1 draft delivered (binding answers to §3.1–§3.9) | Counsel | 2026-05-29 | todo | counsel brief §5 |
| Apply counsel's D1 answers to: CNP-at-signup decision, under-16 flow, retention table | YOU | 2026-06-02 | todo | F11.1 erasure flow + portal sign-up |
| Apply D1 answers to consent purpose catalogue (1B.9) if changes needed | YOU | 2026-06-02 | todo | — |
| Verify backup posture end-to-end; execute restore drill | YOU | 2026-06-04 | todo | backup-disaster-recovery |
| Run k6 load test against production-shape staging; record p50/p95/p99 baselines | YOU | 2026-06-04 | todo | June launch — Stream B |
| Tune Fargate auto-scaling bounds against load-test data | YOU | 2026-06-04 | todo | scaling-architecture |
| F11.1 GDPR endpoints (DSAR + erasure) shipped and tested | YOU | 2026-06-04 | todo | features → F11.1 |
| Sentry organisation created, projects per service, source-map upload in CI | YOU | 2026-06-04 | todo | June launch — Stream E |
| Bunny CDN production account, DPA signed, bandwidth quote | SRL | 2026-06-04 | todo | Vendor |
| Clerk production keys configured | YOU | 2026-06-04 | todo | Clerk dashboard |
| First quarterly DPIA / ROPA review by DPO | DPO | 2026-06-04 | todo | /legal/dpo-designation |
Week 4 — 2026-06-05 to 2026-06-10
Goal: All counsel deliverables final; ops ready; launch.
| Action | Owner | Deadline | Status | Where |
|---|---|---|---|---|
| Counsel deliverables D1–D6 finalised (red-lined templates, ROPA, DPIA, TIA, marketing copy, enforcement memo) | Counsel | 2026-06-05 | todo | counsel brief §5 |
Apply red-lines to platform templates: privacy notice (EN + RO) seeded into legal_document_templates v2 (1B.10) | YOU | 2026-06-06 | todo | /implementation-plan/foundation#_1b-10-privacy-notice-templates |
Publish public sub-processor transparency page at restartix.pro/legal/sub-processors | YOU | 2026-06-06 | todo | Marketing site |
| Sign DPA with counsel-reviewed final wording | SRL | 2026-06-06 | todo | /legal/dpa-template |
| Sign Inner DPA (both sides RestartiX SRL) | SRL | 2026-06-06 | todo | /legal/inner-dpa |
| DPO countersigns DPIA final version | DPO | 2026-06-06 | todo | /legal/dpia §8 |
| Build cookie banner UI per cookie inventory § Banner; minimal launch posture | YOU | 2026-06-07 | todo | Portal landing |
| SES bounce/complaint handler + suppression table shipped | YOU | 2026-06-07 | todo | production-launch-readiness |
| Counsel D7 close letter received | Counsel | 2026-06-08 | todo | — |
| Cutover dry-run executed; PITR restore drill on production | YOU | 2026-06-08 | todo | — |
| On-call rotation activated; one synthetic incident drill against staging | YOU + DPO | 2026-06-09 | todo | /legal/breach-notification-playbook |
| Status page automated from CloudWatch | YOU | 2026-06-09 | todo | — |
| Final pre-launch sign-off meeting (YOU + SRL + DPO) | All | 2026-06-09 | todo | — |
| PUBLIC LAUNCH | — | 2026-06-10 | n/a | — |
Critical-path callouts
These can delay launch and have no slack:
- Counsel D1 by 2026-05-29. Drives CNP decision, under-16 flow, retention table — each has a downstream code change. Slip → choose between launch delay or non-counsel-reviewed templates.
- F9.3 column shape by 2026-05-21. Blocks the F9.3 migration; 50k+ row migration cannot be re-shaped post-launch cheaply.
- Counsel D7 by 2026-06-08. Launch-go signal. No D7, no launch.
- DPO designation submitted to ANSPDCP by 2026-05-26. Wait time for confirmation is operator-uncontrolled; submit early.
- Bunny bandwidth quote in Week 2. Sign-up vs. signed contract is the difference — quote before signing.
Decision dependencies (visualisation)
Today (2026-05-15)
│
├─► [SRL] Fill placeholders ────────► [YOU] Apply to docs
│
├─► [SRL] Select counsel firm ──────► [SRL] Sign letter ──► Materials pack ──► D1 draft ──► D7 close letter
│ │
│ └──► [YOU] Apply answers (CNP, <16, retention) ──► Portal changes
│
├─► [SRL] Select DPO ───────────────► [SRL] Sign letter ──► [DPO+SRL] Submit ANSPDCP ──► DPO operational
│ │
│ └──► Quarterly review starts ──► DPIA countersign
│
├─► [YOU+SRL] WAF decision ─────────► [YOU] Production IaC
│
└─► [YOU] F9.3 column shape ────────► [YOU] F9.3 migration ──► F9 portal pagesPost-launch ongoing responsibilities
These are durable obligations that start at 2026-06-10 and never stop. Each has an owner and a cadence.
Documents and registers
| Responsibility | Owner | Cadence | Where |
|---|---|---|---|
| Maintain the sub-processor list; trigger 30-day notice on changes | YOU + DPO | Per change | /legal/sub-processors |
| Maintain the ROPA; add entries when a new processing activity ships | YOU | Per change + annual review | /legal/ropa |
| Maintain the cookie inventory; add row when new cookie/tracker ships | YOU | Per PR (engineering rule) | /legal/cookie-inventory |
| Re-evaluate the TIA when destination-country law or sub-processor structure changes | DPO + Counsel | Annual + on material change | /legal/transfer-impact-assessment |
| Re-evaluate the DPIA on new high-risk features (pose-tracking activation, AI features) | DPO + YOU | Per feature trigger | /legal/dpia |
| Annual review of all legal artefacts | DPO | Yearly | All /legal/*.md |
Operations
| Responsibility | Owner | Cadence | Where |
|---|---|---|---|
| Personal data breach response — incident commander role | YOU (on-call rotation) | Continuous (on-call) | /legal/breach-notification-playbook |
| Personal data breach notification to operators (within 48h) | DPO (drafts) + SRL (sends) | Per incident | /legal/breach-notification-playbook |
| Quarterly tabletop exercise — incident simulation | DPO organises; YOU + SRL participate | Quarterly | /legal/breach-notification-playbook |
| Quarterly compliance review meeting | DPO chairs; YOU + SRL attend | Quarterly | /legal/dpo-designation |
| DSAR handling — Art. 15 access requests | Routed to clinic-as-controller; platform assists | Per request | /legal/dpa-template §3.3 |
| Erasure requests — Art. 17 | Routed to clinic-as-controller; platform executes anonymisation | Per request | F11.1 |
| Audit-log retention enforcement (6+ years) | YOU (automated via partition cron) | Continuous | audit_log |
| Break-glass session log review | DPO | Quarterly | /architecture/decisions |
Regulator-facing
| Responsibility | Owner | Cadence | Where |
|---|---|---|---|
| ANSPDCP correspondence — first point of contact | DPO | Per query | /legal/dpo-designation |
| Art. 33 breach notification to ANSPDCP within 72h | SRL signs; DPO drafts | Per incident | /legal/breach-notification-playbook §5.3 |
| Art. 34 affected-data-subject notification | SRL signs (for own clinic); tenant clinic signs (for tenant patients); DPO drafts | Per high-risk incident | /legal/breach-notification-playbook §5.4 |
| Update DPO designation when DPO changes | SRL submits; DPO outgoing assists | Per change | ANSPDCP portal |
Decision triggers
These are events that should trigger a specific review:
| Event | Triggers what | Owner |
|---|---|---|
| New sub-processor added | 30-day notice to all controllers; TIA entry if non-EU | YOU + DPO |
| Sub-processor removed or replaced | 30-day notice; update DPA Annex C; remove TIA entry if applicable | YOU + DPO |
| New cookie / tracker shipped | Cookie inventory row in same PR; banner update if consent-gated | YOU |
| New consent purpose added | ROPA entry; privacy notice template revision (1B.10); DPO approval | YOU + DPO |
| Pose-tracking activation (when scheduled) | New DPIA appendix; new consent purpose; privacy notice version bump; DPO sign-off | YOU + DPO |
| First AI feature ships | Anthropic / OpenAI added to sub-processor list; new TIA entry; DPIA appendix; consent purpose | YOU + DPO |
| First third-party clinic onboards | Inner DPA stops being the only one; tenant DPA executed | SRL + clinic |
| EU-US adequacy decision changes (e.g., DPF invalidated) | TIA update for Clerk; IdP-swap contingency evaluation | DPO + YOU |
| ANSPDCP enforcement scan finds new pattern in our space | Counsel re-engagement (mini-scope); affected docs revised | DPO + Counsel |
| Personal data breach affecting controller data | Full breach response; 48h operator notice; 72h ANSPDCP (if applicable) | YOU (IC) + DPO + SRL |
| 12-month anniversary of launch | Annual review of every legal artefact; ISO 27001 progress review | DPO |
Change log
| Date | Change |
|---|---|
| 2026-05-15 | Initial v1 — W1–W4 pre-launch timeline + post-launch ongoing responsibilities |