Kaddio DORA Document
Kaddio services and standard terms under DORA Article 30.
Supplier: Kaddio AB. This description and addendum apply when incorporated into the written agreement. The complete agreement must be available to both parties in paper or another durable and accessible format. The written agreement with each customer must identify the services provided and include the applicable contract details.
Kaddio is a web-based SaaS platform for healthcare providers and similar organisations. It supports customer workflows through platform access, operation, maintenance and support. Only services and optional modules activated for the customer are included.
Depending on the customer's subscription, Kaddio provides scheduling and calendars, clinical documentation, communication, invoicing and payment support, organisation administration and reporting, APIs and integrations, and optional AI assistance. These are capability areas, not an exhaustive list of individual features.
Kaddio is delivered as SaaS through a web browser in a shared environment with logical separation between customer organisations. Kaddio operates and maintains the platform. Security measures for personal data are described in the DPA; backup, recovery and continuity are described in the Disaster Recovery Policy.
When activated, the API provides machine access through supported REST and GraphQL operations and selected webhooks, subject to permissions and organisation boundaries. Other integrations require activation or separate agreement. National and third-party services are subject to their providers' eligibility, availability and technical requirements.
Only activated and subscribed services are included. Customer equipment, networks and other systems are outside the service. Access to external services depends on their providers.
The written agreement must clearly identify all functions and ICT services supplied, including activated optional services. It must state whether subcontracting ICT services supporting a critical or important function, or material parts of them, is permitted and the conditions that apply.
The written agreement must state the countries or regions where each service, including any subcontracted service, is provided and data is processed, including storage locations. Kaddio will notify the customer in advance of planned changes to these locations.
Kaddio will protect customer data, including personal and non-personal data, in respect of availability, authenticity, integrity and confidentiality. On termination, insolvency, resolution or discontinuation of Kaddio's business operations, Kaddio will ensure access, recovery and return in an easily accessible format.
The written agreement must describe the applicable service levels, including how they may be updated or revised.
Kaddio will assist the customer when an ICT incident related to the service occurs, at no additional cost or at a cost specified in advance in the written agreement.
Kaddio will fully cooperate with the customer's competent and resolution authorities, including persons appointed by them. The conditions for Kaddio's participation in the customer's ICT security awareness and digital operational resilience training must be stated in the written agreement.
The customer may terminate for a significant breach of applicable law or contractual terms; circumstances identified through monitoring that may affect service delivery; material weaknesses in Kaddio's ICT risk management; or circumstances preventing effective regulatory supervision. The written agreement must state applicable minimum notice periods.
If the service supports a critical or important function, the written agreement must also specify the precise quantitative and qualitative service-level targets; provider notice and reporting of developments that may materially affect service delivery; implementation and testing of contingency plans and ICT security measures; cooperation in threat-led penetration testing; ongoing monitoring and the required access, inspection and audit rights, including cooperation and review conditions; and an exit strategy with an adequate transition period, as required by Article 30(3) of DORA.