As data controller, the client decides which Personal Data to upload, for what purpose and on what lawful basis, and answers data subject requests, which datascalehr forwards to the client.

The client also manages users and roles in the application, chooses the encryption level for imported data, and sets field-level retention rules per country. The datascalehr Data Processing Agreement sets out the obligations of both parties.