Data Processing Agreement

On one side, the clinic identified in the particular agreement, hereinafter the Controller or the Clinic.

On the other, Miguel Monllau Monfort, Spanish tax ID ES73383415Y, domiciled at Calle Doctor Coca 1, planta 1, puerta 1, 08700 Igualada, Barcelona, trading as “Clynalia”, hereinafter the Processor or Clynalia.

Both parties agree to govern the processing of personal data required to provide Clynalia under the following clauses.

The Controller engages Clynalia to provide the clinical and administrative management software services described in the main agreement. To that end Clynalia will process personal data on behalf of the Controller and only on its documented instructions.

The subject matter, duration, operations, purposes, categories of data and data subjects are detailed in the annexes.

This agreement enters into force on the date set in the particular agreement and remains in force for as long as Clynalia processes data on behalf of the Controller.

Obligations of confidentiality, security, return, deletion and cooperation that must survive will continue for the applicable statutory period.

The Clinic determines the purposes and essential means of processing its patients' data and acts as controller.

Clynalia acts as processor when it processes that data to provide the service. The contractual label will not prevail over the reality of the processing. If Clynalia considers that an instruction alters the roles or breaches the law, it will inform the Controller without delay and may suspend the instruction to the extent necessary to avoid unlawful processing.

Clynalia:

• will process the data only to provide the contracted service;
• will not use it for its own incompatible purposes;
• will not sell patient data;
• will not use clinical records to train models;
• will not disclose data except on instruction, legal obligation or authorised sub-processing;
• will document the instructions received through the agreement, the clinic's configuration and the authorised requests of its users.

Where a legal obligation requires processing or disclosing data outside the instructions, Clynalia will inform the Controller beforehand unless prohibited by law.

Clynalia will ensure that the persons authorised to process data:

• access data only when necessary for their duties;
• are bound by a duty of confidentiality;
• receive appropriate training;
• use individual credentials;
• lose access when it is no longer necessary.

Exceptional support access must be justified, limited and logged.

Clynalia will apply technical and organisational measures appropriate to the risk and keep evidence of their operation. The initial measures appear in the corresponding annex and include encryption, isolation between clinics, access control, auditing, backups, key management and secure development.

The measures may evolve to maintain or improve the level of protection, without materially reducing it during the term.

The Clinic undertakes to manage users and permissions, protect its devices and networks, and report incidents or user departures without delay.

The Controller authorises Clynalia, on the terms set in the particular agreement, to use the sub-processors identified in the annexes.

In the case of a general authorisation, Clynalia:

• will give notice, through the channel and with the notice period set in the particular agreement, of additions or replacements;
• will provide identity, function and location;
• will allow reasoned objections related to data protection;
• will propose a reasonable solution where the objection is well founded;
• will impose equivalent obligations on the sub-processor;
• will remain answerable to the Controller for the sub-processor's compliance under the law.

Clynalia will not make international transfers, nor allow a sub-processor to make them, except where there is:

• a documented instruction from the Controller;
• a need to provide the service described in the annexes; and
• a valid mechanism and appropriate safeguards.

The inventory must identify location, mechanism and applicable documentation. Merely choosing a European provider or a European region does not replace this contractual assessment.

The Clinic will handle its patients' requests. If Clynalia receives a request concerning data processed on behalf of the Clinic, it:

• will forward it without delay to the designated contact;
• will not answer on the Clinic's behalf unless instructed;
• will facilitate, as far as it is able, search, export, rectification, restriction, objection, portability or erasure.

The Controller's contact and the operational period for forwarding and assistance are set in the particular agreement.

Clynalia will notify the Controller without undue delay after becoming aware of a breach affecting the entrusted data.

The notification will include, as it becomes available:

• nature and likely impact;
• approximate categories and volume;
• measures taken or planned;
• contact person;
• the information the Clinic needs to assess its own notifications.

The Clinic decides on communications to the authority and to data subjects, unless Clynalia has a direct obligation. The parties will maintain the emergency channel set in the particular agreement.

Clynalia will reasonably assist the Clinic with:

• risk analysis;
• data protection impact assessments;
• consultation of the data protection officer;
• prior consultation of the authority where applicable;
• documentation of measures and technical operation.

Clynalia will provide reusable information about the service. The Clinic must complete it with its own context, volume, groups, legal bases and care processes.

Clynalia will make available to the Controller the information necessary to demonstrate compliance with this agreement and will allow reasonable audits.

Audits:

• will be coordinated in advance except in an urgent incident;
• will respect the confidentiality and security of other clinics;
• will prioritise certifications, reports and remote evidence where sufficient;
• will not allow access to secrets or to unnecessary third-party data;
• will follow the cost arrangements set in the particular agreement.

At the end of the service, Clynalia will return or delete the data as instructed by the Controller, unless a legal retention obligation applies.

The annexes define export formats, the download window, the treatment of documents, database, keys, audit trail and backups, the blocking of data subject to retention, the certification of the operation, and the periods and exceptions.

No irreversible deletion of clinical records will be carried out until the Clinic confirms the retention periods applicable to its territory and to each category of data.

Clynalia will maintain reasonable backup, recovery and continuity measures appropriate to the risk. Recovery objectives and any service-level commitment will be stated in the particular agreement or in the annexes.

The liability regime will be coordinated with the main agreement and will not limit rights or obligations that cannot legally be limited.

In the event of conflict on data protection matters, this agreement and its annexes prevail.

For Clynalia: privacy and data protection, privacy@clynalia.com; contractual matters, hello@clynalia.com. The Clinic's contacts are designated in the particular agreement.

The agreement is signed by the person representing the Clinic and by Miguel Monllau Monfort on behalf of Clynalia, dated, before any patient data is processed.

Optional AI features. If the clinic enables the relevant feature and an authorised person requests it, Clynalia uses Amazon Bedrock to: (a) literally transcribe the visible text of a document; (b) organise its written information; or (c) draft a visit or episode-of-care report from notes already written by the professional.

For the first two features, the selected PDF or image is sent with technical instructions. For visit reports, the history, examination, treatment, progress and recommendations notes are sent. For episode reports, the notes from its visits, with dates and session numbers, and the reason for consultation are sent; the episode’s diagnosis field is not sent. Clynalia does not add other identifying fields from the patient record, but the file or notes themselves may contain identifiers and health data.

The result may contain errors or omissions. The purpose is documentary: the system must not supply new clinical interpretations, diagnoses or recommendations. A professional must compare it with the sources, correct or discard it and expressly decide whether to add or issue it. The identity shown in the report is added afterwards, outside the model call. The professional gives the report to the patient; Clynalia does not automatically send it to third parties.

AWS provides inference within the verified EU boundary. Use requires assessed contractual and retention conditions. Sources, the AI draft, the reviewed text and their audit trails are kept under the policy applicable to each category. The sub-processor list describes services and safeguards. Clynalia does not use clinical records to train models.

• Annex I: description of processing.
• Annex II: sub-processors and locations.
• Annex III: technical and organisational measures.
• Annex IV: return, retention and deletion.
• Annex V: optional AI transcription, document organisation and draft visit or episode-of-care reports.

The annexes are delivered with the particular agreement. References: Article 28 GDPR and the Spanish Data Protection Authority's guidance on the content of a processing agreement.