Advanced Data & Privacy Agreement

Document control

Document

Advanced Data & Privacy Agreement (DPA + HIPAA Business Associate Addendum + Annexes)

Platform

Doctopass

Processor / Business Associate

DOCTOPASS SARL

Data Protection Officer

contact@doctopass.com

Version

1.0

Governing law

Republic of Tunisia

Preamble

This Advanced Data & Privacy Agreement (“Agreement”) is entered into between:

• DOCTOPASS SARL, the provider of the Platform (“Processor”; where Part B applies, “Business Associate”); and
• the healthcare professional, practice, or clinic that uses the Platform to process personal data about its patients (“Controller”; where Part B applies, “Covered Entity”),

each a “Party” and together the “Parties”.

This Agreement governs the Processor’s processing of personal data on behalf of the Controller in connection with the Platform. It supplements, and is incorporated into, the Terms of Use. In the event of conflict on the subject matter of data protection, this Agreement prevails over the Terms of Use.

1. Definitions

Terms used but not defined in this Agreement have the meaning given in the Terms of Use, in Loi organique n° 2004-63 (Tunisia), or, where applicable, in the GDPR.

• “Applicable Data Protection Law” — Loi organique n° 2004-63 du 27 juillet 2004 (Tunisia) and the requirements of the INPDP; and, where applicable, the GDPR and any implementing legislation.
• “Personal Data” — personal data processed by the Processor on behalf of the Controller under this Agreement, as described in Annex 1.
• “Health Data” — Personal Data concerning health (special-category data).
• “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, “Supervisory Authority” — as defined in Applicable Data Protection Law.
• “Sub-processor” — a third party engaged by the Processor to process Personal Data.
• “Services” — the Platform and related services provided under the Terms of Use.
• “TOMs” — the technical and organisational measures set out in Annex 2.

2. Subject Matter and Roles

2.1The Controller determines the purposes and means of the Processing of Personal Data. The Processor processes Personal Data only on behalf of, and on the documented instructions of, the Controller.

2.2The subject matter, duration, nature and purpose of the Processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex 1.

2.3Each Party shall comply with its obligations under Applicable Data Protection Law. The Controller is responsible for establishing and maintaining a lawful basis for the Processing, for the accuracy of its instructions, and for providing required information to Data Subjects.

3. Processing on Documented Instructions

3.1The Processor shall process Personal Data only on the Controller’s documented instructions, including as set out in this Agreement and the Terms of Use, and as necessary to provide the Services, unless required to process by a law to which the Processor is subject; in which case the Processor shall, where that law permits, inform the Controller of that legal requirement before processing.

3.2The Processor shall inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law. The Processor is not obliged to carry out an instruction it reasonably considers unlawful.

3.3The Processor shall not process Personal Data for its own purposes, except that the Processor may produce and use irreversibly anonymised data derived from the Processing (from which no Data Subject can be identified) to develop and improve the Services and to conduct scientific, statistical, or clinical research, itself or together with research partners it engages, as described in the Terms of Use and the Privacy Policy. No identifiable or pseudonymised Personal Data, and no patient images containing identifying features, are used or shared for this purpose; the sharing of any identifiable or coded data would require a separate agreement, a lawful basis, and any INPDP authorisation, established in advance.

4. Confidentiality

4.1The Processor shall ensure that persons authorised to process the Personal Data are bound by an appropriate obligation of confidentiality.

4.2The Processor shall limit access to Personal Data to personnel who need access to provide the Services, and shall enforce access on a need-to-know basis.

5. Security of Processing

5.1The Processor shall implement and maintain the technical and organisational measures set out in Annex 2, designed to ensure a level of security appropriate to the risk, taking into account the nature of the Personal Data (including that it comprises Health Data).

5.2The Processor may update the TOMs from time to time provided the level of security is not materially reduced.

6. Sub-processing

6.1General authorisation. The Controller grants the Processor general authorisation to engage Sub-processors to process Personal Data for the provision of the Services. A current list of the Sub-processors engaged is made available to the Controller on request.

6.2Flow-down. The Processor shall impose on each Sub-processor, by written contract, data-protection obligations no less protective than those in this Agreement, in particular as to security and confidentiality.

6.3Changes. The Processor shall inform the Controller of any intended addition or replacement of a Sub-processor, giving the Controller a reasonable opportunity to object on reasonable data-protection grounds. Where the Controller reasonably objects and the Parties cannot agree a resolution, the Controller may terminate the affected Services.

6.4Liability. The Processor remains liable to the Controller for the performance of a Sub-processor’s obligations to the extent required by Applicable Data Protection Law.

7. Assistance with Data Subject Rights

7.1Taking into account the nature of the Processing, the Processor shall assist the Controller, by appropriate technical and organisational measures and insofar as reasonably possible, to respond to requests by Data Subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection, and withdrawal of consent).

7.2Where the Processor receives a request directly from a Data Subject relating to Personal Data processed for the Controller, it shall, unless legally required to respond, forward the request to the Controller without undue delay and not respond substantively itself except on the Controller’s instruction.

8. Personal Data Breach

8.1The Processor shall notify the Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting the Controller’s Personal Data.

8.2The notification shall, to the extent available, describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Where information is not available at once, it may be provided in phases without undue further delay.

8.3The Processor shall take reasonable steps to mitigate and remediate the breach, and shall cooperate with the Controller, including to enable the Controller to meet its own notification obligations to Supervisory Authorities and Data Subjects.

9. Data Protection Impact Assessments

The Processor shall provide reasonable assistance to the Controller with data protection impact assessments and any prior consultation with a Supervisory Authority, taking into account the nature of the Processing and the information available to the Processor.

10. Data Residency and International Transfers

10.1The Processor shall host and process the Controller’s Personal Data within the jurisdiction in which the Controller operates, in accordance with the per-jurisdiction deployment model. For a Controller operating in Tunisia, Personal Data (including Health Data) is hosted within Tunisia.

10.2The Processor shall not transfer the Controller’s Personal Data to a third country except on the Controller’s instruction or as strictly necessary to provide the Services, and in either case only where a valid transfer mechanism under Applicable Data Protection Law is in place, and, for Tunisian Personal Data, subject to any authorisation required by the INPDP.

10.3All AI processing is performed on a model self-hosted by the Processor within the applicable jurisdiction; no Personal Data is transmitted to any external artificial-intelligence provider or third-party model (see Annex 2).

11. Return or Deletion on Termination

11.1On termination of the Services, the Processor shall, at the Controller’s choice, return or delete the Personal Data, and delete existing copies, unless retention is required by Applicable Law.

11.2The Parties acknowledge that clinical data is subject to mandatory retention and to a prohibition on hard-deletion while a retention obligation subsists; such data will be retained, restricted, and then securely deleted or irreversibly anonymised in accordance with the retention periods in the Privacy Policy and Applicable Law.

11.3The Processor shall, on request, certify deletion.

12. Audits

12.1The Processor shall make available to the Controller information reasonably necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

12.2Audits shall be conducted on reasonable prior notice, during business hours, no more than once per year (save where required by a Supervisory Authority or following a Personal Data Breach), in a manner that does not disrupt the Processor’s operations or compromise the confidentiality or security of other customers’ data. The Processor may satisfy audit requests by providing relevant certifications, reports, or summaries of its TOMs where these reasonably address the Controller’s request.

13. Liability

13.1Liability under this Agreement is subject to the limitations and exclusions of liability in the Terms of Use, save to the extent such limitation is not permitted by Applicable Data Protection Law.

13.2Nothing in this Agreement limits a Data Subject’s rights, or a Party’s liability to a Data Subject or a Supervisory Authority, under Applicable Data Protection Law.

14. Term, Precedence, and Governing Law

14.1This Agreement takes effect on the effective date and continues for as long as the Processor processes Personal Data on behalf of the Controller.

14.2In the event of conflict between this Agreement and the Terms of Use on data-protection matters, this Agreement prevails. The Annexes form part of this Agreement.

14.3This Agreement is governed by the laws of the Republic of Tunisia, subject to any mandatory provision of Applicable Data Protection Law. Disputes are subject to Section 19 of the Terms of Use.

B1. Definitions

Terms used in this Part B, including “Breach”, “Data Aggregation”, “Designated Record Set”, “Disclosure”, “Electronic Protected Health Information” (“ePHI”), “Health Care Operations”, “Individual”, “Minimum Necessary”, “Protected Health Information”, “Required By Law”, “Secretary”, “Security Incident”, “Subcontractor”, “Unsecured PHI”, and “Use”, have the meanings set out in HIPAA.

B2. Obligations of Business Associate

The Business Associate shall:

1. not Use or Disclose PHI other than as permitted or required by this Addendum or as Required By Law;
2. use appropriate safeguards, and comply with the HIPAA Security Rule with respect to ePHI, to prevent Use or Disclosure of PHI other than as provided for by this Addendum, including the administrative, physical, and technical safeguards summarised in Annex 2;
3. apply the Minimum Necessary standard to Uses and Disclosures of, and requests for, PHI;
4. report to the Covered Entity any Use or Disclosure of PHI not provided for by this Addendum of which it becomes aware, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and in any event within the periods required by the Breach Notification Rule and, where more protective, within the timeframe in Section 8.1 of Part A;
5. in accordance with the HITECH flow-down requirements, ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of the Business Associate agrees in writing to restrictions and conditions at least as protective as those that apply to the Business Associate, including compliance with the Security Rule;
6. make PHI in a Designated Record Set available to the Covered Entity as necessary to satisfy the Covered Entity’s obligations under 45 C.F.R. § 164.524 (Individual access);
7. make PHI in a Designated Record Set available for amendment, and incorporate amendments, as necessary to satisfy 45 C.F.R. § 164.526;
8. maintain and make available the information required to provide an accounting of Disclosures as necessary to satisfy 45 C.F.R. § 164.528;
9. to the extent the Business Associate carries out any of the Covered Entity’s obligations under the Privacy Rule, comply with the requirements of the Privacy Rule that apply to the Covered Entity in the performance of those obligations;
10. make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance; and
11. at termination, return or destroy all PHI received from, or created or received on behalf of, the Covered Entity that the Business Associate maintains, and retain no copies, where feasible; and where return or destruction is not feasible, extend the protections of this Addendum to the PHI and limit further Uses and Disclosures to those purposes that make return or destruction infeasible.

B3. Permitted Uses and Disclosures

1. The Business Associate may Use and Disclose PHI as necessary to perform the Services, and as permitted or required by this Addendum, the Terms of Use, or as Required By Law.
2. The Business Associate may Use PHI for the proper management and administration of the Business Associate and to carry out its legal responsibilities, and may Disclose PHI for such purposes only if Required By Law or if the Business Associate obtains reasonable assurances that the PHI will remain confidential and the recipient notifies the Business Associate of any breach of confidentiality.
3. The Business Associate may Use PHI to provide Data Aggregation services relating to the Health Care Operations of the Covered Entity, where permitted.
4. The Business Associate shall not Use or Disclose PHI in a manner that would violate the Privacy Rule if done by the Covered Entity, except as set out in (b) and (c).

B4. Term and Termination

1. This Addendum is effective on activation and terminates when all PHI is returned or destroyed, or protections are extended in accordance with Section B2(k).
2. The Covered Entity may terminate the Services if the Business Associate materially breaches this Addendum and fails to cure within a reasonable period, as provided by HIPAA.

B5. Interpretation

Any ambiguity in this Addendum shall be resolved to permit the Parties to comply with HIPAA. In the event of conflict between this Part B and other provisions on the treatment of PHI, this Part B prevails where HIPAA applies.

Annex 1 — Details of Processing

Subject matter. Provision of the Doctopass practice-management and clinical-workflow platform to the Controller.

Duration. For the term of the Terms of Use and this Agreement, and thereafter only as required to meet retention obligations.

Nature and purpose of Processing. Hosting, storage, organisation, retrieval, consultation, use, transmission, and erasure of Personal Data to enable the Controller to manage patients, conduct consultations, produce clinical documents and invoices, communicate with patients, schedule appointments, and operate the practice; security and audit; and AI-assisted drafting under human control.

Types of Personal Data

• Identity and contact data (patients, and the Controller’s staff);
• Health Data (special category): vitals, medications, allergies, conditions, family history, vaccinations, consultations, examinations, diagnoses, treatment plans, prescriptions, laboratory results, imaging, surgery history, uploaded documents;
• Appointment and scheduling data;
• Communications (messages, invitations, notifications);
• Billing and limited payment data;
• Authentication, security, and audit data.

Categories of Data Subjects

• The Controller’s patients (including, where applicable, minors represented by a guardian);
• The Controller and its authorised staff (doctors, secretaries).

Special-category data. The Processing includes Health Data, processed subject to the heightened safeguards in this Agreement and Annex 2.

Annex 2 — Technical and Organisational Measures (TOMs)

The Processor maintains an information-security management system aligned to the ISO/IEC 27001:2022 control set (Annex A). No certification is claimed. Where Part B applies, these measures also address the HIPAA Security Rule administrative, physical, and technical safeguards. The measures below are mapped to control themes for the Controller’s due diligence.

A. Organisational controls (ISO/IEC 27001 A.5)

• Information-security policies, reviewed periodically.
• Defined security roles and responsibilities; a Data Protection Officer (contact@doctopass.com).
• Segregation of duties for sensitive operations (e.g. authentication, authorisation, encryption, deployment, and clinical-document signing are not subject to unattended automated change).
• Supplier/sub-processor management with data-protection contractual controls and a maintained sub-processor register.
• Documented incident-management and personal-data-breach procedures (48-hour controller notification).
• Business-continuity and backup procedures, with recovery objectives documented and tested. (HIPAA: Contingency Plan.)

B. People controls (ISO/IEC 27001 A.6)

• Confidentiality obligations for all personnel with access to Personal Data.
• Security awareness appropriate to role; need-to-know access.
• Defined joiner/mover/leaver process governing access provisioning and revocation. (HIPAA: Workforce Security.)

C. Physical controls (ISO/IEC 27001 A.7)

• Hosting in facilities within the applicable jurisdiction that maintain physical access controls and environmental protections. (HIPAA: Facility Access Controls.)
• For the Tunisian service, physical hosting is within Tunisia.

D. Technological controls (ISO/IEC 27001 A.8)

• Access control and authentication. Passwords stored using argon2id (salted, memory-hard hashing); the Processor holds no plaintext passwords. Short-lived access tokens (approximately 15 minutes) and rotated, opaque refresh tokens delivered via secure, httpOnly cookies (approximately 30 days). Two-factor authentication (TOTP) available and encouraged for privileged access.
• Authorisation. Two-layer authorisation on every access to patient data: a role-based guard and a per-record ownership/permission check in the service layer.
• Audit logging. An audit trail records reads and writes of patient data, including cross-Doctor access, retained per the Privacy Policy.
• Encryption. Encryption of Personal Data in transit (TLS) and at rest; database-level cryptographic protection for sensitive fields; stored files accessed only via short-lived signed URLs.
• Integrity. Controls to protect against unauthorised alteration; soft-deletion for clinical entities so patient data is not hard-deleted while a retention obligation subsists.
• Minimisation and de-identification. Collection limited to what is necessary. All AI processing is performed on a model self-hosted by the Processor within the applicable jurisdiction; no Personal Data is transmitted to any external artificial-intelligence provider or third-party model. As defence-in-depth, direct identifiers are additionally minimised within the processing pipeline. Model improvement and research use only irreversibly anonymised data (including the delta between AI drafts and clinician corrections), from which no individual can be identified and which excludes patient images containing identifying features.
• Segregation. Per-jurisdiction deployment isolation; separation of environments (development, staging, production).
• Operations security. Rate limiting and abuse prevention; session management and revocation; monitoring and error diagnostics with scrubbing of Personal Data from telemetry to prevent inadvertent transfer; secure software-development and change-management practices; vulnerability management.
• Network security. Controlled ingress/egress; secrets management; least-privilege service credentials.

E. Governance of AI processing

• All AI processing is routed through a controlled internal gateway and runs on a model self-hosted by the Processor within the applicable jurisdiction; outputs are drafts requiring explicit human confirmation; per-user and per-tenant usage budgets apply. No autonomous automated change is made to authentication, authorisation, encryption, clinical-document signing, or production data-migration logic.