Data Processing Agreement (DPA)

1. Parties and relationship to the Contract

1. 1.1Processor: NEXACorteX s.r.o., Company ID (IČO): 24475483, registered office at Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 440386 (the “Processor”).
2. 1.2Controller: the Customer that has concluded the Contract with the Processor under the NexaCare Terms and Conditions (the “Terms”); the “Controller”.
3. 1.3This data processing agreement (the “DPA”) is an agreement under Article 28(3) of Regulation (EU) 2016/679 (the “GDPR”). It forms part of the Contract and is concluded together with it electronically, without a separate signature.
4. 1.4The DPA governs the processing of personal data that the Processor carries out on behalf of the Controller when providing the Application. It does not apply to data that the Processor processes as an independent controller (user accounts, invoicing, support, operational security); these are described in the Privacy Policy.
5. 1.5This DPA prevails for the processing of Controller Data; the other provisions of the Contract apply unless the DPA provides otherwise.

2. Definitions

1. 2.1The terms “personal data”, “special categories of personal data”, “processing”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in the GDPR.
2. 2.2The terms Contract, Customer, Application, Practice, User, Practice Administrator, Module, Content, AI Output, Integration and Sub-processor have the meaning given in the Terms.
3. 2.3Controller Data means personal data contained in Content that the Processor processes on behalf of the Controller.

3. Subject matter, purpose and duration of processing

1. 3.1Purpose. The Processor processes Controller Data solely for the purpose of providing the Application under the Contract – in particular storing and making Content available, processing incoming and outgoing communication, speech-to-text conversion, creating draft reports, recognising text from documents, extracting data and managing the Controller’s work and operational agenda.
2. 3.2Nature. Automated processing in a cloud environment: collection, storage, organisation, structuring, retrieval, consultation, alteration, transfer to Integrations on a User’s instruction, export and erasure, including processing using artificial intelligence models under Article 14.
3. 3.3Data subjects and data are described in Annex 1. The processing includes special categories of personal data – data concerning health (Article 9 GDPR).
4. 3.4Duration. Processing lasts for the term of the Contract and thereafter for the time necessary to return and erase the data under Article 15.

4. Controller’s instructions

1. 4.1The Processor processes Controller Data only on documented instructions from the Controller, including with regard to transfers to a third country (Article 28(3)(a) GDPR). Documented instructions are:
   • the Contract including this DPA,
   • actions of Users and settings made in the Application (e.g. starting a transcription, setting the retention period, activating an Integration),
   • other written instructions of the Controller that are consistent with the Contract.
2. 4.2The Processor may process Controller Data without an instruction only where required to do so by Union or Member State law; the Processor informs the Controller of that requirement in advance unless that law prohibits it.
3. 4.3If the Processor considers that an instruction infringes the GDPR or other data protection provisions, it immediately informs the Controller (second subparagraph of Article 28(3) GDPR) and is not obliged to carry out the instruction until the Controller changes it so that it complies with the law.
4. 4.4An instruction that would require a change to the Application or processing beyond the scope of the Contract is subject to agreement between the parties.

5. Controller’s obligations

1. 5.1The Controller is responsible for having a legal basis under Article 6 GDPR for processing Controller Data in the Application and, for data concerning health, an exception under Article 9(2) GDPR.
2. 5.2The Controller fulfils its information obligations towards data subjects (Articles 13 and 14 GDPR), including information on the involvement of the Processor and the categories of Sub-processors.
3. 5.3When recording conversations with patients, the Controller proceeds in accordance with Article 5 of the NexaCare Acceptable Use Rules.
4. 5.4The Controller sets Users’ permissions and the retention period for transcripts in accordance with the principle of data minimisation (Article 5(1)(c) and (e) GDPR).
5. 5.5Processing data concerning health using artificial intelligence will usually require the Controller to carry out a data protection impact assessment (Article 35 GDPR); the Processor provides assistance under Article 12.

6. Confidentiality

1. 6.1The Processor ensures that persons authorised to process Controller Data have committed themselves to confidentiality or are under a statutory obligation of confidentiality (Article 28(3)(b) GDPR). The Processor and Sub-processors maintain confidentiality about all facts concerning patients at least to the extent imposed on healthcare providers by Section 51 of Act No. 372/2011 Coll., on Health Services.
2. 6.2The Processor instructs these persons on the nature of the data processed and grants them access only to the extent necessary to perform their tasks.
3. 6.3The confidentiality obligation continues after the end of the Contract and of the employment or other relationship of these persons.

7. Security

1. 7.1The Processor takes technical and organisational measures under Article 32 GDPR appropriate to the nature of the data (health data), the scope of processing and the risks to data subjects. An overview of these measures forms Annex 3.
2. 7.2The Processor continuously evaluates and updates the measures. A change must not reduce the overall level of security.
3. 7.3The Controller is responsible for the security of Users’ devices, login credentials and permission settings in the Application.

8. Sub-processors

1. 8.1The Controller gives the Processor general written authorisation to engage Sub-processors (Article 28(2) GDPR). Their categories as at the effective date of the DPA (activity, data processed and place of processing) are listed in Annex 2; the Processor discloses their identity to the Controller in accordance with Annex 2.
2. 8.2The Processor imposes on each Sub-processor, by written contract, the same data protection obligations as set out in this DPA, in particular the obligation to provide sufficient guarantees of appropriate technical and organisational measures (Article 28(4) GDPR).
3. 8.3Changes. The Processor informs the Controller of any intended engagement or replacement of a Sub-processor at least 30 days in advance by e-mail to the Customer’s contact address or in the Application. The notice contains the identity of the Sub-processor, the activity and the place of processing.
4. 8.4Objection. The Controller may raise a reasoned objection to the change within 14 days of the notice. The parties will try to find a solution. If this is not possible, the Controller may terminate the Contract with effect from the date the new Sub-processor is engaged; the Processor refunds the proportionate part of the subscription paid for the period after the end of the Contract.
5. 8.5Urgent replacement. If the security or availability of the Application is at risk, the Processor may temporarily engage a replacement Sub-processor that provides at least equivalent guarantees and processes data in the EU. The Processor informs the Controller within 48 hours at the latest; the replacement engagement lasts no longer than until the objection period under clause 8.4 expires.
6. 8.6The Processor remains liable to the Controller for the performance of the Sub-processor’s obligations (Article 28(4) GDPR).
7. 8.7External systems that the Controller itself connects to the Application (its e-mail inbox, data box, health insurance company portals, outpatient information system) are not Sub-processors; their operators have a direct relationship with the Controller.

9. Transfers outside the EU/EEA

1. 9.1Controller Data is processed exclusively in the European Union. Neither the Processor nor Sub-processors transfer it to third countries or international organisations.
2. 9.2A transfer outside the EU/EEA is possible only on the basis of the Controller’s prior express written instruction and subject to the conditions of Chapter V GDPR.

10. Data subjects’ rights

1. 10.1The Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests for exercising data subjects’ rights under Chapter III GDPR (Article 28(3)(e) GDPR).
2. 10.2The Controller can usually handle requests itself using features of the Application – in particular correcting and erasing patient data, exporting transcripts and documentation, and the overview of access to patient data.
3. 10.3The Processor forwards a data subject’s request received directly by the Processor to the Controller without undue delay; it responds to it on the merits only with the Controller’s written authorisation or where required by law.

11. Personal data breaches

1. 11.1The Processor notifies the Controller of every breach of security of personal data processed under this DPA without undue delay after becoming aware of it, and in any case within 24 hours. The notification will be made to the Controller’s contact address stated in the Contract or in the Application, or through another agreed communication channel.
2. 11.2To the extent of the information available to it at the time, the Processor provides the Controller in particular with:
   1. the nature of the breach,
   2. the categories and approximate number of data subjects and personal data records concerned, if known,
   3. the likely consequences of the breach,
   4. the measures taken or proposed to address the breach and mitigate its consequences, and
   5. a contact person for further communication.
   If not all information is available at the time of the first notification, the Processor may provide it in phases without further undue delay.
3. 11.3The Processor takes, without undue delay, reasonable technical and organisational measures to mitigate the consequences of the breach, eliminate its cause and prevent its recurrence, and provides the Controller with reasonable assistance needed to fulfil its obligations under Articles 33 and 34 GDPR, in particular in assessing the risk, notifying the breach to the supervisory authority or informing data subjects where applicable.
4. 11.4The Processor keeps documentation of personal data breaches to the extent required by the GDPR and, upon reasonable request, provides the Controller with information relating to a breach concerning personal data processed for the Controller.
5. 11.5Neither notification of a breach nor assistance under this Article constitutes an acknowledgement of the Processor’s liability for the breach, damage or other harm.

12. Impact assessment and prior consultation

1. 12.1The Processor provides the Controller with the information and assistance needed for a data protection impact assessment and any prior consultation with the supervisory authority (Articles 35 and 36 GDPR), in particular a description of the processing, data flows, categories of Sub-processors and security measures.
2. 12.2The Processor also assists the Controller in fulfilling other obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it (Article 28(3)(f) GDPR).

13. Demonstrating compliance and audits

1. 13.1The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and allows for audits and inspections (Article 28(3)(h) GDPR).
2. 13.2Documentary evidence. At the Controller’s request, the Processor provides within 30 days a summary of technical and organisational measures, a description of data flows and evidence of Sub-processors’ certifications, and answers additional questions. Compliance is primarily demonstrated in this way.
3. 13.3On-site audit. If documentary evidence is not sufficient, the Controller may carry out an on-site audit no more than once per calendar year, with written notice at least 30 days in advance. In the event of a breach or at the request of a supervisory authority, an audit is possible more often.
4. 13.4The audit is carried out by the Controller or an auditor appointed by it who is bound by confidentiality and is not a competitor of the Processor, in a way that does not disrupt the operation of the Application or disclose data of other customers. The costs of the audit are borne by the Controller unless the audit reveals a material breach of the DPA by the Processor.
5. 13.5The Processor remedies any deficiencies found without undue delay.

14. Artificial intelligence

1. 14.1Speech-to-text conversion, text recognition from documents and language processing (structuring, extraction, categorisation, translation) are carried out by Sub-processors listed in Annex 2, exclusively in the EU.
2. 14.2Neither the Processor nor Sub-processors use Controller Data to train or improve artificial intelligence models.
3. 14.3Adapting suggestions to the style of a specific User (the “My style” feature) is stored only with that User’s account, is not shared and is not model training. Patient identifiers, including names, are replaced in sample sentences before they are stored.
4. 14.4AI Outputs are drafts that the User verifies before use (Terms, Article 7). The Application does not make automated decisions within the meaning of Article 22 GDPR.
5. 14.5The processing of audio recordings is described in the document Voice Recording and Transcription in NexaCare.

15. Return and erasure of data

1. 15.1During the term of the Contract, the Processor keeps Controller Data for the period set out in Annex 1 or according to the Controller’s settings, and erases it on the Controller’s instruction.
2. 15.2After the end of the Contract, Controller Data remains available for export for 30 days. The Processor then irreversibly erases it, including copies, unless Union or Member State law requires it to be retained (Article 28(3)(g) GDPR).
3. 15.3Data may persist in backups for no longer than 14 days, after which it is automatically overwritten. Until then it is protected in the same way as other data and is not used.
4. 15.4At the Controller’s request, the Processor confirms the erasure in writing.

16. Records of processing and data protection officer

1. 16.1The Processor keeps records of all categories of processing activities carried out on behalf of the Controller (Article 30(2) GDPR) and makes them available to the supervisory authority on request.
2. 16.2The Processor’s data protection officer is Mgr. Stanislav Kukal, e-mail: stanislav.kukal@nexacare.cz.

17. Liability

1. 17.1The parties’ liability for damage is governed by Article 13 of the Terms unless the DPA provides otherwise.
2. 17.2Liability towards data subjects and the powers of the supervisory authority under Articles 82 and 83 GDPR are not affected.

18. Term, changes and final provisions

1. 18.1The DPA takes effect together with the Contract and lasts for as long as the Processor processes Controller Data.
2. 18.2Changes to the DPA are governed by Article 16 of the Terms; changes of Sub-processors are governed by Article 8.
3. 18.3The DPA is governed by the laws of the Czech Republic. Disputes are decided by the courts having jurisdiction under clause 17.3 of the Terms.
4. 18.4If any provision is invalid, the remaining provisions remain in force. The provisions of the DPA are interpreted in accordance with the GDPR.

Annex 1 – Description of processing

A. Data subjects

• The Controller’s patients and their legal representatives.
• The Controller’s employees and associates – to the extent of Content (e.g. attendance, shift schedule, activity records in the Application). User account data is processed by the Processor as an independent controller (clause 1.4).
• Correspondents – senders and recipients of communication (e-mail, data box), including representatives of authorities, health insurance companies and other healthcare providers.
• The Controller’s business partners – suppliers and customers from accounting records, service and contractual partners.
• Visitors to the Practice’s public profile who fill in a questionnaire or an appointment request.

B. Categories of data

C. Activities by Module

D. Retention periods

Annex 2 – Sub-processors

All Sub-processors process Controller Data exclusively in the European Union. The Processor discloses the identity of individual Sub-processors (company name, registered office, activity and place of processing) to the Controller without undue delay upon a request sent to gdpr@nexacare.cz. This information is confidential within the meaning of Article 11 of the Terms.

Annex 3 – Technical and organisational measures

Location and infrastructure

• The Application, database and document storage run in data centres in the Netherlands; backups and the sign-in service are in the EU.
• Database backups are kept for 14 days.

Encryption

• Encryption of data in transit and at rest.
• Access credentials for Integrations (e-mail, data box, insurance company portals) are encrypted with a key stored outside the database.
• Passwords are stored only as an irreversible cryptographic hash.
• The private key for electronic signatures never leaves the User’s device.

Data separation and access control

• Separation of Practices’ data is enforced at database level; the Application verifies at startup that the rule applies.
• Roles and permissions down to the level of Modules and individual e-mail inboxes; an inbox assigned to a branch is available only when working in that branch.
• Two-factor authentication, remote sign-out and a limit on concurrent sessions.
• The Processor’s staff access Content only to the extent necessary for operation or at the Controller’s request.
• Reading data across Practices is reserved for automated jobs (e.g. cleanup of old transcripts, e-mail processing) and the Processor’s administrative tools; each such read is logged with the reason stated.

Logging and traceability

• A log of every access to patient data, with an overview for the Practice Administrator.
• Cryptographically chained audit logs – any subsequent alteration of history is detectable.

Minimisation

• Audio recordings are not stored on the Processor’s servers.
• The language model and OCR operate in zero data retention mode; data is not used for training.
• Configurable retention period for transcripts and automatic deletion.

Organisational measures

• Confidentiality and instruction of persons with access to data (Article 6).
• Contracts with Sub-processors under Article 28 GDPR.
• An appointed data protection officer.