Personal Data Processing Agreement

concluded pursuant to the Carebot AI CXR Software License Terms and Conditions (hereinafter the “Terms and Conditions”) in accordance with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the “GDPR”) and pursuant to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors pursuant to Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (hereinafter the “Clauses”) between

Carebot s.r.o.

with registered office Rašínovo nábřeží 71/10, Vyšehrad, 128 00 Praha 2

Company ID No.: 10898263

company registered in the Commercial Register at the Regional Court in Brno, Section C, Insert 123423

(hereinafter the “Processor”)

and

Licensee under the Terms and Conditions

(hereinafter the “Controller")

(hereinafter the “Contracting Party” or collectively as the “Contracting Parties”).

‍

‍

SECTION I.

Clause 1

Purpose and Scope

1. The purpose of these Clauses is to ensure compliance with Article 28(3) and (4) of the GDPR.
2. The Controller and Processor listed in Annex I have approved these Clauses to ensure compliance with Article 28(3) and (4) of the GDPR.
3. These Clauses apply to the processing of personal data as specified in Annex II.
4. Annexes I to IV form an integral part of these Clauses.
5. These Clauses are without prejudice to the obligations that the Controller has to fulfil under the GDPR.
6. These Clauses do not in themselves ensure compliance with the international transfer obligations under Chapter V of the GDPR.

Clause 2

Immutability of Clauses

1. The Contracting Parties undertake not to amend the Clauses, except to supplement or update the information in the Annexes.
2. This does not prevent the Parties from being able to include these Clauses in a broader agreement or to add other clauses or other safeguards to them, provided that these do not conflict directly or indirectly with the Clauses or do not restrict the fundamental rights or freedoms of data subjects.

Clause 3

Interpretation

1. In cases where these Clauses use terms defined in the GDPR, these terms have the same meaning as in that Regulation.
2. These Clauses are understood and interpreted in accordance with the provisions of the GDPR.
3. These Clauses shall not be interpreted in a manner inconsistent with the rights and obligations set out in the GDPR or restricting the fundamental rights or freedoms of data subjects

Clause 4

Hierarchy

1. In the event of a conflict between these Clauses and the provisions of related agreements existing between the Contracting Parties at the time these Clauses are agreed upon or agreements concluded subsequently, these Clauses shall prevail.

SECTION II.

OBLIGATIONS OF THE PARTIES

Clause 5

Description of Processing

1. Details of the processing operations, in particular the categories of personal data and the purposes for which the personal data are processed on behalf of the Controller, are set out in Annex II.

Clause 6

Obligations of the Parties

1. Instructions
   
   1. The Processor processes personal data only on the basis of written instructions from the Controller, unless such processing is required by Union or Member State law to which the Controller is subject. In this case, the Processor shall inform the Controller of that legal requirement prior to processing, unless prohibited by law for reasons of important public interest. The Controller may also issue further instructions throughout the processing of personal data. These instructions must always be documented in writing.
   2. The Processor shall immediately inform the Controller if, in its opinion, the Controller's instructions violate the GDPR or the relevant Union or Member State data protection provisions.
2. Purpose Limitations
   
   1. The Processor processes personal data only for the specific purpose or purposes of processing as set out in Annex II, unless further instructions are received from the Controller.
3. Duration of Personal Data Processing
   
   1. Processing by the Processor shall take place only for the period specified in Annex II.
4. Processing Security
   
   1. In order to ensure the security of personal data, the Processor must implement at least the technical and organizational measures listed in Annex III. These measures must include the protection of data against security breaches that would lead to its accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access (personal data breach). In assessing the appropriate level of security, the Parties shall take into account the condition of equipment, the cost of implementation, the nature, the scope, the context and the purposes of processing and the risks to data subjects.
   2. The Processor shall grant its employees access to the processed personal data only to the extent necessary for the implementation, administration and control of the Agreement. The Processor shall ensure that persons authorized to process the personal data received undertake to maintain confidentiality or are subject to a legal obligation of confidentiality.
5. Sensitive Data
   
   1. Where the processing involves personal data revealing racial or ethnic origin, political opinions, religion or philosophical beliefs or trade union membership, genetic or biometric data for the purpose of uniquely identifying a natural person, data concerning the health or sex life or sexual orientation of that person, or data concerning criminal convictions and offences (hereinafter the “Sensitive Data”), the Processor shall apply specific restrictions or additional safeguards.
6. Documentation and Compliance
   
   1. Parties shall be able to demonstrate compliance with these Clauses.
   2. The Processor shall deal promptly and appropriately with the Controller's inquiries concerning processing under these Clauses.
   3. The Processor shall provide the Controller with all information necessary to demonstrate compliance with the obligations set out in these Clauses, which arise directly from the GDPR. The Processor shall also, at the request of the Controller, allow and contribute to audits of the processing activities covered by these Clauses at reasonable intervals or where there are indications of non-compliance. When deciding on a review or audit, the Controller may take into account relevant certificates held by the Processor.
   4. The Controller can decide whether to carry out the audit itself or appoint an independent auditor. Audits may also include inspections at the Processor’s facilities and premises and, where appropriate, shall be announced in advance in due time.
   5. The Parties shall, upon request, make available the information referred to in this Clause, including the results of any audits, to the competent supervisory authority or authorities.
7. Use of Sub-Processors of Data
   
   1. Without specific prior written authorization from the Controller, the Processor may not sub-contract to a sub-processor any of its data processing activities which are carried out on behalf of the Controller in accordance with these Clauses. The Processor shall submit an application for a specific authorization at least 15 days before the sub-processor concerned is involved, together with the information necessary to enable the Controller to decide on the authorization. The list of sub-processors approved by the Controller is set out in Annex IV. The Contracting Parties shall keep Annex IV updated.
   2. Where the Processor engages a sub-processor in specific processing activities (on behalf of the Controller), it shall do so by means of an Agreement which imposes on the sub-processor substantially the same data protection obligations as those imposed on the data processor in accordance with these Clauses. The Processor shall ensure that the sub-processor fulfils the obligations applicable to the Processor under these Clauses and the GDPR.
   3. Upon request, the Processor shall provide the Controller with a copy of the agreement with the sub-processor and any subsequent amendments to the agreement. To the extent necessary to protect trade secrets or other confidential information, including personal data, the Processor may modify the text of the agreement before providing a copy.
   4. The Processor is fully responsible to the Controller for ensuring that the sub-processor fulfils the obligations arising from its agreement with the Processor. The Processor shall inform the Controller if the sub-processor fails to fulfil its obligations under that Agreement.
   5. The Processor shall approve with the sub-processor a clause in favor of a third party, according to which if the Processor effectively disappears, legally ceases to exist or becomes insolvent, the Controller has the right to terminate the agreement with the sub-processor and instruct the sub-processor to delete or return the personal data.
8. International Data Transfer
   
   1. Any transfer of data by a Processor to a third country or an international organization shall be made only on the basis of written instructions from the Controller or in order to fulfil a specific requirement under Union or Member State law to which the Processor is subject, in accordance with Chapter V of the GDPR.
   2. The Controller agrees that where a Processor engages a sub-processor for specific processing activities (on behalf of the Controller) in accordance with clause 6.7 and those activities involve the transfer of personal data within the meaning of Chapter V of the GDPR, the Processor and the sub-processor may ensure compliance with the provisions of Chapter V of the GDPR by using standard contractual clauses adopted by the Commission in accordance with Article 46(2) of the GDPR, provided that the standard conditions for the use of such contractual clauses are met.

Clause 7

Assistance Provided to the Controller

1. The Processor shall immediately inform the Controller of any request received from the data subject. It does not respond to this request itself unless authorized to do so by the Controller.
2. The Processor assists the Controller in fulfilling its obligations to respond to requests from data subjects to exercise their rights, taking into account the nature of the processing. In carrying out its obligations under points (a) and (b), the Processor shall comply with the instructions of the Controller.
3. In addition to the Processor's obligation to assist the Controller under clause 7(b), the Processor shall also assist the Controller in ensuring that the following obligations are fulfilled, taking into account the nature of the data processing and the information available to the Processor:
   
   1. the obligation to carry out a data protection impact assessment of the intended processing operations (hereinafter the “Data Protection Impact Assessment”) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;
   2. the obligation to consult the competent supervisory authority or competent supervisory authorities prior to processing where the Data Protection Impact Assessment indicates that the processing would result in a high risk in the absence of measures by the Controller to mitigate that risk;
   3. the obligation to ensure that the personal data are accurate and up-to-date by informing the Controller without delay if it becomes aware that the personal data it processes are inaccurate or out of date;
   4. obligations under Article 32 of the GDPR.
4. Annex III shall set out the appropriate technical and organizational measures by which the Processor is required to assist the Controller in the application of this Clause, as well as the Scope and the scope of the assistance requested.

Clause 8

Reporting Personal Data Breaches

In the event of a personal data breach, the Processor shall cooperate with the Controller and assist it in fulfilling its obligations under Articles 33 and 34 of the GDPR, taking into account the nature of the processing and the information available to the Processor.

1. Breach of security of data processed by the Controller
   In the event of a breach of the security of personal data processed by the Controller, the Processor assists the Controller:
   
   1. when reporting personal data breaches to the competent supervisory authority or competent supervisory authorities, without undue delay after the Controller has become aware of them, if applicable / (unless the personal data breach is unlikely to result in a threat to the rights and freedoms of natural persons);
   2. in obtaining the following information, which must be included in the Controller's notification pursuant to Article 33(3) of the GDPR, and which must at least include:
      
      1. the nature of the personal data breach in question, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
      2. the likely consequences of the personal data breach;
      3. measures taken or proposed to be taken in relation to a personal data breach, including, where appropriate, measures to mitigate potential adverse effects. Where it is not possible to provide all this information at once, the original notification shall contain the information available at the time and further information shall then be provided without undue delay as soon as it becomes available.
   3. in fulfilling the obligation in accordance with Article 34 of the GDPR to notify the data subject of a personal data breach without undue delay if the personal data breach is likely to result in a high risk to the rights and freedom of natural persons.
2. Breach of security of data processed by the Processor
   In the event of a breach of the security of personal data processed by the Processor, the Processor shall inform the Controller without undue delay after becoming aware of the breach. Such notification shall include at least:
   
   1. a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects concerned and the data records);
   2. details of the contact point where more information about the personal data breach can be obtained;
   3. the likely consequences and measures taken or proposed to be taken in relation to the breach, including measures to mitigate potential adverse effects.

Where it is not possible to provide all this information at once, the original notification shall contain the information available at the time and further information shall then be provided without undue delay as soon as it becomes available.

The Parties shall set out in Annex III all additional information to be provided by the Processor when assisting the Controller in fulfilling the Controller's obligations under Articles 33 and 34 of the GDPR.

SECTION III.

FINAL PROVISIONS

Clause 9

Breach of Clauses and Termination of the Agreement

1. Without prejudice to any provisions of the GDPR, if the Processor breaches its obligations under these Clauses, the Controller may order the Processor to suspend the processing of personal data until the Processor fulfils its obligations under these Clauses or the Agreement is terminated. The Processor shall immediately inform the Controller if, for any reason, it is unable to comply with the provisions of these Clauses.
2. The Controller is entitled to terminate the Agreement to the extent that it relates to the processing of personal data in accordance with these Clauses if:
   
   1. the Controller has suspended the processing of personal data by the Processor under point (a) and compliance with the obligations under these Clauses is not resumed within a reasonable period and in any event within one month of the suspension;
   2. the Processor is in serious or persistent breach of these Clauses or obligations under the GDPR;
   3. the Processor fails to comply with a binding decision of the competent court or competent supervisory authority or competent supervisory authorities concerning its obligations under these Clauses or under the GDPR.
3. The Processor is entitled to terminate the Agreement to the extent that it relates to the processing of personal data under these Clauses if, after informing the Controller that the Controller’s instructions violate the applicable legal requirements under clause 6.1 (b), the Controller insists on compliance with these instructions.
4. Upon termination of the Agreement, the Processor shall, at the choice of the Controller, delete all personal data processed on behalf of the Controller and confirm to the Controller that it has done so, or return all personal data to the Controller and delete existing copies unless Union or Member State law requires the retention of personal data. Until the personal data are deleted or returned, the Processor continues to ensure compliance with these Clauses.

Annexes:

- Annex I – List of Parties

- ANNEX II – Description of Processing

- ANNEX III – Technical and Organizational Measures Including Technical and Organizational Measures to Ensure Data Security

- ANNEX IV – List of Sub-Processors

‍

ANNEX I

List of Parties

Controller:

The Data Controller is the Licensee who uses the Software under the Terms and Conditions

Processor:

The Processor of personal data is Carebot, s.r.o., which as the Provider made the Software available to the Controller as the Licensee under the Terms and Conditions.

ANNEX II

Description of Processing

Categories of data subjects whose personal data are processed

Controller's patients whose personal data will be made available to the Processor when using the Software to the extent and under the conditions set out in the Terms and Conditions.

Categories of personal data processed

Image documentation of the Controller's patients in accordance with the Terms and Conditions, including accompanying data and a unique meaningless identifier (code) of individual patients.

Sensitive Data processed (where applicable) and restrictions or safeguards applied that fully account for the nature of the data and the risks involved, such as strict purpose limitations, access limitations (including access only for personnel who have received specialized training), record-keeping of access to the data, restrictions of onward transfer or other security measures.

Health information of the Controller’s patients, as available from the image documentation, will be provided to the Processor exclusively in coded (i.e. pseudonymized) form on the basis of the Terms and Conditions. The Processor will not be able to attribute the Controller’s patients’ personal data to a specific data subject without the use of additional information, which will be kept separately by the Controller and subject to the Controller’s technical and organizational measures to ensure that it cannot be attributed by the Processor to a specific identified or identifiable natural person of the patient.

Nature of processing

Personal data under these Clauses will be processed in an automated manner agreed upon in the Agreement.

The purpose(s) for which the personal data are processed on behalf of the Controller

Personal data will be processed for the purposes specified in the Agreement.

Duration of processing

Personal data will be processed by the Processor for the duration of cooperation under the Terms and Conditions.

ANNEX III

Technical and organizational measures, including technical and organizational measures to ensure data security

A description of the technical and organizational security measures implemented by the Processor(s) (including relevant certificates) to ensure an adequate level of security, taking into account the nature, the scope, the context and the purpose of the processing, as well as the risks to the rights and freedoms of natural persons.

Process and product certification / security measures

• The Processor is certified in accordance with the internationally recognized standard for information security management systems (ISMS) in accordance with the technical standard ČSN EN ISO/IEC 27001. This standard is part of the set of technical standards ČSN EN ISO/IEC 27000, which also includes the standard ČSN EN ISO/IEC 27002 Information security, cybersecurity and privacy protection – Information security measures.
• The Processor provides the Software users with comprehensive information on the intended purpose and proper use of the Software and any measures to be taken when using the Software as outlined in the user and installation instructions.

Measures for pseudonymization, encryption of personal data and data protection during transmission

• The Software will use the unique meaningless identifier 0020,000D Study Instance UID to match the text and graphical output from the Software with a specific patient on the Controller’s side.
• Communication between medical devices for electronic processing, archiving and distribution of image data (PACS) and the Software is carried out exclusively via the DICOMweb API service and the encrypted https protocol.

Measures to ensure the continued confidentiality, integrity, availability and resilience of processing systems and services and measures to ensure the ability to restore the availability of and access to personal data in a timely manner in the event of physical or technical incidents;

• The Software is remotely monitored and serviced by the Processor according to the Terms and Conditions.
• The Processor has established processes for regular testing, assessment and evaluation of the effectiveness of the technical and organizational measures implemented to ensure the security of the processing.
• The Processor has implemented measures to protect the data during storage and ensure the physical security of locations where personal data is processed, as well as measures to ensure that events are recorded during the operation of the Software (logging).

Measures for user identification, provision of user permissions and accountability

• The Controller identifies individual users (doctors) and provides their list to the Processor and the PACS provider.
• Access to the archive collecting predictive information from the Software is granted only to trained personnel of the Controller with the required competence, in particular (not exclusively) radiologists, pneumologists and, after training, other medical specialties.
• The Software employs single-factor authentication using issued login credentials (so-called basic access authentication). These data is available to the local administrator of the PACS, or to the personnel of the computer science department of the Controller.
• Access data issued by the Processor consists of a username and password that is always equal to or longer than 32 characters. Access is granted using a user profile at the linked PACS level.
• Before using the Software, the user must carefully familiarize themselves with the contents of the instructions for use. The user training will be carried out by the Processor after the implementation of the Software and then at each released version with a change in the first number of the versioning format (i.e. MAJOR update).

Measures for system configuration, including default configuration, internal IT governance and IT security measures

• The terms of installation, maintenance, including default configuration and system requirements of the Software are specified in the installation instructions for the Software.
• The Software is intended to be used exclusively with approved medical devices for the electronic processing, archiving and distribution of image data (PACS).
• The Processor has implemented measures for internal administration and management of IT and IT security.

Measures to ensure data minimization and quality

• Image documentation intended for analysis within the Software will be transmitted via PACS in the standardized DICOM format. The Controller shall ensure, in cooperation with the PACS Provider, that all attributes allowing the direct identification of a specific patient are set to blank or “Zero” within the PACS connected to the Software in accordance with DICOM Recommendation PS3.15 2023c, Chapter E – Attribute Confidentiality Profiles (Normative).
• The Software will use the unique meaningless identifier 0020,000D Study Instance UID to match the text and graphical output from the Software with a specific patient on the Controller’s side.

ANNEX IV

List of Sub-Processors

The controller has authorized the use of the following sub-processors:

Microsoft Ireland Operations Limited

One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Irsko

Description of processing: The sub-processor will only process personal data in the course of providing the Microsoft Azure cloud service used by the Software