ClinikAPI Data Processing Agreement

1.1 This Data Processing Agreement ("DPA") is between Bettar Platforms, Inc., a Delaware corporation, of 8 The Green, Suite B, Dover, DE 19901, United States, through its ClinikAPI product (the "Processor", "we" or "us"), and the organization that has agreed to the ClinikAPI Terms of Service, whether by using the Services under them or by accepting this DPA in the ClinikAPI dashboard (the "Controller" or "you").

1.2 It applies to Personal Data we Process on your behalf through the ClinikAPI API, SDK, React components and dashboard (the "Services") where the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), the UK GDPR and the Data Protection Act 2018 ("UK Data Protection Law"), or the Nigeria Data Protection Act 2023 ("NDPA") (together, the "Data Protection Laws") apply. For the personal data of your patients or end users that you send to the Services, you are the Controller and we are the Processor. For your own account, billing, security and authentication data, we are a controller in our own right and our Privacy Policy governs it.

1.3 Where a HIPAA Business Associate Agreement ("BAA") is also in place, both apply: the BAA governs Protected Health Information under United States law, and this DPA governs Personal Data under the Data Protection Laws. Where they conflict as to Personal Data covered by the Data Protection Laws, this DPA prevails. This DPA forms part of the ClinikAPI Terms of Service (the "Agreement"), whether or not it has also been accepted in the dashboard.

1.4 "Personal Data", "Process", "Controller", "Processor", "Sub-processor", "Data Subject", "Supervisory Authority" and "Personal Data Breach" have the meanings given in the Data Protection Laws. Under the NDPA the Supervisory Authority is the NDPC. Article references are to the EU GDPR; where the NDPA or UK GDPR governs, the corresponding provisions of that law apply.

1.5 Where you are a processor. Where you are yourself a processor for your own clients (the controllers), you act as a processor and we act as your sub-processor under Article 28(4) of the EU GDPR (and the corresponding provisions of the UK GDPR and the NDPA). Your documented instructions to us include the instructions of the controller you act for, to the extent you have passed them on, and you remain responsible for having authority to give them. The obligations in this DPA flow down to us as your sub-processor, and we owe them to you for the benefit of that controller. You shall give the controller the notices and objection rights this DPA gives you (for example clause 3.4).

1.6 Applicability and residency. Whether the Data Protection Laws apply is declared by you at acceptance ("Does GDPR, UK GDPR or the Nigeria NDPA apply to the personal data you send?"), pre-filled from your billing country where there is one, and the answer is stored in the record of acceptance. The DPA card is visible to every organization in the dashboard and listed first for organizations in the EEA, the UK and Nigeria.

1.7 Plans. This DPA applies on every plan, through the Terms, to the Personal Data in your account and its request logs and to any other Personal Data you send to the Services. The Business Associate Agreement applies on paid plans only. The Free plan is for synthetic data only; you must not send real patient data on the Free plan. Real patient data sent on the Free plan is your responsibility, and we may delete it on discovery.

See Annex A: subject matter, duration, nature and purpose, types of Personal Data, categories of Data Subjects.

3.1 Documented instructions (Art. 28(3)(a)). We Process Personal Data only on your documented instructions, including on transfers to a third country, unless Required by Law; in that case we inform you first unless the law prohibits it on important grounds of public interest. This DPA, the Agreement, and your configuration and use of the Services (API calls, dashboard actions) are your complete documented instructions. We tell you without undue delay if, in our opinion, an instruction infringes the Data Protection Laws. We do not Process this Personal Data for our own purposes and do not use it to train, develop or improve any artificial intelligence or machine learning model except as you instruct, and we do not treat information de-identified in accordance with 45 C.F.R. § 164.514 as falling outside this DPA unless that information is anonymous within the meaning of the Data Protection Laws.

3.2 Confidentiality of personnel (Art. 28(3)(b)). Each person we authorize to Process Personal Data is bound by an enforceable duty of confidentiality that survives the end of their engagement, has access only as needed to provide the Services or comply with law, and is trained on their obligations.

3.3 Security (Art. 28(3)(c)). We implement and maintain appropriate technical and organizational measures for a level of security appropriate to the risk, addressing as appropriate: pseudonymization and encryption; ongoing confidentiality, integrity, availability and resilience; the ability to restore availability and access in a timely manner after an incident; and regular testing and evaluation of the measures. We make a current description available on request and will not materially diminish it during the term (see Annex B).

3.4 Sub-processors (Art. 28(3)(d), 28(2), 28(4)). You give general written authorization to engage Sub-processors, subject to this clause.

(a) We maintain a current list of Sub-processors that Process Personal Data on your behalf (each Sub-processor, the Processing it carries out, and its country) and supply it on request to [email protected].

(b) We give at least thirty (30) days' notice before adding or replacing a Sub-processor, by email to the account owner and admins. You may object on reasonable data-protection grounds within that period; if it cannot be resolved in good faith you may terminate the affected Services without penalty before the change takes effect.

(c) We bind each Sub-processor by written contract to data-protection obligations no less protective than this DPA and remain fully liable to you for their performance.

3.5 Data Subject rights (Art. 28(3)(e)). Taking into account the nature of the Processing, we assist you by appropriate technical and organizational measures, insofar as possible, in responding to Data Subject requests (access, rectification, erasure, restriction, portability, objection, and not being subject to solely automated decisions). The Services let you access, correct and delete data yourself, and we give access to it through the API on any plan, through bulk NDJSON export on Team and Enterprise, and through a one-off export from support on Free and Pro; where you cannot act yourself, we give reasonable assistance. If we receive a request directly from a Data Subject we only acknowledge it, direct them to you, and notify you without undue delay.

3.6 Breach notification, DPIAs, consultation (Art. 28(3)(f)).

(a) We notify you of a Personal Data Breach affecting Personal Data we Process for you without undue delay and no later than twenty-four (24) hours after becoming aware of it.

(b) The notice includes what a Controller needs to notify: the nature of the breach, categories and approximate numbers of Data Subjects and records, likely consequences, and measures taken, to the extent known, and is supplemented as information becomes available. We do not delay the first notice to finish investigating.

(c) We give reasonable assistance with security of Processing, notification to Supervisory Authorities and Data Subjects, data protection impact assessments and prior consultation.

(d) We do not notify a Supervisory Authority or Data Subjects, or name you publicly, unless you instruct us or the law requires.

3.7 Deletion or return (Art. 28(3)(g)). At your choice, on expiry or termination we delete or return all Personal Data Processed on your behalf and delete existing copies, except as law requires us to retain it. Data on exit. For 30 days after your account is closed or terminated, you can export your data through the API or by asking support to run a bulk export. After that 30-day window your data is permanently deleted, and backup copies age out within 35 days of that deletion. On request, we confirm the deletion in writing. Return is by export during that 30-day window, and deletion follows it. Anything retained because law requires it (for example audit records) is limited to what the requirement demands, stays protected by this DPA, is used only for that purpose and is deleted when the requirement ends. We confirm on request what was deleted, returned or retained.

3.8 Audits and information (Art. 28(3)(h)). We keep records of Processing as the Data Protection Laws require and make available the information reasonably necessary to show compliance. We allow and contribute to audits, including inspections, by you or an auditor you mandate: not more than once per 12 months (except after a Personal Data Breach or if a Supervisory Authority requires), on at least 30 days' written notice, in business hours, under confidentiality, and without disrupting the Services or compromising other customers' data. We may satisfy a request with current third-party audit reports, certifications or completed security questionnaires where available and adequate.

3.9 Automated decision-making. Where the Services present output of automated Processing, it is for review by your users and is not our decision. We take no decision about a Data Subject producing legal or similarly significant effects on automated Processing alone.

4.1 We are established in the United States, with no establishment in the EEA or the UK, so providing the Services involves transfers of Personal Data from the EEA and the UK to a third country. Where a transfer is not covered by an adequacy decision:

(a) the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") are incorporated, Module Two (controller to processor), you as exporter and us as importer;

(b) for transfers under UK Data Protection Law, the EU SCCs apply as varied by the UK International Data Transfer Addendum issued by the UK Information Commissioner, incorporated here;

(c) for the EU SCCs: Annexes I and II are completed by Annexes A and B; the general authorization and 30-day notice in clause 3.4 apply for Clause 9 (Option 2); the competent Supervisory Authority for Clause 13 is that of the Member State where you are established; Clause 17 is governed by the law of Ireland; Clause 18(b) disputes are before the courts of Ireland; the UK Addendum is governed by the laws of England and Wales and subject to its courts;

(d) the EU SCCs prevail over this DPA and the Agreement for the transfer to which they apply.

4.2 Nigeria. Where the NDPA applies, you are the data controller and we are the data processor, and this DPA's commitments apply. We transfer such Personal Data out of Nigeria only where the NDPA permits, including on a contract binding the recipient to equivalent protection. Nothing in this DPA limits your own obligations to the NDPC.

5.1 Liability and governing law follow the Agreement (Delaware law and courts), except that the EU SCCs and UK Addendum are governed as stated in clause 4.1(c). Claims under this DPA are limited as stated in Section 11 of the Terms: two times (2x) the fees you paid for the Service in the 12 months before the claim, to the extent permitted by law.

5.2 Notices to us: Bettar Platforms, Inc., 8 The Green, Suite B, Dover, DE 19901, United States, and [email protected]. Notices to you: the owner's email on the account. Bettar Platforms, Inc. has no establishment in the EEA or the UK. Where Article 27 of the EU GDPR or the UK GDPR requires us to have a representative, details of our representative, once appointed, are published in our Privacy Policy.

5.3 Acceptance and versions. This DPA is accepted for the organization by a person with the owner or admin role in the dashboard (Settings → Legal), recording the organization, the name and role of the person who accepted, the time, the client-reported IP address, the version and SHA-256 fingerprint of the exact text accepted, the plan at acceptance, and whether the session used two-factor authentication, and the residency answer given under clause 1.6; the IP address is as reported by the client and is not independently verified; no countersignature. A new version is notified in the dashboard and by email to owners and admins, and you have 30 days from that notice to accept it. After day 30 the new version applies by continued use of the Services. The acceptance banner stays until someone accepts, and API traffic is never blocked.

1. Parties. Data exporter: you, the organization that has agreed to the ClinikAPI Terms (identified in the record of acceptance where you have accepted this DPA in the dashboard), as Controller. Data importer: Bettar Platforms, Inc., 8 The Green, Suite B, Dover, DE 19901, United States, as Processor, [email protected].

2. Subject matter. Provision of the Services to you under the Agreement.

3. Duration. From the Effective Date until expiry or termination of the Agreement, plus any retention allowed by clause 3.7.

4. Nature and purpose. Hosting, storage, retrieval, transmission, backup and support of the data you send through the API, SDK and dashboard, including FHIR resource storage. The purpose is to provide the Services; you determine the purposes for which you record Personal Data.

5. Frequency. Continuous.

6. Categories of Data Subjects. Patients and clients of your organization and users of your applications, with dependants, guardians and contacts where you record them; your own team members who use the dashboard.

7. Categories of Personal Data. Identification and contact details; clinical data stored as FHIR R4 resources of the 62 types the API enables (Account, ActivityDefinition, AllergyIntolerance, Appointment, AppointmentResponse, AuditEvent, CarePlan, CareTeam, ChargeItem, Claim, ClaimResponse, ClinicalImpression, Composition, Condition, Consent, Coverage, CoverageEligibilityRequest, CoverageEligibilityResponse, Device, DeviceRequest, DeviceUseStatement, DiagnosticReport, DocumentReference, Encounter, EnrollmentRequest, EnrollmentResponse, ExplanationOfBenefit, FamilyMemberHistory, Goal, HealthcareService, ImagingStudy, Immunization, ImmunizationEvaluation, ImmunizationRecommendation, Invoice, Location, Measure, MeasureReport, Media, Medication, MedicationDispense, MedicationKnowledge, MedicationRequest, MedicationStatement, NutritionOrder, Observation, Organization, Patient, PaymentNotice, PaymentReconciliation, Person, PlanDefinition, Practitioner, PractitionerRole, QuestionnaireResponse, RiskAssessment, Schedule, ServiceRequest, Slot, Specimen, Task, VisionPrescription); account and API-credential metadata; technical logs and audit records of API requests.

8. Special categories. Data concerning health, inherent in the Services, and any other special category you choose to record, Processed only to deliver your application and care.

9. Sub-processors. As in clause 3.4; supplied on request to [email protected].

10. Competent Supervisory Authority. Under Clause 13 of the EU SCCs (EU); the UK Information Commissioner (UK); the NDPC (Nigeria).

We maintain the following measures, and describe them further on request:

1. Encryption of personal data in transit and at rest.

2. Access controls, including two-factor authentication for staff and tenant isolation between customers.

3. Audit logging of access to and changes in personal data.

4. Backups and recovery.

5. Security and data-protection training for staff.

6. An incident response process.