Carebot

Solutions（https://www.carebot.com/solutions）

Real-world evidence（https://www.carebot.com/real-world-evidence）

How it works（https://www.carebot.com/how-it-works）

About us（https://www.carebot.com/about-us）

AI in healthcare（https://www.carebot.com/ai-in-healthcare）

Select Language English

I'm Interested（https://www.carebot.com/book-a-call）

Select Language English

Personal data processing agreement

concluded pursuant to the Carebot AI CXR Software License Terms and Conditions (hereinafter the “Terms and Conditions”) in accordance with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the “GDPR”) and pursuant to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors pursuant to Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (hereinafter the “Clauses”) between

Carebot s.r.o.

with registered office Libušina 49/3, Vyšehrad 128 00 Praha 2

Company ID No.: 10898263

company registered in the Commercial Register at the Regional Court in Brno, Section C, Insert 123423

(hereinafter the “Processor”)

and

Licensee under the Terms and Conditions

(hereinafter the “Controller")

(hereinafter the “Contracting Party” or collectively as the “Contracting Parties”).

SECTION I.

Clause 1

Purpose and Scope

The purpose of these Clauses is to ensure compliance with Article 28(3) and (4) of the GDPR.

The Controller and Processor listed in Annex I have approved these Clauses to ensure compliance with Article 28(3) and (4) of the GDPR.

These Clauses apply to the processing of personal data as specified in Annex II.

Annexes I to IV form an integral part of these Clauses.

These Clauses are without prejudice to the obligations that the Controller has to fulfil under the GDPR.

These Clauses do not in themselves ensure compliance with the international transfer obligations under Chapter V of the GDPR.

Clause 2

Immutability of Clauses

The Contracting Parties undertake not to amend the Clauses, except to supplement or update the information in the Annexes.

This does not prevent the Parties from being able to include these Clauses in a broader agreement or to add other clauses or other safeguards to them, provided that these do not conflict directly or indirectly with the Clauses or do not restrict the fundamental rights or freedoms of data subjects.

Clause 3

Interpretation

In cases where these Clauses use terms defined in the GDPR, these terms have the same meaning as in that Regulation.

These Clauses are understood and interpreted in accordance with the provisions of the GDPR.

These Clauses shall not be interpreted in a manner inconsistent with the rights and obligations set out in the GDPR or restricting the fundamental rights or freedoms of data subjects

Clause 4

Hierarchy

In the event of a conflict between these Clauses and the provisions of related agreements existing between the Contracting Parties at the time these Clauses are agreed upon or agreements concluded subsequently, these Clauses shall prevail.

SECTION II.

OBLIGATIONS OF THE PARTIES

Clause 5

Description of Processing

Details of the processing operations, in particular the categories of personal data and the purposes for which the personal data are processed on behalf of the Controller, are set out in Annex II.

Clause 6

Obligations of the Parties

Instructions

The Processor processes personal data only on the basis of written instructions from the Controller, unless such processing is required by Union or Member State law to which the Controller is subject. In this case, the Processor shall inform the Controller of that legal requirement prior to processing, unless prohibited by law for reasons of important public interest. The Controller may also issue further instructions throughout the processing of personal data. These instructions must always be documented in writing.

The Processor shall immediately inform the Controller if, in its opinion, the Controller's instructions violate the GDPR or the relevant Union or Member State data protection provisions.

Purpose Limitations

The Processor processes personal data only for the specific purpose or purposes of processing as set out in Annex II, unless further instructions are received from the Controller.

Duration of Personal Data Processing

Processing by the Processor shall take place only for the period specified in Annex II.

Processing Security

In order to ensure the security of personal data, the Processor must implement at least the technical and organizational measures listed in Annex III. These measures must include the protection of data against security breaches that would lead to its accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access (personal data breach). In assessing the appropriate level of security, the Parties shall take into account the condition of equipment, the cost of implementation, the nature, the scope, the context and the purposes of processing and the risks to data subjects.

The Processor shall grant its employees access to the processed personal data only to the extent necessary for the implementation, administration and control of the Agreement. The Processor shall ensure that persons authorized to process the personal data received undertake to maintain confidentiality or are subject to a legal obligation of confidentiality.

Sensitive Data

Where the processing involves personal data revealing racial or ethnic origin, political opinions, religion or philosophical beliefs or trade union membership, genetic or biometric data for the purpose of uniquely identifying a natural person, data concerning the health or sex life or sexual orientation of that person, or data concerning criminal convictions and offences (hereinafter the “Sensitive Data”), the Processor shall apply specific restrictions or additional safeguards.

Documentation and Compliance

Parties shall be able to demonstrate compliance with these Clauses.

The Processor shall deal promptly and appropriately with the Controller's inquiries concerning processing under these Clauses.

The Processor shall provide the Controller with all information necessary to demonstrate compliance with the obligations set out in these Clauses, which arise directly from the GDPR. The Processor shall also, at the request of the Controller, allow and contribute to audits of the processing activities covered by these Clauses at reasonable intervals or where there are indications of non-compliance. When deciding on a review or audit, the Controller may take into account relevant certificates held by the Processor.

The Controller can decide whether to carry out the audit itself or appoint an independent auditor. Audits may also include inspections at the Processor’s facilities and premises and, where appropriate, shall be announced in advance in due time.

The Parties shall, upon request, make available the information referred to in this Clause, including the results of any audits, to the competent supervisory authority or authorities.

Use of Sub-Processors of Data

Without specific prior written authorization from the Controller, the Processor may not sub-contract to a sub-processor any of its data processing activities which are carried out on behalf of the Controller in accordance with these Clauses. The Processor shall submit an application for a specific authorization at least 15 days before the sub-processor concerned is involved, together with the information necessary to enable the Controller to decide on the authorization. The list of sub-processors approved by the Controller is set out in Annex IV. The Contracting Parties shall keep Annex IV updated.

Where the Processor engages a sub-processor in specific processing activities (on behalf of the Controller), it shall do so by means of an Agreement which imposes on the sub-processor substantially the same data protection obligations as those imposed on the data processor in accordance with these Clauses. The Processor shall ensure that the sub-processor fulfils the obligations applicable to the Processor under these Clauses and the GDPR.

Upon request, the Processor shall provide the Controller with a copy of the agreement with the sub-processor and any subsequent amendments to the agreement. To the extent necessary to protect trade secrets or other confidential information, including personal data, the Processor may modify the text of the agreement before providing a copy.

The Processor is fully responsible to the Controller for ensuring that the sub-processor fulfils the obligations arising from its agreement with the Processor. The Processor shall inform the Controller if the sub-processor fails to fulfil its obligations under that Agreement.

The Processor shall approve with the sub-processor a clause in favor of a third party, according to which if the Processor effectively disappears, legally ceases to exist or becomes insolvent, the Controller has the right to terminate the agreement with the sub-processor and instruct the sub-processor to delete or return the personal data.

International Data Transfer

Any transfer of data by a Processor to a third country or an international organization shall be made only on the basis of written instructions from the Controller or in order to fulfil a specific requirement under Union or Member State law to which the Processor is subject, in accordance with Chapter V of the GDPR.

The Controller agrees that where a Processor engages a sub-processor for specific processing activities (on behalf of the Controller) in accordance with clause 6.7 and those activities involve the transfer of personal data within the meaning of Chapter V of the GDPR, the Processor and the sub-processor may ensure compliance with the provisions of Chapter V of the GDPR by using standard contractual clauses adopted by the Commission in accordance with Article 46(2) of the GDPR, provided that the standard conditions for the use of such contractual clauses are met.

Clause 7

Assistance Provided to the Controller

The Processor shall immediately inform the Controller of any request received from the data subject. It does not respond to this request itself unless authorized to do so by the Controller.

The Processor assists the Controller in fulfilling its obligations to respond to requests from data subjects to exercise their rights, taking into account the nature of the processing. In carrying out its obligations under points (a) and (b), the Processor shall comply with the instructions of the Controller.

In addition to the Processor's obligation to assist the Controller under clause 7(b), the Processor shall also assist the Controller in ensuring that the following obligations are fulfilled, taking into account the nature of the data processing and the information available to the Processor:

the obligation to carry out a data protection impact assessment of the intended processing operations (hereinafter the “Data Protection Impact Assessment”) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

the obligation to consult the competent supervisory authority or competent supervisory authorities prior to processing where the Data Protection Impact Assessment indicates that the processing would result in a high risk in the absence of measures by the Controller to mitigate that risk;

the obligation to ensure that the personal data are accurate and up-to-date by informing the Controller without delay if it becomes aware that the personal data it processes are inaccurate or out of date;

obligations under Article 32 of the GDPR.

Annex III shall set out the appropriate technical and organizational measures by which the Processor is required to assist the Controller in the application of this Clause, as well as the Scope and the scope of the assistance requested.

Clause 8

Reporting Personal Data Breaches

In the event of a personal data breach, the Processor shall cooperate with the Controller and assist it in fulfilling its obligations under Articles 33 and 34 of the GDPR, taking into account the nature of the processing and the information available to the Processor.

Breach of security of data processed by the Controller In the event of a breach of the security of personal data processed by the Controller, the Processor assists the Controller:

when reporting personal data breaches to the competent supervisory authority or competent supervisory authorities, without undue delay after the Controller has become aware of them, if applicable / (unless the personal data breach is unlikely to result in a threat to the rights and freedoms of natural persons);

in obtaining the following information, which must be included in the Controller's notification pursuant to Article 33(3) of the GDPR, and which must at least include:

the nature of the personal data breach in question, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

the likely consequences of the personal data breach;

measures taken or proposed to be taken in relation to a personal data breach, including, where appropriate, measures to mitigate potential adverse effects. Where it is not possible to provide all this information at once, the original notification shall contain the information available at the time and further information shall then be provided without undue delay as soon as it becomes available.

in fulfilling the obligation in accordance with Article 34 of the GDPR to notify the data subject of a personal data breach without undue delay if the personal data breach is likely to result in a high risk to the rights and freedom of natural persons.

Breach of security of data processed by the Processor In the event of a breach of the security of personal data processed by the Processor, the Processor shall inform the Controller without undue delay after becoming aware of the breach. Such notification shall include at least:

a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects concerned and the data records);

details of the contact point where more information about the personal data breach can be obtained;

the likely consequences and measures taken or proposed to be taken in relation to the breach, including measures to mitigate potential adverse effects.

Where it is not possible to provide all this information at once, the original notification shall contain the information available at the time and further information shall then be provided without undue delay as soon as it becomes available.

The Parties shall set out in Annex III all additional information to be provided by the Processor when assisting the Controller in fulfilling the Controller's obligations under Articles 33 and 34 of the GDPR.

SECTION III.

FINAL PROVISIONS

Clause 9

Breach of Clauses and Termination of the Agreement

Without prejudice to any provisions of the GDPR, if the Processor breaches its obligations under these Clauses, the Controller may order the Processor to suspend the processing of personal data until the Processor fulfils its obligations under these Clauses or the Agreement is terminated. The Processor shall immediately inform the Controller if, for any reason, it is unable to comply with the provisions of these Clauses.

The Controller is entitled to terminate the Agreement to the extent that it relates to the processing of personal data in accordance with these Clauses if:

the Controller has suspended the processing of personal data by the Processor under point (a) and compliance with the obligations under these Clauses is not resumed within a reasonable period and in any event within one month of the suspension;

the Processor is in serious or persistent breach of these Clauses or obligations under the GDPR;

the Processor fails to comply with a binding decision of the competent court or competent supervisory authority or competent supervisory authorities concerning its obligations under these Clauses or under the GDPR.

The Processor is entitled to terminate the Agreement to the extent that it relates to the processing of personal data under these Clauses if, after informing the Controller that the Controller’s instructions violate the applicable legal requirements under clause 6.1 (b), the Controller insists on compliance with these instructions.

carebot.com的其他相关信息