Data Processing Agreement

This Data Processing Agreement ("DPA") governs the processing of personal data by CallidusOS Limited ("Processor") on behalf of subscribing clinics ("Controller").

The Clinic acts as Data Controller in respect of Clinical Data belonging to its patients. CallidusOS acts as Data Processor, processing Clinical Data solely on the documented instructions of the Clinic.

Purpose: To provide the CallidusOS® platform services to the Clinic.

Nature: Storage, retrieval, analysis, transmission, and deletion of Clinical Data.

Types of data: Patient names, contact details, medical history, treatment records, consent records, and other clinical information uploaded by the Clinic.

Categories of data subjects: Patients and prospective patients of the Clinic.

Duration: For the term of the Agreement and as set out in the Retention and Deletion Policy.

CallidusOS shall process Clinical Data only on documented instructions from the Clinic; ensure confidentiality obligations are in place for all authorised personnel; implement appropriate technical and organisational security measures; provide 14 days' notice before adding or replacing sub-processors; assist with data subject rights requests within 72 hours; notify the Clinic of any data breach within 24 hours; and delete or return all Clinical Data within 30 days of termination.

CallidusOS maintains the following security measures:

• AES-256 encryption at rest

• TLS 1.3 encryption in transit

• Role-based access controls (six permission levels)

• Multi-factor authentication (TOTP) available for staff

• Bot protection and application attestation (reCAPTCHA Enterprise, Firebase App Check)

• Immutable audit logging of data access

• Error monitoring and alerting

• Clinical records hosted in the UK (Google Cloud, London)

Where sub-processors operate outside the UK or EU, CallidusOS ensures all data transfers are governed by Standard Contractual Clauses or equivalent safeguards approved under UK GDPR.

This Agreement is governed by the laws of England and Wales and interpreted in accordance with UK GDPR and the Data Protection Act 2018.