Neogenic Data Processing Agreement

1. Parties and roles

1.1 This agreement is between the clinic whose authorized person accepted it during onboarding, as recorded in Annex 1 (the Clinic), and Scality Ltd (Scality), which provides the Neogenic software. It forms part of the Neogenic Terms of Service.

1.2 For the processing in section 2 the Clinic is the controller and Scality is the processor, except for the hand-over in section 2.9, for which the Clinic and Scality are joint controllers under Annex 3. Scality's own processing as controller of staff account data, of data for billing the Clinic for Neogenic, and of support-contact data is described in its privacy notice and is outside this agreement.

2. What is processed

2.1 Purpose: providing the Neogenic service to the Clinic: managing contacts, leads and enquiries, companies, opportunities, tasks, scheduling, forms, content and communications, documents and files with the "Patient records" Space, the patient status on a Contact, choosing whom to invite into the patient portal and sending the invitation, choosing which reports to release, the patient's connection in the Clinic's records, statistics of the patient portal for the Clinic, showing the Clinic's invoices and memberships to its patients in the patient portal and the payment of an invoice there, invoices and receipts to the Clinic's clients, payment records, online card payments through the Clinic's own Stripe account, invoice links for the Clinic's clients, memberships and plans for the Clinic's clients, and the Neo assistant acting within staff permissions, as the Clinic configures them. Nature of processing: collecting (including through the Clinic's forms and connected mailboxes), storing, organising, retrieving and displaying, storing and displaying a patient's documents and files, recording who viewed a patient's data, releasing a report to the patient the Clinic chooses, sending email and calendar updates that the Clinic's staff make, creating on the Clinic's instruction the invoices, receipts and credit notes that the Clinic issues, keeping the Clinic's records of payments, memberships and plans, sending a client a link to view, download or pay an invoice or receipt when the Clinic's staff choose to send one, passing to Stripe what a card payment needs and recording its result, AI-assisted drafting and summarising by Neo when staff ask for it, reading by Neo, within the limits set in section 5.3 of the Terms of Service, when a staff member asks, exporting and deleting. The hand-over of a released report into the patient portal is not processing for the Clinic alone: the Clinic and Scality decide it together, as joint controllers. Section 2.9 and Annex 3 set out the arrangement for this step.

2.2 Data subjects: the Clinic's leads, enquirers, clients, patients and business contacts; children, where the Clinic treats them; other people named in a patient's record, such as a relative or an emergency contact; the people who receive or pay the Clinic's invoices; members of the Clinic's memberships and plans; and Clinic staff users.

2.3 Personal data: contact details (name, email, phone), source and campaign, marketing-consent and opt-out status and their records, including the record of a person's objection to marketing that is kept after their contact is erased (section 9.3), enquiry, pipeline and appointment status, calendar and appointment details, notes and tasks, form submissions (with the submitter's IP address and browser information recorded with them), email/message history, conversations with Neo and the instructions staff give it, files staff share with Neo, and staff user identifiers. Health data, in the places that section 2.3 of the Terms of Service allows: a Contact's fields, custom fields, tags and notes; a patient's deals; appointment notes; form questions and answers; documents in the "Patient records" Space; tasks and task comments about a person. Also the patient status on a Contact. The record of views: which staff user viewed or changed a patient record, and when. Billing data is also processed: the billing name and address; invoices, receipts and credit notes (numbers, dates, line descriptions, amounts, discounts and taxes); payment records (amounts, dates, payment method and references); and memberships and plans (the plan, dates, renewals, payment schedules, custom fields, and the sessions or credits used). For online card payments it also includes the Stripe identifiers, status, amounts and dates of each payment and refund, and the payment notices Stripe sends Scality, which Scality keeps for at most 90 days; Scality never receives card numbers. For invoice links it also includes the recipient's email address, the link's expiry, the times each link was sent and opened, the one-time code (stored only as a one-way hash, never as the code itself) and a keyed one-way hash of the network address used to limit attempts.

2.4 Health data and its limits. The Clinic may enter health data, and Scality is instructed to process it, in the places named in section 2.3 of the Terms of Service. The Clinic shall not enter health data in the places that section names as not allowed, in any place on neither list, or in messages to Scality's support. Keeping the names in its catalogue neutral is the Clinic's duty. A service or treatment name may be used as a marketing interest label only if the person gave explicit consent, or the Clinic has assessed that the label reveals nothing about that person's health. The Clinic must not enter full payment card numbers or bank sign-in details. If data is entered where this section does not allow it, the Clinic removes it or asks Scality to, including from an issued document (section 2.6), and the parties check whether it is an incident under section 6.

2.5 Duration: from acceptance for as long as Scality processes Clinic data, including the end-of-service period in section 9. A later version accepted by the Clinic replaces this one.

2.6 Accounting records. Issued invoices, receipts and credit notes are the Clinic's accounting records. Scality does not edit or delete an issued document except on the Clinic's instruction, and keeps a record of any such change. If a person asks the Clinic to erase their data, or the Clinic erases a contact, the Clinic decides whether the law requires it to keep these documents and tells Scality what to do. After the service ends, section 9.1 applies.

2.7 Invoice links. Scality sends an invoice link only to the recipient email address on the invoice, after the Clinic's staff confirm that address. A link expires 7 days after it is sent. Scality deletes expired links, their codes and their viewing sessions 30 days after they expire, except a link that the client used to accept an instalment plan, which Scality keeps with that plan as part of the Clinic's accounting records (section 2.6); the record of when each link was sent and opened 12 months after the link was sent; and the counters used to limit attempts 48 hours after their time window ends. These periods end sooner if the service ends (section 9). Backups expire on the schedule in Annex 2.

2.8 Card payments. When the Clinic connects its own Stripe account, Scality sends Stripe only what each payment needs: the email address on the invoice, the invoice number, the amount, the currency and Scality's own reference numbers. Scality does not send the payer's name, address or phone number. Card details go directly from the payer to Stripe; Scality does not receive or store them. Stripe processes payments under its own agreement with the Clinic.

2.9 The hand-over of a released report. For the hand-over of a report that the Clinic releases into the patient portal, the Clinic and Scality are joint controllers. Annex 3 is their arrangement for that step only. All other processing in this section stays under the rest of this agreement.

3. Instructions

3.1 Scality processes the data only on the Clinic's documented instructions: this agreement, and the settings, automations and actions that authorized Clinic users configure in Neogenic within its scope. This includes instructions about transfers, unless EU or Member State law requires otherwise; Scality informs the Clinic of that requirement first where legally allowed.

3.2 Scality tells the Clinic immediately if it believes an instruction infringes data-protection law. Scality may hold the processing that the instruction asks for until the Clinic confirms, changes or withdraws it.

3.3 The Clinic is responsible for the lawful basis of its marketing, including consent or the existing-customer exemption for electronic marketing, its privacy notices to leads, and honouring objections and unsubscribes. The Clinic does not use health data to select the recipients of marketing, or in a marketing message, without the person's explicit consent. Neogenic's unsubscribe and suppression functions support this but do not replace the Clinic's decisions.

3.4 Neo (AI assistant): the Clinic's staff may use Neo to act on Clinic records within their own permissions, through a fixed set of reviewed actions. What Neo can and cannot read is set out in section 5.3 of the Terms of Service. Neo is an AI system; staff are told so in the product. Neo is not built to decide anything about a patient. Scality does not use Clinic data to train AI models and instructs its AI providers not to train on it or retain it beyond what the provider needs to deliver the service. Requests from Neo go only to the AI provider and regions on the subprocessor list.

3.5 The Clinic's grounds and assessment. The Clinic decides the legal ground for each purpose for which it processes health data, and carries out its own data protection impact assessment where the law requires one.

4. Confidentiality and security

4.1 Only people and service identities that need access for the service may access the data, and they process it only on the Clinic's instructions under section 3.1. They are bound by confidentiality. The AI assistants that Scality uses act under the direction of Scality's people. The AI assistants that Scality uses to build and run Neogenic hold no key that can read the content of Clinic records.

4.2 Scality applies security measures appropriate to the risk (Article 32), including: encryption in transit, role-based staff permissions within each clinic, separation between clinics, multi-factor authentication for administrative access, a record of who viewed each patient record, and primary storage in an EU-hosted database. Annex 2 lists the measures in force.

4.3 Scality does not access Clinic data for support without the Clinic's request or a security need. Access through the Neogenic admin console is recorded.

5. Subprocessors

5.1 The Clinic gives general written authorization for the subprocessors on the published subprocessor list.

5.2 Scality gives the Clinic at least 14 days' written notice to the Clinic's privacy contact before adding or replacing a subprocessor, so the Clinic can object. If an objection cannot be resolved, the Clinic may stop the affected processing or end the service.

5.3 Scality places on each subprocessor, by contract, the same data-protection obligations as this agreement, and remains fully liable to the Clinic for them. Health data goes only to a subprocessor whose terms allow it, as shown on the subprocessor list.

6. Assistance, requests and incidents

6.1 Scality helps the Clinic answer data-subject requests (access, correction, deletion, objection, unsubscribe) with the product's functions or, where needed, manually. Scality keeps a log of the requests it handles for the Clinic. The Clinic decides whether a request is granted, and any limit that the law lets it place on a patient's access to the medical record; Scality does not decide these. Scality forwards any request it receives directly to the Clinic. Help with switching to another provider is set out in section 10 of the Terms of Service.

6.2 Scality notifies the Clinic without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting the Clinic's data. It gives the information then available and updates it as more becomes known.

6.3 Scality assists the Clinic with its security, breach and impact-assessment duties (Articles 32 to 36), taking into account the nature of the processing and the information available to Scality.

7. Transfers

7.1 Primary storage is in the EU (see the subprocessor list). Requests from Neo are processed in EU regions. Where a subprocessor processes data outside the EEA, Scality relies on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or the Commission's standard contractual clauses, as shown for each subprocessor on the subprocessor list. Scality treats access by a subprocessor's support staff from outside the EEA as such processing.

8. Audit and records

8.1 Scality makes available the information needed to demonstrate compliance with this agreement and allows and contributes to reasonable audits by the Clinic or its mandated auditor, with reasonable notice and confidentiality.

9. End of processing

9.1 When the service ends, the Clinic chooses return or deletion. Scality provides an export of the Clinic's data, including invoices, receipts, credit notes, payment records (online card payments included), memberships and plans, in a usable format on request within 30 days, then deletes live copies. This does not apply to a copy that EU or Member State law requires Scality to keep; Scality then keeps only that copy, protects it and uses it for nothing else. Backup copies expire on the backup schedule in Annex 2 and are not restored into use.

9.2 If the Clinic accepts a later version, the data continues under that version.

9.3 Marketing objections after erasure. When a contact who has objected to marketing or unsubscribed is erased during the service, Scality keeps, on the Clinic's instruction, only the email address and the date of the objection, so that the Clinic does not market to that person again by mistake (GDPR Articles 17(3) and 21). This record is used for nothing else and is deleted with the rest of the Clinic's data under section 9.1.

9.4 After deleting the Clinic's data under section 9.1, Scality confirms the erasure in writing to the Clinic's privacy contact.

9.5 The record of views. Scality keeps the record of who viewed a patient record. It holds identifiers and times, not the content of any record. While the Clinic uses Neogenic, this record is the Clinic's, and the Clinic can obtain it on request. At the end of the service, it is part of the Clinic's export.

10. General

10.1 This agreement prevails over the service terms on data protection. It is governed by the laws of the Republic of Cyprus.

Accepted electronically by the Clinic's authorized person during onboarding (Annex 1 acceptance record).

Annex 1 — Parties and acceptance

Scality Ltd, company HE459172, Attikis 3, City Residences 1, 6045 Larnaca, Cyprus; VAT CY60062286C. Privacy contact: privacy@neogenic.ai. Security incidents: security@neogenic.ai.

The Clinic is identified by the details its authorized person enters during onboarding: legal entity name, registration number, registered address, privacy contact and security-incident contact. Neogenic records the accepting person, the time of acceptance and this version.

Annex 2 — Security measures

• Traffic between users and Neogenic, and between Neogenic and its providers over public networks, is encrypted in transit (TLS).
• Clinic data is stored in an EU-hosted database that is encrypted at rest.
• Every user signs in with their own account. Access within a clinic follows the roles and permissions the clinic sets, and each clinic's data is separated from every other clinic's in the database.
• Opening a patient record is recorded with the user and the time, and the Clinic can obtain that record on request.
• Access to production systems is limited to authorized Scality personnel and protected by multi-factor authentication.
• The AI assistants that Scality uses to build and run Neogenic hold no key that can read the content of Clinic records.
• Patient files are not sent to AI, text recognition or search, and reach the browser only through the Neogenic server, never through a shareable link. A file that a staff member attaches to a chat with Neo is the exception the Terms of Service forbid (section 5.3).
• No file is opened in an outside document viewer.
• Nobody can edit an issued invoice, receipt or credit note in the product. Neogenic keeps one master copy of each issued invoice document, plus the daily backups described below.
• Invoice links expire 7 days after they are sent, open only with a one-time code sent to the recipient's email address, limit how many attempts can be made, and record each time they are opened.
• Online card payments use Stripe's own payment page; card details never pass through Neogenic.
• The database is backed up daily. Backups are kept for 7 days and then expire.
• Requests from Neo, the AI assistant, go only to the AI provider on the subprocessor list, in EU regions. Under its terms that provider does not store the data and does not train on it.
• Application logs record identifiers, counts and timings, not the content of Clinic records or conversations.
• Security incidents are handled under a documented procedure, including notice to the Clinic under section 6.2.

Annex 3 — Joint control of reports released to the patient portal

A3.1 What this annex covers. When the Clinic releases a report to one of its patients, the report is handed over into the patient portal, where that patient can see it. The Clinic decides whether to release a report, which report, and to which patient. Scality decides how the patient portal receives the report. For this hand-over, and only for it, the Clinic and Scality are joint controllers under Article 26 GDPR. This annex is their arrangement. It forms part of this agreement and so of the Terms of Service.

A3.2 What is handed over, and why. The released report and the details that identify it and the patient, which may include health data, about the patient to whom the Clinic releases it. The only purpose of the hand-over is to make the report available to that patient in the patient portal.

A3.3 Legal ground. Each party is responsible for having a legal ground for its own part of the hand-over: the Clinic for releasing the report, and Scality for receiving it into the patient portal.

A3.4 Informing patients. The Clinic tells its patients, in its own privacy information, that it may release reports to them through the patient portal. Scality tells patients, in the patient portal's privacy notice, how the portal receives and shows a released report. Scality also makes the essence of this annex available to patients there, including the contact point in A3.5 and the patient's right to use their rights against either party.

A3.5 Contact point. The contact point for patients about the hand-over is Scality, at privacy@neogenic.ai.

A3.6 Patients' requests. A patient may use their rights under the GDPR against the Clinic, against Scality, or both. Between the parties, the Clinic answers requests about the content of a report and about its decision to release it, including a request to correct a report and any limit that the law lets it place on the patient's access. Scality answers requests about how the patient portal received and shows a report. A party that receives a request that is for the other passes it on without undue delay, and each helps the other to answer.

A3.7 Security. Scality keeps the hand-over secure: the connection from the Clinic's records to the patient portal, and the patient portal itself, with measures appropriate to the risk (Article 32). The Clinic makes sure that it releases the right report to the right patient.

A3.8 Breaches. A party that becomes aware of a personal-data breach in the hand-over tells the other party without undue delay and gives it the information then available. Scality makes the notices that the law requires to the supervisory authority and to the patients concerned for a breach in the connection or in the patient portal. The Clinic makes them for a breach caused by a report released to the wrong patient. The parties work together on each notice.

A3.9 No other use. Neither party uses the hand-over for any purpose other than making the released report available to the patient.

A3.10 Before and after the hand-over. Each party alone is responsible for its processing before and after the hand-over. Before it, the Clinic's records and its decision to release are the Clinic's, and Scality processes them as the Clinic's processor under the rest of this agreement. After it, the patient's portal account, and what the portal does with the report for the patient, are Scality's as controller, under the patient portal's privacy notice.

Other earlier versions: Version 9 (22 October 2026), Version 8 (16 October 2026), Version 5 (9 October 2026), Version 4 (1 October 2026), Version 3 (30 September 2026), Version 2 (30 September 2026), Version 1 (24 September 2026)