Data Processing Addendum (DPA)

Last updated: 23 May 2026 · Version 1.0-draft

This Data Processing Addendum ("DPA") forms part of the Terms of Service between [SELLER LEGAL ENTITY] ("Processor", "we") and the customer organization ("Controller", "you") and applies whenever the Processor processes Personal Data on behalf of the Controller through the Aegis EMR Service.

This DPA is designed to comply with: Egyptian Personal Data Protection Law No. 151 of 2020 ("PDPL"), the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") where applicable, and UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection ("UAE PDPL").

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including patient health data, processed under this DPA.
• "Controller" means the customer (healthcare provider organization or solo practitioner) that determines the purposes and means of processing Personal Data.
• "Processor" means Aegis EMR, which processes Personal Data on behalf of the Controller.
• "Sub-processor" means any third party engaged by the Processor to process Personal Data (e.g., cloud infrastructure, AI inference providers).
• "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

2. Subject Matter and Duration

The Processor will process Personal Data only for the purpose of providing the Service and as documented in the Terms of Service, throughout the term of the customer's subscription and for the limited retention period thereafter as described in Section 9.

3. Nature and Purpose of Processing

Processing activities include: storage of clinical records, generation of clinical summaries (with explicit consent), drug interaction checks, AI-assisted differential diagnosis (reference only, with explicit consent), audit logging, billing operations, and customer support.

4. Categories of Data Subjects and Personal Data

5. Obligations of the Processor

• Process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law.
• Ensure that personnel authorized to process Personal Data have committed themselves to confidentiality.
• Implement appropriate technical and organizational measures as described in Annex A.
• Engage Sub-processors only with the Controller's prior general authorization and subject to equivalent contractual protections (Section 6).
• Assist the Controller in responding to data subject requests (Section 7).
• Notify the Controller without undue delay after becoming aware of a Personal Data Breach (Section 8).
• Delete or return all Personal Data at the end of the provision of services, subject to Section 9.
• Make available all information necessary to demonstrate compliance and allow audits.

6. Sub-processors

The Controller authorizes the Processor to engage Sub-processors for the provision of the Service. A current list of Sub-processors is maintained at /subprocessors (URL placeholder — to be published).

The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors at least 30 days in advance. The Controller may object on reasonable grounds, in which case the parties will work in good faith to resolve the objection or the Controller may terminate the affected Service.

Current Sub-processor categories include:

7. Data Subject Rights

The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as possible, for the fulfillment of the Controller's obligation to respond to requests from data subjects exercising their rights under PDPL Articles 12-14, GDPR Articles 15-22, or equivalent applicable laws (access, rectification, erasure, restriction, portability, objection).

8. Personal Data Breach Notification

The Processor will notify the Controller without undue delay and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Controller Personal Data. The notification will include, at minimum:

• Nature of the breach and categories/approximate number of data subjects and records affected.
• Name and contact details of the Data Protection Officer.
• Likely consequences of the breach.
• Measures taken or proposed to address the breach and mitigate its effects.

9. Retention and Deletion

Upon termination of the Service or at the Controller's written request, the Processor will, at the Controller's choice, delete or return all Personal Data within 30 days, except where applicable law (e.g., Egyptian commercial record-keeping obligations under Law 17/1999, tax records under Law 67/2016) requires retention, in which case the data will be securely archived for the minimum period required.

10. International Data Transfers

Where Personal Data is transferred outside Egypt (or outside the UAE for Emirati customers), the Processor will ensure such transfers are conducted under one of the safeguards permitted by Article 14 of the PDPL: adequacy decisions, binding corporate rules, standard contractual clauses, explicit consent of the data subject, or other mechanisms approved by the relevant data protection authority.

11. Governing Law and Jurisdiction

This DPA shall be governed by the laws of [Arab Republic of Egypt / UAE — depending on seller entity]. Any dispute arising under or in connection with this DPA shall be subject to the exclusive jurisdiction of the competent courts, unless the parties agree to arbitration under the rules of CRCICA (Cairo) or DIAC (Dubai) respectively.

12. Contact

Data Protection Officer: dpo@electronicmedicalrecord.cloud
Legal: legal@electronicmedicalrecord.cloud