Data Processing Addendum

1.1For Patient Data and other Customer Data processed through the Service, the Clinic is the Controller and CureYou is the Processor.

1.2The Clinic is responsible for the lawfulness of its instructions and for having a valid legal basis (including any patient consent) for the processing.

2.1We process Personal Data only (a) to provide and support the Service under the Agreement, (b) on the Controller's documented instructions, and (c) as required by law (in which case we will notify the Controller unless legally prohibited).

2.2We will inform the Controller if, in our opinion, an instruction infringes the Oman PDPL or other applicable law.

2.3We will not sell Personal Data, use it for our own purposes, or use Patient Data to train third-party AI models.

2.4No marketplace repurposing by default. Any use of Personal Data for the CureYou Marketplace is a separate, optional purpose governed by the Marketplace Data-Sharing Addendum. Absent the Controller's express opt-in there (and, for patient data, the patient's own consent), we will not share or repurpose Personal Data for the Marketplace. The Controller's possession of a record does not by itself authorise such repurposing.

We ensure that personnel authorised to process Personal Data are bound by confidentiality and access it only on a need-to-know basis.

4.1We implement appropriate technical and organisational measures to protect Personal Data, having regard to the state of the art and the risk — in particular for health data (a special category). These measures are described in Annex 2 and include encryption in transit, database-per-tenant isolation, role-based access control, hashed credentials, audit logging, and regular backups.

4.2The Controller is responsible for configuring user roles and permissions and for the security of its own devices and credentials.

5.1The Controller authorises us to engage the sub-processors listed in Annex 3 to process Personal Data.

5.2We impose data-protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.

5.3We will give the Controller 14 days' notice of any new or replacement sub-processor (by updating Annex 3 and notifying clinic administrators). The Controller may object on reasonable data-protection grounds; if we cannot resolve the objection, the Controller may terminate the affected Service.

6.1We host Personal Data on infrastructure located in the Sultanate of Oman (data residency).

6.2We will not transfer Personal Data outside Oman except where (a) necessary to provide the Service via an Annex 3 sub-processor, and (b) the transfer complies with the Oman PDPL, including any required safeguards, approvals, or consents. We will inform the Controller of any such transfer.

7.1Taking into account the nature of the processing, we will provide reasonable assistance to the Controller in responding to data-subject (patient) requests to access, correct, delete, or object; carrying out data-protection impact assessments and consultations; and meeting its security and breach-notification obligations.

7.2Where a patient contacts us directly, we will, unless legally required to act, refer them to the relevant Clinic.

8.1We will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's Personal Data, with the information reasonably available to us.

8.2We will take reasonable steps to contain and remediate the breach and assist the Controller in meeting its notification duties to the competent Omani authority and affected patients.

On termination or expiry of the Agreement, or on the Controller's written request, we will (at the Controller's choice) return or delete the Personal Data, except to the extent retention is required by law. We will provide a reasonable export window before deletion.

We will make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits by the Controller (or an independent auditor) no more than once per year on reasonable notice, subject to confidentiality and not unreasonably disrupting our operations. We may satisfy this through up-to-date certifications or summary reports where available.

Liability under this DPA is subject to the limitations and exclusions in the Agreement.