Data Processing Agreement

1. Parties and incorporation

This Data Processing Agreement ("DPA") forms part of the applicable Master Service Agreement, Order Form, or other written agreement ("Agreement") between the Customer identified in the applicable Order Form and Dial In Doctor LLP ("Dial In Doctor").

2. Roles

For processing described in Schedule 1:

• Customer is the "Controller"/principal determining the purposes and essential means of processing to the extent stated in the Agreement.
• Dial In Doctor is the "Processor"/service provider acting on documented Customer instructions.

Where either party independently determines purposes required by law, professional obligations, patient safety, fraud prevention, payment reconciliation, or its own contracting relationship with the individual, that party may act as an independent controller for that limited processing.

3. Documented instructions

Dial In Doctor will process Customer Personal Data:

• to provide the contracted services;
• according to the Agreement, Order Form, this DPA, and lawful written instructions;
• as otherwise required by applicable law.

If an instruction appears unlawful or materially unsafe, Dial In Doctor may suspend the affected processing while the parties resolve the issue.

4. Confidentiality

Dial In Doctor will ensure persons authorized to process Customer Personal Data:

• are subject to confidentiality obligations;
• receive access only as needed for their role;
• receive appropriate security/privacy guidance.

5. Security measures

Dial In Doctor will maintain reasonable technical and organizational safeguards appropriate to the nature of the data, including as applicable:

• role-based authorization;
• patient/provider scoping;
• authentication/session controls;
• hashed credentials;
• encrypted network transport;
• secrets management;
• logging/audit controls;
• vulnerability/patch management;
• backup/recovery controls;
• incident response;
• provider webhook verification for payment state;
• least-privilege access.

A current security schedule may be attached to an Order Form.

6. Sensitive and health data

Customer acknowledges that the Services may process health/clinical information.

Both parties will:

• restrict access to need-to-know use;
• avoid using health data for unrelated marketing;
• maintain appropriate confidentiality;
• ensure appropriate authority/consent for collection/disclosure where required.

7. Subprocessors

Customer authorizes Dial In Doctor to use subprocessors necessary to provide the Services, subject to:

• appropriate written data-protection/security obligations;
• access limited to the service provided;
• Dial In Doctor remaining responsible for its contractual processor obligations.

Production subprocessor categories may include:

• cloud hosting/infrastructure;
• payment processing;
• email/communications;
• monitoring/security;
• document generation/storage;
• approved healthcare-service partners where acting as a processor.

Named subprocessors should be maintained in an up-to-date schedule before enterprise signature.

8. International processing

Where a subprocessor or infrastructure provider processes Customer Personal Data outside Pakistan or another agreed location, Dial In Doctor will implement contractual and security measures reasonably appropriate to applicable law and the sensitivity of the data.

Any customer-specific data residency commitment must be stated in the Order Form.

9. Assistance with individual requests

Taking into account the nature of processing, Dial In Doctor will provide reasonable assistance where Customer receives a valid request relating to:

• access;
• correction;
• deletion;
• restriction/objection;
• information about processing;

to the extent the request applies to data processed on Customer's behalf and is legally available.

Dial In Doctor may refer a requester to Customer where Customer controls the response.

10. Data accuracy

Customer is responsible for the accuracy and lawful collection of data it supplies.

Dial In Doctor is responsible for not intentionally altering Customer data outside authorized processing and for providing correction mechanisms appropriate to the Service.

Clinical records may require amendment/versioning rather than destructive deletion.

11. Security incidents

A "Security Incident" means confirmed unauthorized access to, acquisition of, disclosure of, or material loss/destruction of Customer Personal Data within Dial In Doctor's responsibility.

Dial In Doctor will:

1. investigate and contain;
2. notify Customer without undue delay after confirmation where the incident materially affects Customer Personal Data;
3. provide information reasonably available about nature, scope, likely consequences and mitigation;
4. cooperate with Customer's lawful notification obligations;
5. avoid making admissions on Customer's behalf.

Notification is not an admission of fault or liability.

12. Audits and compliance information

On reasonable written request, Dial In Doctor will provide information reasonably necessary to demonstrate compliance with this DPA.

Any audit:

• must protect other customers and confidential systems;
• must be proportionate;
• should first use existing reports/evidence;
• must not require disclosure of secrets, exploit details, or other-customer data;
• is subject to reasonable frequency and confidentiality controls.

13. Return and deletion

At termination, and subject to legal/professional retention obligations and backup cycles, Dial In Doctor will:

• return or make available agreed Customer data where required;
• delete or render inaccessible data no longer required for lawful purposes.

Data required for legal, tax, clinical, fraud, security, or dispute purposes may be retained with access restricted to that purpose.

14. Business continuity

Dial In Doctor will maintain reasonable backup/recovery processes appropriate to the service tier.

Customer remains responsible for any export/backup obligation expressly assigned to Customer in the Order Form.

15. Liability

Liability under this DPA is governed by the Agreement and the Data Liability & Security Allocation Addendum. Unless an Order Form states a different negotiated cap, the MSA's default 12-month-fees liability structure applies, except where applicable law does not permit limitation.

Neither party may use this DPA to exclude responsibility for fraud, willful misconduct, or other non-excludable liability.

Schedule 1 — Processing details

Subject matter

Provision of telehealth platform, patient portal, healthcare operations, document, payment, and related contracted services.

Duration

For the term of the Agreement plus lawful retention/deletion period.

Nature of processing

Collection, recording, organization, storage, retrieval, consultation, transmission, access control, document generation, payment metadata processing, support, security monitoring, backup, deletion/return.

Purposes

As stated in the applicable Order Form/MSA and authorized service configuration.

Data subjects

May include:

• patients;
• parents/guardians;
• healthcare professionals;
• Customer staff/users;
• partner contacts.

Personal data

May include:

• identifiers;
• contact details;
• account identifiers;
• appointment data;
• clinical/health information;
• prescriptions/labs/certificates;
• payment metadata and receipts;
• support communications;
• technical/security logs.

Sensitive data

Health/clinical information and other sensitive data supplied for lawful healthcare operations.

Frequency

Continuous or event-driven during service use.

Schedule 2 — Minimum security commitments

• least privilege;
• authentication controls;
• secure credential storage;
• encryption in transit;
• access logging where appropriate;
• secrets outside source code;
• vulnerability and patch management;
• server-side patient/tenant authorization;
• incident handling;
• tested backup/recovery;
• payment-signature verification where applicable;
• staff confidentiality.

Schedule 3 — Subprocessors

Dial In Doctor will maintain the production subprocessor schedule from the actual deployed environment. The following categories are currently anticipated by the product architecture and must be verified against production configuration before an enterprise Order Form is signed:

Dial In Doctor will not treat this table as permission to send data to a provider that is not actually configured, contracted, and necessary for the Services.