3. The Services

6. Indemnity

8.1 The Company and the Healthcare Provider acknowledge that for the purposes of the Data Protection Act 1988, 2003, 2018 and GDPR, the Company is the Data Processor and the Healthcare Provider is the Data Controller in respect of Patient(s) Data

8.2 The Healthcare Provider will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Patient’s Personal Data via Wellola for the duration and purposes of the Services.

8.3 The Company shall, in relation to any Patient(s) Data processed in connection with the performance by the Company of the Services:

8.3.1 process Patient(s) Data only on the written instructions of the Healthcare Provider unless required by the laws of any member of the European Union or by the laws of the European Union applicable to the Company to process Personal Data (“Applicable Laws”);

8.3.2 ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Patient(s) Data and against accidental loss or destruction of, or damage to, Patient(s) Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures;

8.3.3 ensure that all the Company’s staff who have access to and/or process Patient(s) Data are obliged to keep the Patient(s) Data confidential;

8.3.4 ensure that where a Sub-Processor is used, the Company shall:

a) only engage a Sub-Processor with the prior consent of the Healthcare Provider;

b) inform the Healthcare Provider of any intended changes concerning the addition or replacement of Sub-Processors;

c) implement a written contract containing the same data protection obligations as set out in this agreement, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the Applicable Laws;

d) understand that where any Sub-Processor is used on their behalf, that any failure on the part of the Sub-Processor to comply with the Applicable Laws or the relevant data processing agreement, the Company, as the initial Data Processor, remains fully liable to the Healthcare Provider for the performance of the Sub- Processor’s obligations;

8.3.5 not transfer any Patient Data outside of the European Economic Area unless:

a) the European Commission has issued a decision confirming that the country to which we transfer the Personal Data ensures an adequate level of protection for the data subjects' rights and freedoms;

b) appropriate safeguards are in place such as binding corporate rules (BCR), standard contractual clauses approved by the European Commission, an approved code of conduct or a certification mechanism;

c) the Patient has provided explicit consent to the proposed transfer after being informed of any potential risks; or

d) the Patient Data is being transferred to a company in the US which has self- certified its compliance with the EU-US Privacy Shield which has been found by the European Commission to provide an adequate level of protection to the Personal Data of EU citizens;

8.3.6 assist the Healthcare Provider, at the Healthcare Provider’s cost, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the data protection laws with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

8.3.7 notify the Healthcare Provider without undue delay on becoming aware of a Personal Data breach;

8.3.8 within 48 hours of the date of termination or cancellation of your Contract delete Patient’s Data and copies thereof unless required by Applicable Laws to store the Personal Data; and

8.3.9 maintain complete and accurate records and information to demonstrate its compliance with these obligations and make such records and information available to the Healthcare Provider and allow for and contribute to audits, including inspections, conducted by the Healthcare Provider or another auditor mandated by the Healthcare Provider.

8.4 Each party warrants to the other that it will process the Personal Data in compliance with all Applicable Laws, enactments, regulations, orders, standards and other similar instruments.

8.5 The Company is not liable in respect of any Patient(s) Data which is controlled by the Healthcare Provider in breach of data protection laws or outside the scope of the permissions granted to the Healthcare Provider by the Patient.

10. Variation

12.1. If any provision of the Agreement (or part of any provision) is found by a Court or other authority or composite Jurisdiction to be invalid, illegal or un-enforceable that provision or part-provision shall, to the extent required, be deemed not to form part of the Agreement, and the validity and enforceability of the other provisions of the Agreement shall not be affected.

12.2. A provision of the Agreement or part of any provision if found illegal or unenforceable that provision shall apply with the minimum modifications necessary to make it legal, valid and enforceable.

13.1. The Agreement constitutes the whole Agreement between the parties and supersedes all previous Agreements between the parties relating to its subject matter.

13.2. Each party acknowledges that, in entering into the Agreement, it is not relied on and shall have no right or remedy in respect of, any statement, representation, assurance or warranty (whether made negligently or innocently).

13.3. Nothing in this clause shall limit or exclude any liability to fraud.