Data Processing Terms

These Data Processing Terms ("DPT") are entered into between the customer organisation named in the signature record (the "Customer") and GetClinic Inc., a Delaware corporation, 74 E Glenwood Ave, Unit STE 5895, Smyrna, DE 19977, United States ("GetClinic"). They form part of the Tulparus Terms of Service or the Cloud Services Agreement (the "Agreement"). Capitalised terms used but not defined in this DPT have the meanings given in the Agreement.

1. Definitions

1.1 "Data Protection Law" means every law on the processing of personal data that applies to a party's processing under the Agreement, including Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), and US state privacy laws. For protected health information under HIPAA, the Business Associate Agreement applies in addition.

1.2 "Customer Personal Data" means personal data in Customer Data that GetClinic processes on behalf of the Customer.

1.3 "Sub-processor" means a third party that GetClinic engages to process Customer Personal Data.

1.4 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

1.5 Other terms, such as "controller", "processor", "data subject", "processing" and "supervisory authority", have the meanings given in the GDPR, and the corresponding meanings under other Data Protection Law ("veri sorumlusu" and "veri işleyen" under the KVKK).

1.6 "Data Location" means the location chosen for the Customer's Organisation in organisation setup or in the Order Form, and shown in the Service. GetClinic stores and processes Customer Personal Data in the Data Location, subject to access by GetClinic personnel under section 7, and does not copy it to another location without the Customer's instruction. The kinds of Data Location are described in Annex I. A change of Data Location is a migration that the parties agree in a written order.

2. Roles and scope

2.1 The Customer is the controller of Customer Personal Data, or a processor acting for its own client (for example a laboratory working for a hospital). GetClinic is the Customer's processor, or sub-processor where the Customer is itself a processor.

2.2 GetClinic is a controller only of the account, security, billing and usage data described in its Privacy Notice. This DPT does not apply to that data.

2.3 Annex I describes the processing: its subject matter, duration, nature, purpose, the data subjects, the categories of data and the Data Location.

2.4 Private and air-gapped installations. Where the Data Location is a private installation or an air-gapped installation, the Customer hosts and operates the Service on its own infrastructure under the Private Licence. GetClinic does not host Customer Personal Data and is not the Customer's processor for it, except when GetClinic personnel work on the installation in a session the Customer starts, such as a remote support session or an assisted installation. This DPT applies to those sessions only. During a session, GetClinic personnel act only as the Customer directs and do not copy Customer Personal Data out of the installation unless the Customer instructs it. The Customer is responsible for the security of the installation, and sections 7.2, 7.3 and 9 and Annex III do not apply to it.

3. Instructions

3.1 GetClinic processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers of personal data to a third country, unless the law requires otherwise, in which case GetClinic will inform the Customer before processing unless the law forbids it.

3.2 The Agreement, this DPT, and the Customer's use and configuration of the Service are the Customer's complete instructions. Only the Customer can enable the features that change what is processed or who receives it, namely case matching with other organisations, research and model training, assist mode, integrations, exports and API access.

3.3 GetClinic will inform the Customer immediately if it believes an instruction breaks Data Protection Law, and may then suspend that processing.

4. The Customer's obligations

4.1 The Customer is responsible for the lawfulness of the processing it instructs. It warrants that:

(a) it has a lawful basis for every patient and relative whose data it enters, and where the law requires it, the explicit consent of the patient or the patient's representative, in particular for genetic testing, secondary findings, recording relatives in a pedigree, matching with other centres, recontact and research;

(b) the consents it records in the Service reflect the actual consents, and it updates them when a consent is withdrawn;

(c) it informs patients and relatives about the processing as Data Protection Law requires; and

(d) it enters identifiers only in the fields of the Service meant for them.

4.2 The Customer will not enter Patient Data until it has signed this DPT (and, where it applies, the Business Associate Agreement). The Service blocks Patient Data until then.

5. Confidentiality of personnel

GetClinic will ensure that every person it authorises to process Customer Personal Data is bound by confidentiality. For Customers subject to section 203 of the German Criminal Code, GetClinic will sign the secrecy undertaking provided in organisation setup and bind its personnel accordingly.

6. Security

6.1 GetClinic implements the technical and organisational measures in Annex II. It may change them, but will not reduce the overall level of protection during the term of the Agreement.

6.2 The Customer is responsible for the security of its own Users, devices, integrations and API keys, and for using the security settings the Service offers.

7. GetClinic personnel and access to Customer Personal Data

7.1 No routine access. GetClinic personnel do not access Customer Personal Data in normal operation. They see platform metadata, such as organisation names, counts and states.

7.2 Assist mode. GetClinic support may request temporary read-only access to configuration sections of the Customer's organisation, stating a reason. Access starts only if an administrator of the Customer approves it, covers only the approved sections, ends at the approved time, and is logged and shown to the Customer's administrators. A request that is not approved lapses after 24 hours. GetClinic does not sign in as a User.

7.3 Emergency access (break-glass). Where access to Customer Personal Data is needed to resolve an incident, it:

(a) requires approval by a second operator where GetClinic has more than one operator; while GetClinic has a single operator, it is opened only for a declared critical incident (an incident that meets the P1 criteria of GetClinic's breach response plan), and the operator completes a written review within 24 hours and sends it to the Customer's administrators;

(b) is read-only, limited to an approved list of views, and ends after at most 4 hours;

(c) is notified to the Customer's administrators when it opens and when it closes; and

(d) is recorded in an audit record kept in write-once storage that cannot be changed or deleted for 400 days.

Findings and relatives withheld for lack of consent stay hidden during such access.

7.4 Location. GetClinic personnel who operate the Service work from Türkiye, except that a sovereign Data Location is operated by personnel located in its region. Where their access is a transfer, section 12 covers it. For a sovereign Data Location, and where the Order Form includes the in-region operators option (Enterprise plans), access under section 7.3 is given only to operators located in the region of the Data Location. For a Data Location in Türkiye, all access to Customer Data, including access under section 7.3 and in support sessions, is limited to GetClinic personnel located in Türkiye (section 12.1(d)).

8. AI Features

8.1 Language models used by the Service's AI Features run inside GetClinic's environment in the Data Location, on the infrastructure in Annex III. GetClinic does not send Customer Personal Data to any third-party AI provider.

8.2 GetClinic does not use Customer Personal Data to train or improve models unless the Customer enables research and training and accepts the Research and Training Addendum, and then only as that addendum allows.

8.3 Text in uploaded or retrieved documents is treated as data and not as instructions to the Service.

9. Sub-processors

9.1 The Customer gives general authorisation for GetClinic to engage Sub-processors. The list published at https://tulparus.ai/subprocessors/ is the authoritative list of Sub-processors, including the infrastructure provider of each Data Location, and Annex III shows its entries at the date of signature. Changes to the list follow section 9.2. Only the Sub-processors of the Customer's Data Location process its Customer Personal Data.

9.2 GetClinic will notify the Customer's administrators, in the Service and by email, at least 30 days before a new Sub-processor starts processing Customer Personal Data. Where a Sub-processor must be replaced urgently to keep the Service secure or running, GetClinic will notify the Customer as soon as possible, and the 30-day period runs from that notice.

9.3 The Customer may object on reasonable data protection grounds within those 30 days. The parties will then discuss the objection in good faith. If it is not resolved within 30 days after the objection, the Customer may terminate the affected subscription and receive a refund of prepaid fees for the remaining period.

9.4 GetClinic imposes on each Sub-processor data protection obligations no less protective than this DPT, and remains responsible to the Customer for its Sub-processors.

9.5 Where the Data Location is in Türkiye, on a sovereign national cloud, or in a custom region with a provider other than Amazon Web Services, the infrastructure provider is named on the sub-processor list, and in the Order Form where there is one, with notice under section 9.2, before that location receives Customer Personal Data. A Data Location whose infrastructure provider is not on that list cannot be chosen and receives no Customer Personal Data.

10. Assistance

10.1 Data subject requests. If GetClinic receives a request from a data subject about Customer Personal Data, GetClinic will forward the request to the Customer and will not respond to it. The Service provides the tools the Customer needs to answer requests: case export, correction, consent withdrawal, and erasure of a patient's data.

10.2 Impact assessments. GetClinic will provide the information the Customer reasonably needs for a data protection impact assessment and for prior consultation with a supervisory authority.

11. Personal Data Breach

11.1 GetClinic will notify the Customer of a Personal Data Breach without undue delay and in any case within 48 hours after becoming aware of it.

11.2 The notice describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact person. Information not yet known is provided as it becomes available.

11.3 The notice is sent by email to the Customer's administrators and to any security contact the Customer has named. An incident notice in the Service does not replace it.

11.4 GetClinic will cooperate with the Customer's investigation and will not notify supervisory authorities or data subjects on the Customer's behalf unless the Customer asks or the law requires it. Notifying a breach is not an admission of fault.

12. International transfers

12.1 Locations. GetClinic processes Customer Personal Data in the Data Location (Annex I and Annex III). GetClinic Inc. is a US company and its operating personnel work from Türkiye, so access under section 7 can be a transfer even where the Data Location is in the Customer's own country. For each Data Location:

(a) United States. Customer Personal Data is stored in the United States. Transfers to the United States from the European Economic Area, the United Kingdom, Switzerland or Türkiye, and access from Türkiye, are covered by sections 12.2 to 12.5.

(b) European Union. Customer Personal Data is stored in the European Union (Frankfurt, Germany, for the shared and dedicated locations). Access by GetClinic Inc. and by its personnel in Türkiye is a transfer from the European Economic Area, covered by section 12.2, or, for a Customer in Switzerland, from Switzerland, covered by section 12.4. For a Customer in the United Kingdom, storage in the European Union relies on the UK adequacy regulations, and access under section 7 is covered by section 12.3. For a Customer established in Türkiye, storage in the European Union is a transfer abroad covered by section 12.5.

(c) United Kingdom. Customer Personal Data is stored in London, United Kingdom. Access by GetClinic Inc. and by its personnel in Türkiye is a restricted transfer, covered by section 12.3.

(d) Türkiye. Customer Personal Data is stored on infrastructure in Türkiye, with an infrastructure provider in Türkiye. Access to it, including emergency access under section 7.3 and support sessions, is limited to GetClinic personnel located in Türkiye, and the data, the infrastructure provider and that access stay in Türkiye. This DPT does not decide whether the role of a processor incorporated outside Türkiye is itself a transfer under Article 9 of the KVKK. If GetClinic ever allows access from outside Türkiye, including access by or for GetClinic Inc. from the United States, it will first conclude the standard contract under section 12.5 with the Customer, signed in wet ink or with a qualified electronic signature, and will notify the change under section 9.2. For a Customer outside Türkiye, storage in Türkiye is a transfer from the Customer's country, covered by sections 12.2 to 12.4 as applicable.

(e) Dedicated, custom region and sovereign national cloud. Where the location is in the United States, the European Economic Area, the United Kingdom or Türkiye, the position in (a) to (d) for that country or area applies. For a location in any other country, the Order Form states the transfer mechanism, and sections 12.2 to 12.5 apply to transfers from the European Economic Area, the United Kingdom, Switzerland and Türkiye.

(f) Private and air-gapped installations. Customer Personal Data stays on the Customer's infrastructure. Sections 12.2 to 12.5 apply only to access in a session under section 2.4 from outside the country of the installation.

12.2 EEA. For transfers from the European Economic Area, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference: Module Two where the Customer is a controller, Module Three where it is a processor. For the purposes of those clauses:

(a) Clause 7 applies;

(b) in Clause 9, Option 2 (general written authorisation) applies, with a notice period of 30 days;

(c) the option in Clause 11 does not apply;

(d) for Clauses 17 and 18, the law and courts of Ireland apply;

(e) in Clause 13 and Annex I.C, the competent supervisory authority is that of the Member State where the Customer is established or, where the Customer is not established in the EEA, that of the Member State where GetClinic's representative under Article 27(1) of the GDPR is established; and

(f) Annexes I to III of this DPT form Annexes I to III of the clauses.

12.3 United Kingdom. For transfers from the United Kingdom, the International Data Transfer Addendum to the EU standard contractual clauses issued by the Information Commissioner (version B1.0) applies and is incorporated by reference. Table 1 is completed with the parties' details in the signature record, and Tables 2 and 3 with the information in section 12.2 and the Annexes. For Table 4, either party may end the Addendum.

12.4 Switzerland. For transfers from Switzerland, section 12.2 applies with the Federal Data Protection and Information Commissioner as the competent authority, and with Swiss law applying where the Swiss Federal Act on Data Protection so requires. The term "member state" in the clauses does not exclude data subjects in Switzerland from suing in their place of habitual residence (Clause 18(c)).

12.5 Türkiye. For transfers from Türkiye under Article 9 of the KVKK, the parties sign, without changes, the standard contract published by the Personal Data Protection Authority, in Turkish, with wet-ink signatures or qualified electronic signatures under Law No. 5070, each with its date. GetClinic provides the contract countersigned. Where the Data Location is outside Türkiye, Patient Data of a Customer established in Türkiye is not accepted until both signatures are in place. Where the Data Location is in Türkiye, the contract is signed before any access from outside Türkiye is allowed under section 12.1(d). The Customer, as exporter, will notify the Authority within 5 business days after the last signature, physically, by registered electronic mail (KEP) or through the Authority's notification module.

12.6 Invalidation. If a court or authority invalidates a transfer mechanism, the parties will work in good faith to put another in place, and the Customer may suspend the affected transfer in the meantime.

12.7 Requests from public authorities. If GetClinic receives a request from a public authority for Customer Personal Data, it will tell the Customer unless the law forbids it, challenge requests it considers unlawful, and disclose only the minimum required.

13. Audits

13.1 GetClinic will make available the information needed to demonstrate compliance with this DPT: its security documentation, answers to reasonable security questionnaires, and the records of operator access to the Customer's organisation.

13.2 If that information is not enough, a supervisory authority requires it, or there are indications of non-compliance, the Customer may audit GetClinic once a year, on 30 days' written notice, during business hours, at its own cost, either itself or through an independent auditor bound by confidentiality. The audit does not extend to other customers' data or to security information whose disclosure would put the Service at risk. Where the Agreement gives broader audit rights, they also apply.

14. Return and deletion

14.1 During the term. The Customer sets its retention period for closed cases (10 years by default, adjustable from 1 to 50 years). The Service flags cases whose period has ended; nothing is deleted automatically. GetClinic erases a case or a patient's data only when the Customer requests it and a second authorised person of the Customer approves it. A legal hold suspends erasure.

14.2 At the end. When the Agreement ends or the Organisation is closed, the Customer can export Customer Personal Data in the formats the Service offers during the export period under the Agreement. After that period ends, GetClinic will erase it from its active systems, and database backups containing it expire within 7 days after erasure.

14.3 What remains. GetClinic keeps records that an erased item existed, with internal record identifiers only (no patient identifiers or content), and audit records, as far as needed to prove what was done, unless the law requires otherwise. Where the law requires GetClinic to keep data, it keeps it protected and uses it only for that purpose.

14.4 Certificate. GetClinic will issue a deletion certificate on request, naming what was erased and when.

15. Liability and order of precedence

15.1 Each party's liability under this DPT is subject to the limitations of the Agreement, except where Data Protection Law does not allow them.

15.2 If this DPT conflicts with the Agreement, this DPT prevails for Customer Personal Data. If the standard contractual clauses or a transfer contract under section 12 conflict with this DPT, they prevail.

16. Term

This DPT applies from signature until GetClinic no longer holds Customer Personal Data.

Annex I: Description of the processing

Parties. Data exporter: the Customer, as recorded at signature, as controller (or processor). Data importer: GetClinic Inc., as processor (or sub-processor). Contact: [email protected].

Competent supervisory authority. As set out in section 12.2(e).

Subject matter. Providing the Tulparus investigation and decision-support service for genetic cases that remain unresolved after initial testing.

Duration. The term of the Agreement plus the export period under the Agreement, and the time needed for erasure under section 14.

Nature and purpose. Storing, validating, quality-checking, annotating and analysing genetic and clinical data; ranking candidate genes, variants and diseases; retrieving evidence from scientific knowledge sources; producing hypotheses, next steps and reports for review by the Customer's professionals; and, where the Customer enables them, case matching, reanalysis and integrations.

Frequency. Continuous.

Data subjects. Patients (probands), their relatives recorded in pedigrees, fetuses where the Customer records them, and the Customer's staff named in case records.

Categories of personal data.

• Identity data the Customer enters: names, dates of birth, sex, record and sample numbers.
• Clinical data: phenotype terms with their state (present, absent, unknown, not tested, not provided), onset and modifiers, clinical history, referral letters, notes, prior tests and their results.
• Genetic data: sequencing and variant files (such as VCF, gVCF, BAM, CRAM and FASTQ), copy number and structural variants, repeat expansions, mitochondrial variants, relatedness and ancestry estimates, and secondary findings.
• Family data: pedigrees and relationships.
• Consent records by scope (diagnostic, secondary findings, hereditary cancer analysis, research, matching, recontact, pedigree membership).
• Results: candidates, evidence, hypotheses, tasks, comments and reports.

Special categories. Health data and genetic data (Article 9 of the GDPR; Article 6 of the KVKK). Annex II applies to them in full.

Retention. As set out in section 14.

Data Location. The Data Location is recorded in the signature record and shown in the Service. GetClinic offers the following kinds of Data Location. Not every kind is offered in every country, for every sector or under every plan; the Service shows the locations offered to the Customer in organisation setup.

• Shared location: a location in which the Organisations of several customers run, separated as described in Annex II. The shared locations are United States (Northern Virginia), European Union (Frankfurt, Germany), United Kingdom (London) and Türkiye.
• Dedicated location: a location used by the Customer alone, in the region of a shared location.
• Custom region: a location GetClinic opens for the Customer in any Amazon Web Services region, or with a qualified provider in the Customer's country.
• Sovereign national cloud: a location on a qualified national cloud, operated by GetClinic with operators located in its region.
• Private installation: the Service installed on the Customer's own infrastructure, in its data centre or its cloud account, and operated by the Customer under the Private Licence (section 2.4).
• Air-gapped installation: a private installation on an isolated network with no outbound connection, updated by signed media (section 2.4).

Each location that GetClinic hosts runs its own copy of the Service, including its language models, databases, file storage and backups.

Annex II: Technical and organisational measures

These measures apply in every Data Location that GetClinic hosts. In a private or air-gapped installation the Customer operates the infrastructure, and the measures that depend on it are the Customer's (section 2.4).

1. Separation of customers. Every record carries its organisation; the database enforces row-level security; access is checked on every request against the person's memberships and roles.

2. Encryption. TLS for all connections, with certificate verification for database connections; encryption at rest for databases, file storage and backups, with keys held in the key management service of the Data Location (AWS Key Management Service in Amazon Web Services locations).

3. Network. Private network; no public endpoint for the Kubernetes control plane; web application firewall on public traffic; malware scanning and quarantine of every upload.

4. Identity and access. Breached-password check; second factors (authenticator app, security key, email code); recent sign-in required for sensitive actions; single sign-on through OpenID Connect, which the Customer can make mandatory; 12-hour sessions; administrators can deactivate users at once.

5. GetClinic personnel. No routine access; assist mode and break-glass as set out in section 7; named production access only, screened under 28 CFR Part 202; confidentiality obligations.

6. Audit and logging. Audit trail of actions in the Service; write-once copy of emergency access records for 400 days; application logs without clinical notes, variants, names, dates of birth or prompts with patient data.

7. AI. Models run inside GetClinic's environment in the Data Location; uploaded and retrieved text is treated as data; agents reach data only through a controlled tool interface that enforces the organisation's permissions.

8. Software supply chain. Changes reviewed and tested before release; container images pinned by digest.

9. Availability. Point-in-time recovery of databases within the last 7 days; each Data Location runs in one region, and its backups stay in the Data Location; incident process with notices to customers in the Service.

10. Data minimisation and deletion. Retention settings, two-person erasure, legal holds, tombstones without content, as set out in section 14.

Annex III: Sub-processors of Customer Personal Data

The Sub-processor of Customer Personal Data is the infrastructure provider of the Customer's Data Location. The current list of Sub-processors, including the infrastructure provider of each Data Location, is published at https://tulparus.ai/subprocessors/, and changes to it follow the notice in section 9.2. A Data Location whose infrastructure provider is not on that list cannot be chosen and receives no Customer Personal Data. The entries at the date of signature are:

For a private or air-gapped installation GetClinic engages no Sub-processor (section 2.4).

Operating personnel. GetClinic's own personnel who operate the Service work from Türkiye, except for a sovereign Data Location, which is operated by personnel located in its region (section 7.4). For a sovereign Data Location, and where the Order Form includes the in-region operators option, emergency access is limited to operators located in the region of the Data Location. For a Data Location in Türkiye, access to Customer Data is limited to personnel located in Türkiye.

Other service providers (not Sub-processors)

The following providers are not Sub-processors under this DPT. They receive no Customer Personal Data and process only account, billing and usage data for which GetClinic is controller under section 2.2, as described in the Privacy Notice. They are the same for every Data Location: