Annex 1 — Data Processing Agreement for doctors and practices (DPA)

Version 28.09.2026 — revizia 2 · In force from 28.09.2026

This annex supplements the DrAtlas Terms of Use (Part III) and is accepted by the doctor or the practice's representative when creating the doctor profile. It is concluded under Article 28 of Regulation (EU) 2016/679 ("GDPR"). This is a translation; the Romanian version prevails.

A1. Parties and roles

For the patient record and clinical operations determined by the doctor/practice, the doctor/practice is the "Controller" and ALTANET S.R.L., tax ID 15748710, Str. Amilcar Sandulescu 11 Bl. A32 Sc. 1 Ap. 13 Cod 200689 is the "Processor".

ALTANET remains a separate controller for the doctor's own account, invoicing, verification, general security and its legal obligations, under the Privacy Policy.

A2. Subject matter, duration, nature and purpose

ALTANET hosts, organises, secures, makes available and, on the Controller's instruction, sends or deletes the data needed for appointments, messages, documents and records.

Processing lasts for the term of the contract and the limited return/deletion period in section 53 of the Terms (90 days after the account is closed).

A3. Data subjects and data

Data subjects: patients, family members/representatives, the Controller's staff and contact persons.

Data: identification, contact, appointments, messages, documents, health data (special category, Art. 9 GDPR), medical notes, access logs and other information lawfully entered by the Controller.

A4. Instructions and confidentiality

ALTANET processes only on the Controller's documented instructions, including for transfers, unless the law requires otherwise. Using the app's features (for example adding, editing, sending or deleting a record) constitutes the Controller's instructions. If an instruction appears to infringe the GDPR, ALTANET informs the Controller and may suspend it until clarified.

Authorised persons are bound by confidentiality and receive access only as far as necessary.

A5. Security

ALTANET applies measures proportionate to the risk (Art. 32 GDPR), including role-based access, encryption in transit (HTTPS), private storage of documents reachable through temporary links, hashed passwords, temporary account lockout after wrong passwords, logging of administrative access, daily backups, vulnerability and incident management, continuity and periodic testing.

The Controller is responsible for configuring staff access, its own devices and the lawfulness of the data entered.

A6. Sub-processors

The Controller authorises the following sub-processors:

• ALTANET — hosting, database, files and e-mail, on its own infrastructure, in Romania;
• Twilio Inc. — confirmation and reminder SMS (USA);
• Expo (650 Industries, Inc.), Apple Inc. (APNs) and Google LLC (FCM) — push notifications (USA).

The list is made available to the Controller and updated by notice to the e-mail address linked to the professional account. ALTANET gives at least 30 days' notice before adding or replacing a sub-processor and a reasonable opportunity to object on justified grounds; if no solution is found, the Controller may end the contract at no extra cost. ALTANET imposes equivalent obligations on the sub-processor and remains liable to the Controller for their performance.

A7. Data subject rights

ALTANET assists the Controller, through appropriate technical and organisational measures, in handling requests for access, rectification, erasure, restriction, portability and objection. Requests ALTANET receives about the Controller's records are forwarded without delay. ALTANET does not reply directly on the Controller's behalf without instruction, except for its own obligations.

A8. Incidents

ALTANET notifies the Controller without undue delay, within 48 hours of becoming aware of a personal data breach affecting data processed on its behalf, and provides the information available for assessment and notification.

The Controller decides on notifying the authority and the patient for its processing, with ALTANET's assistance.

A9. DPIA and authorities

ALTANET provides the information reasonably needed for a data protection impact assessment (DPIA) and prior consultation, taking into account the nature of the processing and the information available.

A10. Return and deletion

On termination, ALTANET, at the Controller's choice and within the law, returns the data — patient list, medical history and documents, in JSON/CSV plus the original files, on request to hello@medi-max.ro, within 30 days — and permanently and automatically deletes it 90 days after the account is closed. Data disappears from backups when they are overwritten (daily backup, kept for at most 30 days). Legal exceptions are isolated and not used for other purposes.

A11. Audit and evidence

ALTANET makes available the information needed to demonstrate compliance with Art. 28 GDPR and allows reasonable audits, scheduled with at least 30 days' written notice, subject to confidentiality and security limits. The Controller bears the cost of an unjustified additional audit, unless the parties agree otherwise.

A12. Transfers

Record data is stored in Romania. Any transfer outside the EEA takes place only with a legal mechanism and applicable safeguards: for the US sub-processors (Twilio, Expo, Apple, Google), based on the EU–US Data Privacy Framework adequacy decision for certified providers, otherwise on the European Commission's standard contractual clauses. Only the data strictly needed for notifications leaves through them (phone number or token and the message text), not the records, documents or messages.

Contact

ALTANET S.R.L., Str. Amilcar Sandulescu 11 Bl. A32 Sc. 1 Ap. 13 Cod 200689
E-mail: hello@medi-max.ro