Schedule 1 Data protection (Controller to Processor)
DEFINITIONS
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, processing and appropriate technical and organisational measures: as defined in the Data Protection Legislation.
Data Protection Legislation:
a) To the extent the UK GDPR applies, the law of the United Kingdom or of a part of the United Kingdom which relates to the protection of Personal Data.
b) To the extent the EU GDPR applies, the law of the European Union or any member state of the European Union to which the Customer is subject, which relates to the protection of Personal Data.
Domestic Law: the law of the United Kingdom or a part of the United Kingdom.
EU GDPR: the General Data Protection Regulation ((EU) 2016/679).
EU Law: the law of the European Union or any member state of the European Union.
UK GDPR: has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.
- DATA PROTECTION
1.1. To the extent applicable, the Healthcare Provider shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of all such Healthcare Provider Data, other than arising from any error caused by Aide.
1.2. In the event of any loss or damage to the Healthcare Provider Data, the Healthcare Provider's sole and exclusive remedy against Aide shall be for Aide to use reasonable commercial endeavours to restore the lost or damaged Healthcare Provider Data from the latest back-up of such Healthcare Provider Data maintained by Aide. Aide shall not be responsible for any loss, destruction, alteration or disclosure of Healthcare Provider Data caused by any third party (except those third parties sub-contracted by Aide to perform services related to Healthcare Provider Data maintenance and back-up for which it shall remain fully liable under clause 1.8 below).
1.3. Both parties will comply with all applicable requirements of the Data Protection Legislation. This clause 1.3 is in addition to, and does not relieve, remove or replace, a party's obligations or rights under the Data Protection Legislation.
1.4. The parties acknowledge that for the purposes of the Data Protection Legislation, in respect of the Healthcare Provider Personal Data, the Healthcare Provider is the Controller and Aide is the Processor. Appendix A sets out the scope, nature and purpose of processing by Aide, the duration of the processing and the types of Personal Data and categories of Data Subject.
1.5. Without prejudice to the generality of clause 1.3, the Healthcare Provider will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of the Healthcare Provider Data to Aide for the duration and purposes of this Agreement so that Aide may lawfully use, process and transfer the Healthcare Provider Data in accordance with this Agreement on the Healthcare Provider's behalf and the Healthcare Provider shall defend, indemnify and hold harmless Aide against all claims, requests, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with the Healthcare Provider's breach of its obligations in this clause 1.5, provided that:
1.5.1. the Healthcare Provider is given prompt notice of any such claim;
1.5.2. Aide provides reasonable co-operation to the Healthcare Provider in the defence and settlement of such claim, at the Healthcare Provider's expense; and
1.5.3. the Healthcare Provider is given authority to defend or settle the claim, provided it does so diligently and not to the detriment of Aide.
1.6. Without prejudice to the generality of clause 1.3, Aide shall, in relation to any Healthcare Provider Personal Data processed in connection with the performance by Aide of its obligations under this Agreement:
1.6.1. process that Healthcare Provider Personal Data only on the documented written instructions of the Healthcare Provider unless Aide is required by domestic law (where “domestic law” means the UK Data Protection Legislation and any other law that applies in the UK) to otherwise process that Healthcare Provider Personal Data. Where Aide is relying on domestic law as the basis for processing Healthcare Provider Personal Data, Aide shall promptly notify the Healthcare Provider of this before performing the processing required by the domestic law unless domestic law prohibits Aide from so notifying the Healthcare Provider;
1.6.2. ensure that all personnel who have access to and/or process Healthcare Provider Personal Data are obliged to keep the Healthcare Provider Personal Data confidential;
1.6.3. not transfer any Healthcare Provider Personal Data to a third party outside of the UK and EEA unless the following conditions are fulfilled:
a) the data subject has enforceable rights and effective legal remedies; and
b) use reasonable endeavours to ensure that: (i) the transfer is to a country approved under applicable Data Protection Legislation as providing an adequate level of protection to any Healthcare Provider Personal Data that is transferred; (ii) there are appropriate safeguards (such as the UK ICO approved international data transfer agreement or international data transfer addendum) or binding corporate rules in place in relation to the transfer pursuant to the applicable Data Protection Legislation; (iii) the transferee otherwise complies with Aide’s relevant obligations under the applicable Data Protection Legislation by providing an adequate level of protection to any Healthcare Provider Personal Data that is transferred; or (iv) one of the derogations for specific situations in the applicable Data Protection Legislation applies to the transfer;
1.6.4. assist the Healthcare Provider, at the Healthcare Provider's cost, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
1.6.5. notify the Healthcare Provider without undue delay on becoming aware of a Personal Data Breach;
1.6.6. at the written direction of the Healthcare Provider, delete or return (to the extent technically and reasonably possible) relevant Healthcare Provider Personal Data and copies thereof to the Healthcare Provider on termination of the Agreement unless required by domestic law to store the Healthcare Provider Personal Data; and
1.6.7. maintain complete and accurate records and information to demonstrate its compliance with this clause 1 and promptly inform the Healthcare Provider if, in the opinion of Aide, an instruction infringes the Data Protection Legislation.
1.7. Each party shall ensure that it has in place appropriate technical and organisational measures, to protect against unauthorised or unlawful processing of Healthcare Provider Personal Data and against accidental loss or destruction of, or damage to, Healthcare Provider Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Healthcare Provider Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it).
1.8. The Healthcare Provider hereby consents to the appointment of all third-party processors of Healthcare Provider Personal Data that have been appointed by Aide as of the Commencement Date in order to assist Aide in complying with its obligations as a processor under this Agreement (each, a “Sub-Processor”). Aide confirms that it may only appoint additional Sub-Processors if the Healthcare Provider provides Aide with its consent prior to each such appointment. Where such consent is not provided, either party may terminate this Agreement on 30 days’ written notice to the other. Aide has, or as the case may be, will enter into written agreements with each Sub-Processor that it appoints incorporating terms which are substantially similar to those set out in this clause 1 and which Aide confirms reflect and will continue to reflect the applicable requirements of the Data Protection Legislation. As between Aide and the Healthcare Provider, Aide shall remain fully liable for all acts or omissions of any Sub-Processor appointed by it pursuant to this clause 1.8.
1.9. The Healthcare Provider hereby acknowledges and agrees that Aide may anonymise the Healthcare Provider Data (so that it can no longer be associated with a Data Subject), aggregate it with the data of other customers and end users of Aide and/or use and share such aggregated and/or anonymised data for any purpose, including, but not limited to, research and/or statistical analysis in respect of education and health, to support pharmaceutical partners in conducting real-world drug effectiveness and safety evaluations, helping to improve treatments and patient outcomes, as well as data analytics to evaluate, administer, protect and improve the Services, and Aide’s rights in this clause 1.9 shall survive termination or expiry of this Agreement, however arising (“Aide Data”). The parties acknowledge that Aide shall only be considered a Controller in respect of any Aide Data in the event any such data is classified as Personal Data and shall process such Personal Data in accordance with the terms of its privacy policy, which can be found at www.aide.health/privacy-policy.
Appendix A - PROCESSING, PERSONAL DATA AND DATA SUBJECTS
Scope and purpose of processing
Aide will process the Personal Data to provide the Services to the Healthcare Provider.
Nature
Storage and transfer of the Personal Data for the purposes of providing the Services.
Duration of the processing
Aide will process the Personal Data for the duration of this Agreement and as necessary thereafter solely as required by the Data Protection Legislation and any applicable laws and regulations.
Types of Personal Data
Names, surnames, job titles, telephone numbers and e-mail address and data relating to the physical health of a Patient, including treatment, care, diagnosis, medical records, charts, medical history, prescriptions, findings, and other medical record’s in a Clinician’s possession to the extent necessary for providing the Patient the relevant Services.
Categories of data subject
The Healthcare Provider’s Authorised Users, officers, members, employees, contractors, subcontractors and suppliers.
Schedule 2 - Additional responsibilities if you are a business user
ADDITIONAL DEFINITIONS
Subscription Fee: the subscription fees payable by you to us which entitle your Authorised Users to access and use the Services and the Documentation in accordance with this Agreement as set out in the Proposal.
Medical Records: a Patient’s medical records including, but not limited to, reports, charts, medical history, findings, prescriptions, diagnosis, medical testing, test results, ethnicity and other treatment records in a Clinician’s possession.
- PROPOSAL
1.1. This Agreement and your obligations set out in this Agreement are in addition to your responsibilities as set out in out in our Proposal with you. - PAYMENT TERMS AND CONDITIONS
2.1. You will pay the Subscription Fee to us in accordance with this section and the Proposal.
2.2. We shall invoice you:
2.2.1. on the Commencement Date for the Subscription Fees payable in respect of the Initial Subscription Term; and
2.2.2. subject to clause 15 of the Agreement at least 90 days prior to each anniversary of the Commencement Date for the Subscription Fees payable in respect of the next Renewal Period, and you shall pay each invoice within 30 days after the date of such invoice.
2.3. If we have not received payment within 30 days after the due date, and without prejudice to any of our other rights and remedies:
2.3.1. We may, without liability to you, disable your Authorised Users account and access to all or part of the Services and we shall be under no obligation to provide any or all of the Services while the invoice(s) concerned remain unpaid; and
2.3.2.interest shall accrue on a daily basis on such due amounts at an annual rate equal to 3% over the then current base lending rate of the Bank of England from time to time, commencing on the due date and continuing until fully paid, whether before or after judgment.
2.4. All amounts and fees stated or referred to in this Agreement:
2.4.1. shall be payable in pounds sterling;
2.4.2. are non-cancellable and non-refundable; and
2.4.3 are exclusive of value added tax, which shall be added to your invoice(s) at the appropriate rate.
2.5. We shall be entitled to increase the Subscription Fees at the start of each renewal Term upon 90 days' prior notice to you and the Subscription Fee set out in the Proposal shall be deemed to have been amended accordingly. - CONSENT OF PATIENTS AND ACCESS TO PATIENTS PERSONAL DATA
3.1. You shall have sole responsibility to:
3.1.1. determine the suitability of the relevant Cohorts of Patients to use the Services;3.1.2. determine the suitability of the relevant Clinician appropriate to be paired with a Patient on the Platform to enable the Patient to better utilise the Services;3.1.3. ensure that you have the necessary and valid consent from Patients to enable the lawful transfer of Patients Medical Records, for the duration and purpose of this Agreement so that we may lawfully use and have access to such Patients’ Medical Records to the extent necessary to provide the Services.
3.2. You acknowledge and agree that the Platform is only intended to support and enhance but not replace your or your Clinicians professional judgement and knowledge. - USER SUBSCRIPTIONS
4.1. In relation to your Authorised Users (to the extent applicable), you undertake that:4.1.1. you will not allow or suffer any user registration to be used by more than one individual Authorised User unless if applicable it has been reassigned in its entirety to another individual Authorised User, in which case the prior Authorised User shall no longer have any right to access or use the Services and/or Documentation;4.1.2. each Authorised User shall keep a secure password for their use of the Services and Documentation and that each Authorised User shall keep their password confidential;4.1.3. you shall permit us or our designated auditor to audit the Services in order to establish the name and password of each Authorised User and your data processing facilities to audit compliance with this Agreement. Each such audit may be conducted no more than once per quarter, at our expense, and this right shall be exercised with reasonable prior notice, in such a manner as not to substantially interfere with your normal conduct of business; and4.1.4. if any of the audits referred to in clause 4.1.4 reveal that any password has been provided to any individual who is not an Authorised User, then without prejudice to our other rights, we shall promptly disable such passwords and we shall not issue any new passwords to any such individual. - PUBLIC STATEMENTS
5.1. Neither you or us shall make, or permit any person to make, any public announcement concerning the Agreement without the prior written consent of the other party (such consent not to be unreasonably withheld or delayed). - CONFIDENTIALITY
6.1. You shall not at any time during the Term of this Agreement and for a period of five years after termination of expiry of this Agreement disclose to any person any confidential information concerning our business, affairs, customers, clients or suppliers except as permitted by section 6.2
6.2. You may disclose our confidential information:
6.2.1. to your employees, officers, representatives, contractors, subcontractors or professional advisers who need to know such information for the purposes of exercising your rights or carrying out your obligations under or in connection with this Agreement. You shall ensure that your employees, officers, representatives, contractors, subcontractors or advisers to whom you disclose our confidential information are subject to a duty of confidentiality; and
6.2.2. as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.
Schedule 3 - Addendum for United States Users
This Addendum supplements the Aide Health Terms of Service (the "Terms") for users who are resident in the United States and who are accessing the Aide Health platform through a pilot programme operated by Aide Health Limited ("Aide", "we", "us") in the United States, including the pilot offered through Temple University Health System.
In the event of any conflict between this Addendum and the Terms, this Addendum prevails for US pilot users. All other provisions of the Terms remain in full force and effect. Capitalised terms used but not defined in this Addendum have the meanings given to them in the Terms.
1. Nature of the pilot
I understand that:
- the Services are being made available to me free of charge as part of a pilot programme;
- the pilot is a research project and is not a paid consumer service;
- access to the Services may be discontinued at the end of the pilot period, and Aide is under no obligation to make the Services available to me on a continuing basis after the pilot ends; and
- the cooling-off, refund, cancellation and subscription provisions in the Terms (including those relating to consumer rights under UK law) do not apply to my use of the Services during the pilot, because no fees are payable by me.
2. Data location and transfer
I understand that Aide is a company incorporated in England and Wales, that Aide's infrastructure and personnel are located primarily in the United Kingdom, and that my personal data, including health-related data I provide through the Services, will be transferred to and processed in the United Kingdom. Aide will apply appropriate technical and organisational safeguards to my data wherever it is held.
3. UK statutory references in the Aide End User Licence Agreement
References in the Aide End User Licence Agreement to specific provisions of UK legislation, including sections 50B and 296A of the Copyright, Designs and Patents Act 1988 and the Contracts (Rights of Third Parties) Act 1999, are replaced for US pilot users by the equivalent rights and limitations available under applicable US federal and state law. No greater rights are intended to be granted, and no rights that cannot lawfully be excluded under applicable US law are excluded.
4. Age
I confirm that I am at least 18 years of age.
5. Provisions not applicable to US pilot users
The following provisions of the Terms do not apply to me as a US pilot user:
- the cooling-off provisions in clause 13 of the Terms; and
- the cancellation and subscription provisions in clause 14 of the Terms, to the extent they relate to paid subscriptions.