AdvaPACS Data Processing Agreement

AdvaPACS Global Data Processing Agreement

This Global Data Processing Agreement (“DPA”) is entered into on the effective date (“Effective Date”) of the AdvaPACS Terms of Service by and between:

ADVAHEALTH SOLUTIONS PTE. LTD. (UEN 202010734K), a company incorporated in Singapore with its registered address at 165B Telok Ayer Street, Singapore 068617 (“AdvaHealth” or “Company”); and
you, details of which are set out in the AdvaPACS Terms of Service (hereafter referred to as the “Customer” or “Reseller”),

(the Company and the Customer are each a “Party” and together the “Parties”).

Background and Purpose
1. This DPA forms part of and is incorporated into the AdvaPACS Terms of Service on the Effective Date (the “Agreement”) between the Parties governing the Customer’s (and its clinicians, registered patients and/or authorised proxy of a registered patient) access and use of AdvaPACS, a software-as-a-service application (the “Application”) and related services.
2. The Application is intended for use by healthcare providers such as hospitals and clinics to provide Picture Archiving and Communications System (PACS) services for storing, indexing, retrieving, transmitting, viewing and otherwise processing medical imaging and related clinical data, together with associated support, maintenance and hosting (“Services”).
3. This DPA sets out the Parties’ data protection and security obligations in relation to Personal Data processed in connection with the Services, in accordance with the Applicable Law. By creating an account on the Application or using the Services, the Customer agrees to this DPA, which is incorporated by reference in the Agreement.
4. This DPA shall include and incorporate by reference any annexures attached to or referenced in this DPA including the BAA (collectively referred to as the “Annexures”). Each of the Annexures forms part of this DPA as if fully set out herein. In the event of any inconsistency between the provisions of this DPA and any applicable Annexure, the relevant Annexure shall prevail to the extent of such inconsistency with respect to the jurisdiction to which it applies.
Definitions and Interpretation
1. Capitalised terms used but not otherwise defined herein shall have the meanings ascribed to them in the Agreement.
2. In this DPA, unless the context requires otherwise:
  1. “Applicable Law” means with respect to any Party, all laws, statutes, codes, rules, regulations, orders, judgments, decrees, directives, circulars or decisions and other requirements of any governmental or competent authority that apply to that person including any legally enforceable requirements that apply to any Party’s Processing of Personal Data pursuant to the Agreement, including:
    1. the Personal Data Protection Act 2012 of Singapore (“PDPA”) and regulations made under it;
    2. any binding guidelines, circulars or decisions published by the Personal Data Protection Commission (“PDPC”);
    3. any other laws, statutes, codes, rules, regulations, orders, judgments, decrees, directives, circulars or decisions and other requirements of any governmental or competent authority relating to data protection, cybersecurity or confidentiality that apply to the Services and each Party; and
    4. where the Customer is a licensed healthcare provider, the Healthcare Services Act 2020 and regulations made under it, the Healthcare Information Bill, and any binding guidelines, circulars or decisions published by the Ministry of Health (“MOH”);
  2. “Business Associate Agreement” or “BAA” has the meaning ascribed to it in Annex E;
  3. “Data Intermediary” means an organisation which processes personal data on behalf of another organisation but does not include an employee of that other organisation;
  4. “Effective Date” means the date which the Parties entered into the Agreement or such other date as agreed in writing between the Parties;
  5. “Personal Data” means data provided by the Customer to AdvaHealth, whether true or not, in any form, about an identified or identifiable individual, where the individual can be identified (i) from that data alone, or (ii) from that data and other information to which a person has or is likely to have access. Personal Data includes:
    1. identifiers and contact details (e.g., name, NRIC/FIN/passport, date of birth, sex, address, phone, email, patient numbers/medical record numbers, insurance identifiers);
    2. administrative information relating to the individual’s use of healthcare services, eligibility for healthcare subsidies/assistance, appointment/admission/discharge and billing/claims administration;
    3. clinical information relating to the individual’s physical/mental health and the diagnosis, treatment or care of the individual;
    4. medical imaging and related data, including images, studies/series, and associated metadata;
    5. user and access information (e.g., clinician/staff user IDs, roles, audit logs) to the extent such data relates to an identifiable individual; and
    6. technical identifiers (e.g., IP addresses, device IDs, log data) to the extent such data relates to an identifiable individual;
      
      For avoidance of doubt, Personal Data includes “health information” as defined in the Health Information Act 2026 and “patient health records” as referred to in the Healthcare Services (General) Regulations 2021;
  6. “Processing” and “process” in relation to Personal Data, means the carrying out of any operation or set of operations in relation to the Personal Data, and includes any of the following:
    1. recording;
    2. holding;
    3. organisation, adaptation or alteration;
    4. retrieval;
    5. combination;
    6. transmission; or
    7. erasure or destruction.
  7. “Security Incident” means any actual or reasonably suspected data breach including any (i) unauthorised access, collection, use, disclosure, copying, modification, disposal, deletion, or loss of Personal Data; (ii) compromise of confidentiality, integrity, or availability of systems that store or process Personal Data; or (iii) event that materially compromises the security of Personal Data, including ransomware, malware, credential compromise or material misconfiguration.
  8. “Subprocessor” means any third party engaged by AdvaHealth to process Personal Data on behalf of the Customer in connection with the Services.
3. In this DPA, a reference to:
  1. a statutory provision shall, except where expressly provided to the contrary, be construed as references to that provision as respectively amended, consolidated, extended or re-enacted from time to time and shall include the corresponding provision of any earlier legislation (whether repealed or not) and any orders, regulations, instruments or other subordinate legislation made from time to time under the statute concerned;
  2. “person” shall include an individual, corporation, company, partnership, firm, trustee, trust, executor, administrator or other legal personal representative, unincorporated association, joint venture, syndicate or other business enterprise, any governmental, administrative or regulatory authority or agency (notwithstanding that “person” may be sometimes used herein in conjunction with some of such words), and their respective successors, legal personal representatives and assigns, as the case may be, and pronouns shall have a similarly extended meaning;
  3. “month” is a reference to a period starting on one day in a calendar month and ending on the numerically corresponding day in the next succeeding calendar month;
  4. “Business Day” means a day (excluding Saturdays and Sundays) on which banks are open for normal banking business in Singapore;
  5. “written” and “in writing” include any means of visible reproduction;
  6. “Recitals”, “Clauses”, and “Annexures” are to the recitals, clauses of, and the annexures to, this DPA (unless the context otherwise requires); and
  7. times of the day are to local time in Singapore unless otherwise stated and references to a day are to a period of twenty-four (24) hours running from midnight to midnight.
4. Unless the context otherwise requires, words importing the singular shall include the plural and vice versa, and words importing a specific gender shall include any other gender.
5. The headings in this DPA are inserted for convenience only and shall not affect the construction of this DPA.
6. Any obligation or anything to be done under this DPA that is required or falls to be done on a stipulated day shall be done on the next succeeding Business Day, if the day upon which that thing or obligation is required or falls to be done falls on a day which is not a Business Day.
7. If a period of time is specified and dates from a given day or the day of an act or event, it will be calculated exclusive of that day.
8. Unless the context otherwise requires, general words shall not be given a restrictive meaning by reason of their being preceded or followed by words indicating a particular class or example of acts, matters or things.
9. Unless the context otherwise requires, references to “include” or “including” shall not be construed restrictively but shall mean “including without prejudice to the generality of the foregoing” and “including but without limitation”.
10. Any references to any documents (including this DPA) shall be deemed to include any amendments, additions, modifications, variations or supplements to such document from time to time.
11. Reference to a regulation includes any regulation, rule, official directive, request or guideline (whether or not having the force of law) of any governmental, inter-governmental or supranational body, agency, department or regulatory, self-regulatory or other authority or organisation.
12. In the event of conflict between this DPA and the Agreement in relation to Personal Data Processing matters, this DPA prevails to the extent of the conflict.
Roles of the Parties
1. For the purpose of this DPA and the Agreement:
  1. The Customer is the “organisation” under the PDPA and determines the purposes and means of Processing health information and other Personal Data uploaded on the Application.
  2. AdvaHealth processes Personal Data as a Data Intermediary on behalf of the Customer for the purposes of providing the Services and will comply with its obligations as a Data Intermediary under the PDPA (the Protection Obligation and the Retention Limitation Obligation), and with the contractual obligations set out in this DPA.
Description of Processing
1. AdvaHealth shall only process, use or disclose Personal Data provided under this Agreement:
  1. for the purposes of fulfilling its obligations and providing the Services required under the Agreement;
  2. with the Customer’s and/or its authorised users prior written consent; or
  3. when required by law or an order of court, but shall notify the Customer as soon as practicable before complying with such law or order of court at its own costs.
2. AdvaHealth shall not retain any Personal Data (or any documents or records containing any Personal Data, electronic or otherwise) for any period of time longer than is necessary to serve the purposes of the Agreement, subject to any transitional period for return/export and deletion as set out in Clause 12.
3. In addition to the provision of the Services, AdvaHealth may process any Personal Data for purposes which are ancillary to the provision of the Services such as to enforce access control, user management, logging, backup, disaster recovery, customer support (including troubleshooting) and security monitoring.
4. The types of Personal Data processed under the Agreement includes any Personal Data uploaded to, stored in, transmitted through, accessed via, or otherwise processed by the Services, and any Personal Data generated or derived by the Services in the course of providing the Services (including system/audit logs, access records and other technical or usage data), to the extent such information constitutes Personal Data.
5. The categories of Personal Data provided by the Customer includes the Customer’s employees, consultants, officers, agents and patients, and any authorised third-party healthcare professionals or service providers of the Customer.
6. The Personal Data will be processed by AdvaHealth, its related companies and/or third party service providers as necessary to provide the Services.
7. AdvaHealth shall not transfer any Personal Data to a place outside Singapore without the Customer’s prior written consent. If the Customer provides consent, AdvaHealth undertakes to the Customer that the Customer Personal Data transferred outside Singapore will be protected at a standard that is comparable to that under the PDPA. If AdvaHealth transfers Personal Data to any third party overseas, the Contractor shall procure the same written undertaking from such third party. Where the Processing involves any transfer of Personal Data outside Singapore, such transfer will be subject to Clause 11 (Cross-Border Transfers).
Customer Instructions
1. AdvaHealth will process Personal Data only on documented instructions from the Customer, including as set out in the Agreement, this DPA, and the Customer’s configuration choices or other settings on the Application.
2. AdvaHealth will promptly inform the Customer if, in its reasonable opinion, an instruction may violate Applicable Law. In such case, AdvaHealth may suspend the relevant Processing until the Parties agree to discuss in good faith on how to proceed with the relevant Processing, including seeking appropriate legal advice at the Customer’s expense.
3. If AdvaHealth is required by law or a competent authority to process or disclose Personal Data other than on the Customer’s instructions, AdvaHealth will (unless prohibited by Applicable Law) notify the Customer before complying and will cooperate with the Customer to the extent permitted by Applicable Law to limit the scope of disclosure.
Permitted Processing and Prohibited Use
1. AdvaHealth may process Personal Data only to the extent necessary to provide the Services pursuant to the Agreement, to comply with Applicable Law and for any other reasonable legal or compliance purposes.
2. AdvaHealth must not process Personal Data for AdvaHealth’s own purposes except as permitted under the Agreement, this DPA or Applicable Law, and must not sell any Personal Data.
3. AdvaHealth must not disclose any Personal Data to any third party except as permitted under the Agreement, this DPA or Applicable Law.
4. AdvaHealth will only permit its authorised personnel, any third party service providers, including any Subprocessor, legal and other advisors, to access Personal Data on a need-to-know basis where necessary or ancillary to perform its obligations pursuant to the Agreement and to provide the Services.
Confidentiality and Personnel Obligations
1. AdvaHealth will ensure that all personnel authorised to process Personal Data are:
  1. subject to confidentiality obligations (contractual or statutory); and
  2. trained on data protection, secure handling of health information and security incident reporting consistent with their role.
2. AdvaHealth will apply least-privilege access, role-based access control and need-to-know principles for internal access to health information.
Security Measures
1. AdvaHealth shall protect the Personal Data in AdvaHealth’s control or possession by making reasonable security arrangements (including, where appropriate, physical, administrative, procedural and ICT measures) to prevent:
  1. unauthorised or accidental access, collection, use, disclosure, copying, modification, disposal or destruction of Personal Data, or other similar risks; and
  2. the loss of any storage medium or device on which Personal Data is stored.
2. In determining what “reasonable security arrangements” are reasonable for the purposes of this DPA, AdvaHealth will have regard to the administrative, physical and technical controls appropriate to the nature and volume of the Personal Data, and the harm that might result from a Security Incident, aligned with the best practices set out in guidelines issued by MOH, PDPC and other competent authorities, where applicable.
3. Without limitation to Clause 7.2, AdvaHealth will restrict access to health information to authorised personnel on a need-to-know basis for the purposes of providing the Services and handling support and security matters.
4. The Customer acknowledges that the Customer is responsible for the security of its own systems, devices and endpoints and for the secure configuration and use of the Services (including user provisioning and access permissions) within the Customer’s environment. The Customer shall indemnify AdvaHealth and its officers, employees and agents, against all actions, claims, demands, losses, damages, statutory penalties, expenses and cost (including legal costs on an indemnity basis), in respect of the Contractor’s breach of this Clause 8.4 or any act, omission or negligence of the Customer or its authorised users that causes or results in AdvaHealth and its related companies being in violation of any Applicable Law.
Data Accuracy and Correction
1. The Customer is responsible for ensuring that any Personal Data uploaded to the Application (by the Customer or its authorised users) is accurate and complete for the purposes it is disclosed to and processed by AdvaHealth and for ensuring that its own collection and disclosure to AdvaHealth complies with Applicable Law.
2. AdvaHealth will not independently verify the accuracy of Personal Data input by the Customer or its authorised users. However, where technically feasible and supported by the Application, AdvaHealth will use reasonable efforts to assist Customer to correct Personal Data in AdvaHealth’s possession or control upon the Customer’s prior written request.
3. AdvaHealth will process health information only to the extent necessary to provide, secure and support the Application or to carry out its obligations under the Agreement (e.g., indexing, transcoding, compression where clinically appropriate and instructed by the Customer in accordance with Clause 5) in accordance with the Agreement and the Customer’s instructions. AdvaHealth will not intentionally alter the clinical content of health information other than as required for such technical Processing or as instructed by the Customer (or its authorised users).
Subprocessing
1. The Customer authorises AdvaHealth to engage Subprocessors to process Personal Data for the limited purpose of providing the Services, subject to this Clause 10.
2. AdvaHealth will:
  1. conduct reasonable due diligence on Subprocessors’ ability to protect Personal Data;
  2. enter into a written agreement with each Subprocessor imposing data protection and confidentiality obligations to the extent necessary to comply with its obligations under Applicable Law; and
  3. remain responsible for the performance of Subprocessors in relation to Personal Data.
3. AdvaHealth may change its Subprocessors from time to time. Where reasonably practicable, AdvaHealth will provide the Customer with information about the Subprocessors upon the Customer’s reasonable written request.
Cross-Border Transfers
1. The Customer authorises cross-border transfers by AdvaHealth where necessary to provide, support or secure the Services, including to AdvaHealth’s server hosting providers and Subprocessors.
2. Where Personal Data is transferred outside Singapore, AdvaHealth will implement appropriate measures to ensure a standard of protection comparable to that under the PDPA.
3. Such safeguards may include (as applicable):
  1. ensuring that overseas recipients (including Subprocessors and hosting service providers) are contractually bound to protect Personal Data to a comparable standard;
  2. implementing reasonable technical measures (such as encryption in transit and at rest, and access controls, where appropriate); and/or
  3. upon the Customer’s reasonable request, providing to the Customer information reasonably available to AdvaHealth and necessary for the Customer to assess cross-border transfer safeguards to comply with its obligations under Applicable Law.
Retention and Deletion of Personal Data
1. AdvaHealth will not retain Personal Data longer than is reasonably necessary for legal or business purposes related to providing the Services and to carry out its obligations under the Agreement, except as required by Applicable Law or for legal or compliance purposes.
2. Upon termination or expiry of the Agreement, and upon the Customer’s written request, AdvaHealth will, within a reasonable time and subject to the payment of any agreed fees:
  1. make available to the Customer a standard export of Personal Data in a commonly used format (including medical imaging formats such as DICOM and associated metadata); and
  2. delete or irreversibly anonymise all Personal Data in its possession or control after completion of the export, except to the extent retention is required by law, any court order, tribunal award, competent authority’s direction or for dispute resolution, provided such retained Personal Data remains protected under this DPA.
3. Following completion of an export under Clause 12.2 (or where no export is requested, following termination or expiry of the Agreement), AdvaHealth will delete or anonymise Personal Data in its possession or control within a reasonable time in accordance with its data retention and deletion practices, except to the extent retention is required by law, compliance or audit requirements, or to enforce its obligations under the Agreement or this DPA (in which case the retained Personal Data will remain protected under this DPA).
4. After returning or deleting all Personal Data, AdvaHealth will provide the Customer with written confirmation that it no longer possesses any Personal Data upon written request by the Customer. Where applicable, AdvaHealth will also instruct all third parties to whom it has disclosed Customer Personal Data for the purposes of the Agreement and this DPA to return to AdvaHealth or delete or anonymise such Personal Data.
5. Personal Data in backups will be deleted or anonymised in accordance with AdvaHealth’s backup rotation schedule, and will remain subject to access restrictions and encryption.
Assistance with Individuals’ Requests and PDPA Obligations
1. Taking into account the nature of the Processing, and to the extent reasonably practicable and within the functionality of the Application, AdvaHealth will provide reasonable assistance to the Customer to respond to individuals’ requests under the PDPA (e.g., access and correction requests), in respect of Personal Data processed by AdvaHealth on the Customer’s behalf and at the Customer’s expense.
2. AdvaHealth will, where technically feasible and contractually supported by the Services, use reasonable efforts to:
  1. enable the Customer to retrieve, correct, or delete Personal Data through administrative controls; and/or
  2. execute the Customer’s written instructions to retrieve, correct, restrict access to, or delete Personal Data within a reasonable time.
3. AdvaHealth will promptly notify the Customer if it receives a request from an individual or regulator relating to Personal Data processed on behalf of the Customer, to the extent permitted by Applicable Law, and will not respond except on the Customer’s documented instructions unless required by law, any court order, tribunal award or competent authority’s direction.
Data Breach and Security Incident Management
1. To the extent permitted by Applicable Law, the Parties agree on the following process in relation to any Security Incident:
  1. Incident notification: AdvaHealth will notify the Customer without undue delay and in any event within three (3) days after becoming aware of a Security Incident affecting Personal Data processed under this DPA.
  2. Content of notification: AdvaHealth’s notification will include information reasonably available to AdvaHealth at the time, and generally describe (a) the nature of the Security Incident, (b) the affected systems and categories of Personal Data (and, where known, the likely impact), and (c) the containment and remediation measures taken or planned.
  3. Updates: AdvaHealth will provide reasonable updates as material information becomes available and will deliver a written incident report within 10 (ten) business days of containment, including root cause analysis and corrective actions.
  4. Cooperation and regulatory notifications: AdvaHealth will reasonably cooperate with the Customer to support the Customer’s assessment of whether the incident meets PDPA mandatory breach notification thresholds and the Customer’s notification obligations to the PDPC and affected individuals, including providing information reasonably requested by the Customer for such notifications.
  5. Preservation: AdvaHealth will, to the extent that it’s within its control, take reasonable steps to preserve relevant logs and evidence in accordance with its incident response and security practice and Applicable Law.
  6. No admission: Notifications are not an admission of fault or liability.
  7. Expenses: The Customer shall indemnify AdvaHealth, its related companies, its Subprocessors and its respective officers, employees and agents, against all actions, claims, demands, losses, damages, statutory penalties, expenses and cost (including legal costs on an indemnity basis), in respect of any act, omission or negligence of the Customer, its respective officers, employees and agents, or its users that causes or results in the Security Incident.
Audit and Cooperation
1. AdvaHealth will maintain appropriate records of its Processing activities under this DPA and will make available to the Customer, upon reasonable written request, information reasonably necessary to demonstrate compliance with this DPA.
2. Upon reasonable written request, AdvaHealth will provide one or more of the following on an annual basis if in AdvaHealth’s control or possession, subject to confidentiality obligations and reasonable redactions (in such a form or manner to be provided in AdvaHealth’s absolute discretion):
  1. an independent audit report; and/or
  2. its security policies and incident response framework.
3. The Customer’s audit rights under this DPA are limited to comply with Applicable Law or where the Customer reasonably requires cooperation from AdvaHealth in connection with:
  1. a Security Incident affecting the Customer’s Personal Data; or
  2. a binding regulatory request.
    
    Any such review will be subject to reasonable notice, confidentiality and scope limitations, and will not include access to AdvaHealth systems or other customers’ data.
4. Nothing in this Clause 15 requires AdvaHealth to disclose information that would compromise the security of the Application, reveal other customers’ data or breach any applicable law or obligations owed to any third party; in such cases, the Parties are to cooperate in good faith to provide such alternative information.
Support Access Controls
1. Where emergency support access is required to diagnose or restore Services, AdvaHealth will use reasonable controls to:
  1. limit access to the minimum required authorised personnel or such third party service providers;
  2. require approval workflow (where feasible) and use time-bound access; and
  3. make relevant access records available to the Customer upon reasonable request, subject to confidentiality obligations and security limitations.
Data Protection Officer and Contact Points
1. The contact point for data protection matters of the Customer is as set out in the AdvaPACS Terms of Service.
2. AdvaHealth will maintain a contact point for data protection matters with the following details:
  1. AdvaHealth contact:
    1. Chief Information Security Officer
    2. ciso@adva.health
Indemnity; Limitation and Exclusion of Liability
1. AdvaHealth will indemnify the Customer for direct losses, damages, fines, penalties, and reasonable costs in connection with or arising from a breach of this DPA or violation of any Applicable Law to the extent caused by AdvaHealth’s wilful misconduct or negligence, subject to the limitations and exclusions in the Agreement, except that nothing limits liability for fraud or wilful misconduct.
2. The Customer will indemnify AdvaHealth for losses arising from the Customer’s unlawful instructions or the Customer’s breach of Applicable Law, subject to the limitations and exclusions in the Agreement.
3. To the extent permitted by law, in no event will AdvaHealth, its related companies or any of its officers, directors, employees, agents or third party service providers (including Subprocessors), shall be liable for any indirect, incidental, consequential, special, exemplary, punitive, actual, or other indirect damages, including loss of revenue or income, pain and suffering, emotional distress, or similar damages even if AdvaHealth has been advised of the possibility of such claims or damages, arising out of any matters or claims you may raise relating to the Application and/or provision of and/or use of the Services) including but not limited to with respect to bodily injury, physical harm, loss, illness, death or property damage.
4. In no event will the collective liability of AdvaHealth, its related companies or any of its officers, directors, employees, agents or third party service providers (including Subprocessors), exceed the greater of SGD 100 or the amount you paid to AdvaHealth, if any, for the applicable Service out of which the liability arose. If any of the limitations contained herein are contrary to applicable law (such as, consequential, or incidental damages), AdvaHealth’s liability shall be limited to the fullest extent allowed under applicable law.
Term; Survival
1. This DPA begins on the Effective Date and continues until the termination or expiry of the Agreement.
2. Unless otherwise agreed in writing by the Parties, Clauses 7 (Confidentiality and Personnel Obligations), 8 (Security Measures), 11 (Cross-Border Transfers), 12 (Retention and Deletion of Personal Data), 14 (Data Breach and Security Incident Management), 15 (Audit and Cooperation), 18 (Indemnity; Limitation and Exclusion of Liability), 22 (Governing Law and Dispute Resolution) shall survive the termination or expiry of the Agreement.
Costs
1. Each Party remains responsible for its own compliance with the Applicable Law and this DPA at its own cost.
Amendments
1. AdvaHealth may amend this DPA from time to time to comply with any changes in Applicable Law, PDPC guidance, MOH guidance, or material changes to the Application and any service offerings to the Customer.
2. The Customer agrees to any amendments to this DPA as a condition to the continued provision of the Application and Services by AdvaHealth.
Governing Law and Dispute Resolution
1. This DPA is governed by the laws of Singapore, without regard to any conflict of laws provisions.
2. The Parties submit to the exclusive jurisdiction of the courts of Singapore, unless the Agreement provides a different dispute resolution mechanism, in which case that mechanism applies.

By clicking “CONFIRM”, “SUBMIT”, “I AGREE”, “I ACCEPT” or such similar links, it constitutes the Customer’s agreement and intention to be bound by this DPA. You hereby waive any rights or requirements under any applicable laws in any jurisdiction which require an original signature or delivery other than electronic means.

Annex A – Canada Addendum

This Canada Addendum (“Canada Addendum”) to the DPA is intended to describe AdvaHealth’s practices and Customer’s rights under Canadian privacy and data protection legislation. To the extent Customer (or its clinicians, registered patients and/or authorised proxy of a registered patient) is resident in Canada, this Canada Addendum shall supplement and modify the DPA.

DEFINITIONS AND INTERPRETATION
1. “Applicable Law” shall include: (i) the Personal Information Protection and Electronic Documents Act (Canada), the Personal Health Information Protection Act (Ontario) (“PHIPA”) and provincial privacy legislation; and (ii) any guidelines or decisions published by the Privacy Commissioner of Canada or any equivalent provincial data protection authority (collectively, “Canadian Law”).
2. “Personal Data” shall mean information about an identifiable individual and includes “Personal Health Information” as defined in the PHIPA.
3. “Processing” and “process” in relation to Personal Data shall include the following: (i) collecting, (ii) using and (iii) disclosing.
OBLIGATIONS UNDER APPLICABLE LAW
1. Nothing in the DPA is intended to limit or otherwise modify either Party’s obligations under Canadian Law. To the extent of any conflict between the terms and conditions of the DPA and Canadian Law as it applies to the relationship between the Parties, Canadian Law shall prevail and the terms and conditions of the DPA shall be deemed amended accordingly.
2. All references in sections 13.1 and 14.1(d) of the DPA to the PDPA shall be deemed struck and replaced with the applicable Canadian Law.
3. All references in section 21.1 to PDPC and MOH guidance shall be deemed struck and replaced with guidance of the Privacy Commissioner of Canada or any equivalent provincial data protection authority.
ROLES OF THE PARTIES
1. For the purpose of the DPA and the Agreement, AdvaHealth shall process Personal Data on behalf of Customer as a third-party service provider. The Customer shall remain accountable for the Personal Data transferred to AdvaHealth for Processing and shall determine the purposes and means of Processing such Personal Data.
CROSS-BORDER TRANSFERS
1. References within the DPA to Personal Data transfers to locations outside Singapore shall not apply.
2. Customer acknowledges and agrees that AdvaHealth may transfer Personal Data to a jurisdiction outside Canada, including but not limited to, Singapore.
Audit and Cooperation
1. Notwithstanding anything to the contrary in the DPA, AdvaHealth shall provide Customer, upon reasonable advance notice and legal grounds, with reasonable access to the records and information on AdvaHealth for the purposes of Customer fulfilling its legally obligated audit requirements to verify AdvaHealth’s compliance with the DPA.
GOVERNING LAW
1. To the extent required by Canadian Law, the governing law shall be the laws of the jurisdiction of incorporation or formation of the Customer.

Annex B – Australia Addendum

CONTEXT
1. This Australia Addendum (the “Australia Addendum”) sets out additional, jurisdiction-specific data protection terms for Australia that supplement the terms otherwise set out in the DPA.
2. This Australia Addendum applies to the extent that AdvaHealth processes Personal Data on behalf of the Customer that is collected in Australia, relates to individuals located in Australia, is processed in Australia or otherwise gives rise to obligations under the Australian Data Protection Laws.
DEFINITIONS
1. Capitalised terms not defined in this Australia Addendum have the meanings given in the Agreement. The following definitions apply for the purposes of this Australia Addendum:
  
  “Australian Data Protection Laws” means the:
  1. Privacy Act 1988 (Cth);
  2. Health Records and Information Privacy Act 2002;
  3. Health Records Act 2001; and
  4. Health Records (Privacy and Access) Act 1997.
    
    “Eligible Data Breach” means an unauthorised access to, unauthorised disclosure of or loss of Personal Information, where a reasonable person would conclude that any of the individuals to whom the information relates is likely to suffer serious harm, as defined in the Privacy Act 1988 (Cth), or other applicable Australian Data Protection Laws.
    
    “Personal Data” includes personal information as defined in the Australian Data Protection Laws.
APPLICABLE LAW
1. For the purposes of the DPA, “Applicable Law” includes the Australian Data Protection Laws.
ELIGIBLE DATA BREACHES
1. AdvaHealth will reasonably cooperate with the Customer to support the Customer’s assessment of whether the incident is an Eligible Data Breach and, if relevant, the Customer’s notification obligations to the Office of the Australian Information Commissioner and affected individuals, including providing information reasonably requested by the Customer for such notifications.
2. Without prejudice to Clause 14 of the DPA or 4.1 of this Addendum, in the case if an Eligible Data Breach affecting Personal Data, each Party is responsible for complying with its own statutory obligations to notify the Office of the Australian Information Commissioner and affected individuals.
CROSS BORDER TRANSFERS
1. Clause 15 of the DPA applies where AdvaHealth transfers Personal Data outside of Australia or, in the case where Personal Data is collected in each of New South Wales, the Australian Capital Territory or Victoria, outside of each of those respective states.
Assistance with Individuals’ Requests
1. Taking into account the nature of the Processing, and to the extent reasonably practicable and within the functionality of the Application, AdvaHealth will provide reasonable assistance to the Customer to respond to individuals’ requests under the Australian Data Protection Laws (e.g., access and correction requests), in respect of Personal Data processed by AdvaHealth on the Customer’s behalf and at the Customer’s expense.

Annex C – Malaysia Addendum

This Malaysia Data Protection Addendum (“Malaysia Addendum”) forms part of and supplements the DPA between AdvaHealth and the Customer.

Where Personal Data is processed in Malaysia, this Malaysia Addendum shall apply and prevail in respect of Malaysian data protection matters in the event of any inconsistency with the DPA.

Unless otherwise indicated, all terms used in this Malaysia Addendum shall have the same meaning as in the DPA.

APPLICATION OF MALAYSIAN DATA PROTECTION LAW
1. For purposes of this Malaysia Addendum:
  1. the Customer shall be the “Data Controller”; and
  2. AdvaHealth shall be the “Data Processor”,
    
    as those terms are defined under the Personal Data Protection Act 2010 of Malaysia (“Malaysia PDPA”). The term “Malaysia PDPA” shall include regulations made under it, guidelines, circulars, directives or decisions by any appropriate authority.
2. For the purposes of this Malaysia Addendum, “Personal Data” shall, in addition to the meaning ascribed to it in the DPA, include the meaning as defined in the Malaysia PDPA and “sensitive personal data” as defined in the Malaysia PDPA.
3. For the purposes of this Malaysia Addendum, “processing” or “process” in relation to Personal Data means collecting, recording, holding or storing the Personal Data, or carrying out any operation or set of operations on the Personal Data, including:
  1. the organisation, adaptation or alteration of Personal Data;
  2. the retrieval, consultation or use of Personal Data;
  3. the disclosure of Personal Data by transmission, transfer, dissemination or otherwise making available; or
  4. the alignment, combination, correction, erasure or destruction of Personal Data.
4. The Parties acknowledge and agree that the processing of Personal Data in Malaysia shall comply with:
  1. the Malaysia PDPA;
  2. all applicable legislations, regulations, guidelines, and codes of practice issued by the Malaysian regulatory bodies; and
  3. appropriate data protection and healthcare information security practices applicable in Malaysia.
5. Nothing in this Malaysia Addendum limits the Customer’s primary responsibility as a Data Controller including to ensure lawful collection, use, disclosure and consent under Malaysian law.
SCOPE OF PROCESSING IN MALAYSIA
1. AdvaHealth shall process Malaysian Personal Data solely:
  1. for purposes related to providing, maintaining, securing and supporting the Application and Services;
  2. in accordance with the Customer’s written instructions; and
  3. as required by applicable law.
2. AdvaHealth shall not process Malaysian Personal Data for any purposes other than those set out in Clause 2.1.
SECURITY MEASURES
1. Each Party shall implement reasonable and appropriate security measures to protect the Personal Data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction.
DATA BREACH NOTIFICATION
1. AdvaHealth shall notify the Customer as soon as reasonably practicable upon becoming aware of any actual or suspected Personal Data breach affecting Malaysian Personal Data.
  
  For purposes of this Clause 4, a Personal Data breach includes any breach, loss, misuse or unauthorized access, disclosure, alteration or destruction of Personal Data.
2. Upon receiving notification from AdvaHealth, the Customer shall assess whether the Personal Data breach meets the notification requirements under applicable Malaysian law and shall notify the relevant Malaysian regulatory authority where required in accordance with the applicable Malaysian law.
3. Where the Personal Data breach causes or is likely to cause significant harm to the data subject, the Customer shall notify the affected data subjects without unnecessary delay and in accordance with the applicable Malaysian law.
4. For the purposes of Clause 4.3, a Personal Data breach may be considered likely to cause significant harm where the compromised Personal Data:
  1. may result in physical harm, financial loss, a negative effect on credit records, or damage to or loss of property;
  2. may be misused for unlawful or illegal purposes;
  3. consists of sensitive personal data; or
  4. consists of Personal Data which, whether alone or in combination with other information, could potentially enable identity fraud or identity theft.
5. The notification shall include available information on:
  1. details of the Personal Data breach;
  2. potential consequences arising from the breach;
  3. chronology of events leading to the Personal Data breach;
  4. remedial actions taken or planned to address the Personal Data breach;
  5. remedial actions taken or planned to address the affected data subjects; and
  6. contact details of the data protection officer or any other relevant contact person from whom further information on the personal data breach may be obtained.
DATA PROTECTION OFFICER
1. Each Party shall assess whether it is required to appoint one or more Data Protection Officer(s) in accordance with the Malaysia PDPA and any applicable regulations or guidelines issued by the relevant Malaysian regulatory authority.
2. Where required under applicable Malaysian law or regulatory guidance, each Party shall:
  1. appoint one or more Data Protection Officer(s) responsible for overseeing compliance with the Malaysia PDPA; and
  2. ensure such appointment is made and notified to the relevant authority within the prescribed timeframe.
3. Each Party shall ensure that its appointed Data Protection Officer is reasonably accessible for matters relating to Malaysian Personal Data and shall provide contact details for such Data Protection Officer upon reasonable request by the other Party.
4. For the avoidance of doubt, the appointment of a Data Protection Officer does not relieve either Party of its respective obligations under the Malaysia PDPA.
CROSS BORDER TRANSFERS OUTSIDE MALAYSIA
1. The Parties shall ensure that any Malaysian Personal Data shall only be transferred to any place outside Malaysia if:
  1. there is in that place in force any law which is substantially similar to the Malaysia PDPA;
  2. the data subject has given his consent to the transfer; or
  3. any other permitted condition for transfer under the Malaysia PDPA or applicable law applies.
DATA SUBJECT RIGHTS
1. AdvaHealth shall provide reasonable assistance to the Customer to respond to individuals’ requests under the Malaysia PDPA in respect of Personal Data processed by AdvaHealth as the Data Processor.
RETENTION AND DELETION OF PERSONAL DATA
1. Malaysian Personal Data shall not be retained longer than is necessary for the fulfilment of the purposes for which it was processed.
2. AdvaHealth shall retain Malaysian Personal Data only for the duration instructed by the Customer and in accordance with applicable Malaysian law.
3. The Customer shall take all reasonable steps to ensure that Malaysian Personal Data is destroyed or permanently deleted where such Personal Data is no longer required for the purposes for which it was processed, in accordance with applicable Malaysian law.
LIABILITY
1. Each Party remains responsible for:
  1. its respective compliance obligations under applicable Malaysian law; and
  2. any breaches arising from its own acts, omissions or unlawful instructions relating to the processing of Malaysian Personal Data.
2. The provisions relating to limitation and exclusion of liability under the DPA shall apply equally to this Malaysia Addendum.
GOVERNING LAW
1. This Malaysia Addendum is intended to supplement the DPA for purposes of ensuring compliance with applicable Malaysian data protection laws, including the Malaysia PDPA.
2. Except as expressly provided in this Malaysia Addendum, all terms of the DPA shall remain in full force and effect. In the event of any inconsistency between this Malaysia Addendum and the DPA in respect of Malaysian Personal Data, this Malaysia Addendum shall prevail to the extent of such inconsistency.
3. The governing law and dispute resolution provisions set out in the DPA shall apply equally to this Malaysia Addendum.

Annex D – Philippine Addendum

(Data Outsourcing Agreement)

BACKGROUND AND PURPOSE
1. Recognizing that the DPA may involve Processing falling under the Addendum Scope (as defined below), the Parties hereby enter into this Philippine Addendum (the “Philippine Addendum”), which forms part of and supplements the DPA.
ADDENDUM SCOPE AND APPLICABLE LAW
1. This Philippine Addendum shall govern all Processing of Personal Data conducted within or outside the Philippines where such Processing relates to Personal Data of Philippine citizens or residents, or where the relevant entity maintains sufficient links with the Philippines, including but not limited to entering into contracts in the Philippines, exercising central management and control within the Philippines, maintaining a branch, agency, office, or subsidiary in the Philippines, carrying on business in the Philippines, or collecting or holding Personal Data in the Philippines (“Addendum Scope”).
2. The Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (“IRR”), issuances of the National Privacy Commission (“NPC”), and other applicable Philippine data protection regulations (collectively, the “Philippine Data Privacy Laws”) shall be deemed incorporated herein by reference and form an integral part of this Philippine Addendum as if fully set forth herein.
3. Accordingly, the DPA shall apply to Processing under the Addendum Scope only to the extent that its provisions are not inconsistent with Philippine Data Privacy Laws, as may be applicable under their territorial or extraterritorial scope. In the event of any inconsistency, conflict, or ambiguity between the DPA and this Philippine Addendum, or between the DPA and the Philippine Data Privacy Laws, the provisions of this Philippine Addendum shall prevail, subject to the provisions of Philippine Data Privacy Laws.
4. Except as expressly modified by this Philippine Addendum, all terms and conditions of the DPA shall remain in full force and effect.
DEFINITIONS
1. Terms defined under the Philippine Data Privacy Act of 2012, its IRR, issuances of the NPC, and Philippine Data Privacy Laws shall have the meanings ascribed to them under such laws.
2. Capitalized terms not defined in this Philippine Addendum or under Philippine Data Privacy Laws shall have the meanings given in the DPA.
3. In the event of any ambiguity in interpretation, terms used in this Philippine Addendum shall be construed in a manner consistent with Philippine Data Privacy Laws and prevailing NPC guidance.
ROLES AND RELATIONSHIP OF THE PARTIES
1. For purposes of this Philippine Addendum and the processing activities falling under the Addendum Scope, the Parties agree that such activities constitute a Data Outsourcing Agreement, wherein the Customer acts as the Personal Information Controller (“PIC”) and the Company acts as the Personal Information Processor (“PIP”).
DESCRIPTION OF PROCESSING
1. The nature, purpose, and location of the processing are specified under Section 4 of the DPA, while the categories of data subjects and the types of personal data processed are specified under Section 2 of the PIP’s Data Protection Notice.
2. The PIC shall ensure that data subjects are made aware that the specific data processing activities are outsourced to the PIP, and such outsourcing shall be reflected in the PIC’s privacy notice, pursuant to relevant NPC issuances.
OBLIGATIONS OF THE PIP
1. The PIP shall assist the PIC in ensuring compliance with Philippine Data Privacy Laws, taking into account the nature of the processing and the information available to the Parties.
2. In relation to the PIP’s obligation under Section 8 of the DPA to implement appropriate technical and organizational measures to protect Personal Data, such security measures to be implemented shall be aligned with the best practices set out under Philippine Data Privacy Laws, along with directives issued by the Philippine Department of Information and Communications Technology (“DICT“), including its Cybersecurity Bureau and the National Computer Emergency Response Team (“CERT-PH”).
3. In relation to the breach reporting obligations set forth under Section 14 of the DPA, if a personal data breach (1) involves personal data processed by the PIP or its sub-processor(s) falls under the Addendum Scope, and (2) involves sensitive personal information or information that may, under the circumstances, be used to enable identity fraud, are reasonably believed to have been acquired by an unauthorised person, and the PIC or the NPC believes that such unauthorised acquisition is likely to give rise to a real risk of serious harm to any affected data subject:
  1. The PIP shall take appropriate measures to address the breach, including measures to mitigate its adverse effects on PIC and data subjects.
  2. The PIP shall notify the PIC in writing of the personal data breach within twenty-four (24) hours upon knowledge of or reasonable belief that a personal data breach subject to mandatory breach reporting under pertinent laws and regulations has occurred.
  3. The notification of PIP shall include such information and details that shall allow PIC to make a proper notification to the NPC, other relevant data protection authorities or government agencies, and data subjects. Such information and details shall include, but is not limited to:
    1. a description of the nature of the breach, which shall include a description of how the breach occurred, the timeline of events leading to the breach, the approximate number of data subjects or records involved, a description of the likely consequences of the personal data breach, and the name and contact details of designated point persons who PIC may contact regarding the breach;
    2. a description of the personal data involved or possibly involved in the breach, which shall include a description of sensitive personal information involved and a description of other personal data that may be used to enable identity fraud; and
    3. a description of the measures to address the breach, which shall include actions being taken to secure or recover compromised personal data, actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident, and measures being taken to prevent a recurrence of the security incident or breach.
4. With reference to the Retention and Deletion of Personal Data set forth in Section 12 of the DPA, the PIP shall maintain and implement policies governing the secure storage and disposal of Personal Data processed under this Agreement.
5. Such policy should ensure that Personal Data are stored in secure systems protected by appropriate administrative, technical, and organisational safeguards designed to prevent unauthorised access, use, disclosure, alteration, or destruction.
6. Consistent with Section 12.1 of the DPA, Personal Data is retained only for as long as reasonably necessary to fulfil the purposes of the Services or to comply with legal, regulatory, or compliance obligations.
7. With reference to Section 7 (Confidentiality and Personnel Obligations) and Section 8 (Security Measures) of the DPA, the PIP shall maintain an appropriate data management process to ensure the proper handling and control of Personal Data throughout its entire lifecycle.
8. Such process shall include mechanisms for tracking and monitoring records, including the use of audit logs, timestamps, or similar system records where applicable, identifying the types of Personal Data sent or received through the Services, and ensuring that access to records is restricted to authorised personnel on a need-to-know basis in accordance with Section 6.4 of the DPA.
9. With reference to Section 8 (Security Measures) of the DPA, the PIP represents that it maintains a privacy and security program designed to protect Personal Data processed under this Agreement against unauthorised access, disclosure, alteration and destruction.
10. With reference to Sections 9 (Data Accuracy and Correction), 12 (Retention and Deletion of Personal Data) and 15 (Audit and Cooperation) of the DPA, the PIP shall ensure that the Services provide mechanisms that allow the PIC to view, monitor, and reconcile Personal Data processed through the Application. Such mechanisms may include system records, audit logs, data exports, or other system-generated outputs that allow the PIC to review relevant data records and processing activities. These outputs may be made available through the Application or in commonly used electronic formats, as may be appropriate to the Services.
11. The PIP shall assign personnel responsible for ensuring compliance with applicable data protection obligations and the requirements of the DPA and this Philippine Addendum. Such personnel shall be given sufficient authority and an appropriate allocation of time and resources necessary to carry out their duties relating to the protection of Personal Data.
12. With reference to Sections 14 (Data Breach and Security Incident Management) and 15 (Audit and Cooperation) of the DPA, the PIP shall promptly inform the PIC of any material control deficiencies, vulnerabilities, or security issues affecting the processing of Personal Data that are identified through internal reviews, audits, or other sources. The PIP shall cooperate with the PIC in addressing and resolving such issues.
AMENDMENT
1. With reference to Section 21 (Amendments) of this DPA, this Philippine Addendum may not be changed or altered unless in writing and duly signed by an authorised representative of each of the Parties.
GOVERNING LAW AND DISPUTE RESOLUTION
1. Notwithstanding any conflicts-of-law provisions under the Agreement or the DPA, this Philippine Addendum and processing falling under the Addendum Scope shall be governed by and construed in accordance with the laws of the Republic of the Philippines.
2. In the event of any a conflict arising from this Philippine Addendum and/or processing falling under the Addendum Scope, the Parties submit to the exclusive jurisdiction of the applicable courts of the Republic of the Philippines, and, where applicable, to the adjudicatory authority of the NPC.

Annex E – US Addendum

CONTEXT
1. This United States Addendum (the “US Addendum”) sets out additional, jurisdiction-specific data protection terms for United States that supplement the terms otherwise set out in the DPA.
2. This US Addendum applies to the extent that AdvaHealth processes Personal Data on behalf of the Customer that is collected in the US, relates to individuals located in the US, is processed in US or otherwise gives rise to obligations under the Applicable US Laws.
DEFINITIONS
1. Unless expressly stated otherwise in this US Addendum, capitalised terms not defined in this US Addendum have the meanings given in the Agreement.
2. Where the same term is defined differently in the BAA and the DPA, the definition applicable to the category of data at issue and the governing law for such data shall control. For purposes of PHI, subject to HIPAA, capitalized terms such as “Security Incident,” “Breach,” and “Unsecured PHI” shall have the meanings set forth in the BAA. For purposes of Personal Data that is not PHI, such terms shall have the meanings set forth in the DPA and any applicable jurisdiction-specific addendum.
3. The following definitions apply for the purposes of this US Addendum:
  
  “Applicable US Laws” means the:
  1. the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the HITECH Act, and implementing regulations at 45 C.F.R. Parts 160 and 164; and
  2. New York’s Stop Hacks and Improve Electronic Data Security Act (“SHIELDS Act”);
  3. applicable state data breach notification laws; and
  4. any other US federal or New York state data protection, cybersecurity, or health information privacy law applicable to the processing of Personal Data.
    
    “Business Associate” has the meaning ascribed to it in the Business Associate Agreement.
    
    “Covered Entity” has the meaning ascribed to it in the Business Associate Agreement.
    
    “HIPAA” includes the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule.
    
    “Protected Health Information” or “Protected Health Information” or “PHI” has the meaning given to such term at 45 C.F.R. § 160.103, limited to the information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity, or created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity in performing its obligations under the Underlying Agreement.
    
    “Business Associate Agreement” or “BAA” means any HIPAA-required business associate agreement entered into between the Parties in connection with the Services.
    
    “Underlying Agreement” has the meaning ascribed to it in the Business Associate Agreement.
Relationship to HIPAA and Business Associate Agreement
1. To the extent AdvaHealth processes PHI on behalf of the Customer and HIPAA applies:
  1. the Parties acknowledge that AdvaHealth acts as a Business Associate and the Customer acts as a Covered Entity (or Business Associate, as applicable);
  2. the Parties agree that the BAA governs HIPAA-specific requirements, including, but not limited to, permitted uses and disclosures of PHI, safeguards, breach notification, subcontractor obligations, and amendments; and
  3. this US Addendum supplements the BAA solely to the extent a matter is not expressly addressed in the BAA. In the event of any inconsistency between the US Addendum and the BAA, the provisions in the BAA will prevail.
2. Nothing in this US Addendum shall be construed to limit or reduce AdvaHealth’s obligations under the BAA.
3. To the extent not already governed by the BAA, AdvaHealth shall not:
  1. sell Personal Data;
  2. use Personal Data for targeted advertising or marketing; or
  3. retain, use, or disclose Personal Data except as permitted under the DPA, the BAA, this US Addendum, or Applicable US Laws.
US Data Security Requirements
1. To the extent not already required under the BAA, AdvaHealth shall, to the extent it owns or licenses New York residents’ private information develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data, including measures sufficient to meet the requirements of the SHIELDS Act, where applicable.
2. To the extent a Security Incident involves Personal Data that is not PHI (and therefore is not subject to the BAA’s breach provisions):
  1. AdvaHealth shall notify the Customer without unreasonable delay after becoming aware of such incident;
  2. AdvaHealth’s notification shall include information reasonably necessary for the Customer to determine its obligations under applicable U.S. state breach notification laws; and
  3. AdvaHealth shall reasonably cooperate with the Customer in any required regulatory notifications or remediation efforts.
No Expansion of Obligations
1. Definitions included in the BAA are intended solely to satisfy HIPAA requirements and shall not be construed to expand AdvaHealth’s notification or remediation obligations with respect to Personal Data that is not PHI, except as expressly required under the DPA or US Applicable Laws.