APPENDIX 1: DATA PROCESSING ADDENDUM

This Data Processing Addendum (the “DPA”) forms Appendix 1 to, and is an integral part of, the Website Terms of Use (the “Agreement”).

BETWEEN:

“VIVIAN LAB SINGLE MEMBER P.C.”, with headquarters in Athens, street 47 SAMOU STR, with no. G.E.MI. 179795401000, Tax NUMBER 802625789, Tax office AMAROUSION (the “Company” or “VivianLab”)
AND
The Professional - Provider - User (the “Provider” or “Client”), who has accepted the Agreement.

(each a “party” and together the “parties”).

BACKGROUND:

(A) The Client has accepted the Agreement for the supply by the Company of intermediary services via the Platform (the “Services”).
(B) This DPA forms part of the Agreement to reflect the parties’ agreement with regard to the processing of Personal Data, in accordance with the requirements of the Data Protection Legislation.
(C) In the course of providing the Services to the Client pursuant to the Agreement, the Company will Process Personal Data on behalf of the Client . The Client acts as the Data Controller and the Company acts as the Data Processor .
(D) The types of Personal Data and categories of Data Subjects Processed by the Company, when acting as a Processor, under this DPA are further specified in Schedule 1 to this DPA.

AGREED TERMS:

1. Interpretation

1.1 The following definitions and rules of interpretation apply in this DPA.

“Affiliate” means any entity which directly or indirectly Controls, is Controlled by, or is under direct or indirect common Control with, that body corporate from time to time.
“Business Contact Data” means Personal Data that contains professional contact details of each party’s personnel.
“Client Data” means Personal Data Processed in connection with the Services that is:
(a) made available or provided by Client (or a third party on Client’s behalf) to Company or to a third party, or
(b) collected by Company or a third party on Client’s behalf.
“Control” means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of another entity (whether through the ownership of voting shares, by contract or otherwise), the terms “Controls” and “Controlled” being construed accordingly.
“Data Controller”, “Data Processor”, “Data Subject”, “Processing”, “Process” and “Processed” each have the meaning set out in the Data Protection Legislation.
“Data Protection Legislation” means Regulation (EU) 2016/679 (the “GDPR”) and any national legislation related to data protection ; as amended or replaced from time to time.
“European Commission’s Standard Contractual Clauses” means an agreement setting out the clauses contained within the standard agreement approved by the European Commission for transfer of Personal Data outside the EEA under the European Commission decision of 4 June 2021.
“Personal Data” has the meaning set out in the Data Protection Legislation and relates only to Personal Data, or any part of such Personal Data:
(a) supplied to the Company by or on behalf of the Client; and/or
(b) obtained by, or created by, the Company on behalf of the Client in the course of delivery of the Services, and for which, in each case, the Client is the Data Controller and the Personal Data is Processed by the Company in the performance of the Services.
“Regulator” means the national data protection authority under Data Protection Legislation.
“Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
“Sub-Processor” means a Data Processor contracted by Company to Process Client Data in relation to the Services provided directly by Company.
“Technical and Organisational Measures” means the technical and organisational measures considered by the parties as per Article 32 of the GDPR.

1.2 The Schedules form part of this DPA and shall have effect as if set out in full in the body of this DPA.
1.3 In the case of conflict or ambiguity between any of the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail.

2. PROCESSING OF PERSONAL DATA

2.1 Roles of the Parties
(a) The parties acknowledge and agree that with regard to the Processing of Personal Data, the Client (Provider) is the Data Controller, the Company (VivianLab) is a Data Processor and that the Company will engage any Sub-Processors in accordance with the requirements set out in clause 4 below .

2.2 Client’s Processing of Personal Data
(a) The Client shall Process Personal Data in connection with the Services in accordance with the requirements of Data Protection Legislation.
(b) The Client’s instructions for the Processing of Personal Data shall comply with Data Protection Legislation.
(c) The Client shall have sole responsibility for the accuracy, quality, and legality of Client Data and the means by which the Client acquired Personal Data.
(d) The Client warrants and undertakes that:
(i) its disclosure of Personal Data to the Company is limited to what is necessary in order for the Company to perform the Services;
(ii) such Personal Data is accurate and up-to-date at the time that it is provided to the Company; and
(iii) it relies and will continue to rely on a legal basis for the Processing (including obtaining any necessary valid consents, particularly for Special Categories of Personal Data as defined in Schedule 1), has conducted legitimate interest assessments where required, and will maintain information notices required to enable the Company to lawfully Process Personal Data for the duration and purposes of the Services.

2.3 Company Processing of Personal Data
(a) The Company shall Process Personal Data in connection with the Services in accordance with the requirements of the Data Protection Legislation and only as specified in the Client’s written instruction (which includes the Agreement and use of the Services).
(b) The Company is instructed to Process Personal Data for the purposes specified in Schedule 1.
(c) If the Company reasonably believes the instructions provided by the Client in relation to the Processing contravene Data Protection Legislation, the Company shall notify the Client.
(d) The Company shall ensure that any persons authorised by it to process Personal Data pursuant to this DPA are contractually bound to maintain the confidentiality of, and shall not disclose Personal Data to, any third parties without the Client’s prior consent, except as required by law or permitted by the Agreement.

3. RIGHTS OF DATA SUBJECTS

3.1 Correction, Blocking and Deletion
(a) The Company shall, to the extent permitted by law, notify the Client upon receipt of any complaint or request relating to the Client’s obligations under Data Protection Legislation or Personal Data.
(b) The Company shall, at the Client’s cost, comply with any commercially reasonable written instructions from the Client to facilitate any actions required.

3.2 Data Subject Requests
(a) The Company shall, to the extent permitted by law, promptly notify the Client if it receives a request from a Data Subject for access to, correction, amendment, restriction or deletion of that person’s Personal Data.
(b) The Company shall not respond to any such Data Subject request without the Client’s prior written consent, to the extent legally permitted, except to confirm that the request relates and has been passed to the Client.
(c) The Company shall provide the Client with commercially reasonable cooperation and assistance in relation to handling of a Data Subject’s request, within agreed timelines, to the extent permitted by law, and to the extent the Client does not have access to or the ability to correct, amend, restrict or delete such Personal Data itself.
(d) The Client shall be responsible for any reasonable and documented costs arising from the Company’s provision of such assistance.

4. SUB-PROCESSORS

4.1 Appointment of Sub-Processors
(a) The Client acknowledges and agrees that the Company may engage third-party Sub-Processors in connection with the provision of the Services. The Company’s current Sub-Processors are listed in its Privacy Policy and/or will be made available to the Client on request.
(b) The Company shall require all Sub-Processors to agree in writing to process Personal Data on terms no less onerous than the provisions set out in this DPA .

4.2 Sub-Processor Liability
(a) The Company shall be liable for the acts and omissions of its Sub-Processors in relation to the Processing of Personal Data to the same extent the Company would be liable if the Company itself performed such acts and omissions.

5. SECURITY AND BREACH NOTIFICATION

The Company shall cooperate, on request, with any competent supervisory authority or regulatory body in the performance of its tasks, including by providing all necessary information and assistance as required under applicable Data Protection Legislation, including Article 31 of the GDPR.
The Company shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, including, where appropriate, measures such as pseudonymisation and encryption, access controls, backup and recovery procedures, and regular security testing.
In the event of a Security Breach affecting Client Data, the Company shall notify the Client without undue delay after becoming aware of it and shall provide the Client with all information reasonably required to enable the Client to comply with its obligations under Articles 33 and 34 GDPR.

6. NOTICES

6.1 The Company shall promptly notify the Client of any lawful request the Company receives for disclosure of Personal Data by any Regulator, law enforcement or other government authority, unless prohibited from doing so by law.

7. RETURN AND DELETION OF CLIENT DATA

7.1 Upon termination or expiration of the Services, or at the written request of the Client, the Company shall (at the Client’s selection), delete or return all Personal Data, save as necessary to keep it for compliance with legal or regulatory purposes.
7.2 If the Client chooses deletion, the Company shall delete the Personal Data as soon as reasonably practicable and without undue delay after termination or expiration of the Services, unless retention is required by law.
7.3 The parties agree that a certification of deletion of Personal Data shall be provided by the Company to the Client only upon the Client’s request.

8. AUDITS AND ASSISTANCE

8.1 Upon the Client’s reasonable request, the Company shall make available to the Client all information necessary to demonstrate the Company’s compliance with the obligations set forth in this DPA.
8.2 The Client shall have the right to audit the Company’s compliance, provided that:
(a) audit requests shall be provided in writing and no more frequently than once in any 12-month period;
(b) audits must be conducted during regular business hours and may not unreasonably interfere with the Company’s business activities;
(c) to request an audit, the Client must submit a detailed audit plan at least six (6) weeks in advance; and
(d) all audits are at the Client’s sole cost and expense.
8.3 The Company shall, at the Client’s cost and only upon the Client’s specific written request, provide the Client with such assistance and information as may be reasonably required in order for the Client to comply with any obligation to carry out a data protection impact assessment or to consult with a Regulator. For the avoidance of doubt, the Company shall have no obligation to proactively identify or initiate a data protection impact assessment on behalf of the Client.

9. DATA TRANSFERS OUTSIDE OF THE EEA

9.1 The Company shall not process, store or transfer Personal Data outside of the European Economic Area (“EEA”) without prior written authorisation from the Client, except where such transfer is made to a Sub-Processor and is subject to a valid lawful transfer mechanism (such as, but not limited to, the European Commission’s Standard Contractual Clauses) .
9.2 The Client provides general authorisation for transfers to Sub-Processors outside the EEA, as detailed in Schedule 1, provided a valid transfer mechanism is in place.

10. LIABILITY AND INDEMNITY

10.1 The parties agree that the provisions of this DPA will not be subject to the limitations and exclusions of liability and other terms of the Agreement applicable to the Services in question.
10.2 Subject to clause 10.1, neither party will be liable under this DPA for any loss of actual or anticipated income or profits, loss of contracts or for any special, indirect or consequential loss or damage of any kind.
10.3 Subject to clause 10.1, the total aggregate liability of the Company towards the Provider arising out of or in connection with this DPA — regardless of the legal basis (contract, tort, breach of statutory duty, indemnity or any other cause) — shall in no event exceed the total amount of three thousand euros (€3,000).
10.4 The Company shall indemnify and hold harmless the Client against all losses, damages, or fines which may be incurred by the Client as a result of any claim or Regulator action brought against the Client directly arising out of any breach by the Company of this DPA.
10.5 The Client shall indemnify and hold harmless the Company against all losses, damages, or fines which may be incurred by the Company as the result of any claim or Regulator action brought against the Company directly arising out of or in connection with:
(a) the Company complying with the Client’s instructions regarding Personal Data Processing; or
(b) The Client breaching its obligations as Controller under Data Protection Legislation .
10.6 The limitations and exclusions of liability set out in this Article 10 apply to all claims, including indemnity claims, except where and to the extent that such limitation is expressly prohibited by mandatory provisions of law.

11. LEGAL EFFECT

11.1 This DPA shall become legally binding between the Client and the Company as of the date the Agreement has been executed.
11.2 The provisions of this DPA shall survive the term of the Agreement until the Company has returned or deleted all Personal Data in accordance with clause 7.

12. GENERAL

12.1 This DPA, together with the Agreement into which it is incorporated, constitutes the entire agreement between the parties relating to its subject matter.
12.2 This DPA and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the law set out in the Agreement (Greek Law).
12.3 Each party irrevocably agrees that the courts set out in the Agreement (Courts of Athens) shall have jurisdiction to settle any dispute or claim arising out of or in connection with this DPA.

SCHEDULE 1 – Description of the Processing of Personal Data

Subject Matter: The provision of intermediary Services to the Client (Provider) by the Company in accordance with the Agreement, enabling the Client to manage appointments and consultations with its own Users via the VivianLab Platform .

Nature: The collection, storage, retrieval, and management of User data on behalf of the Client (Provider) to facilitate the scheduling of services (including via Google Calendar integration), processing of payments, and to provide the technical means for communication and consultation between the User and the Client (Provider).

Purpose: The performance of the Agreement , enabling the Client (Provider) to find, schedule, manage, and deliver professional services to Data Subjects (Users).

Categories of Personal Data (concerning Data Subjects):
User Identity & Contact Data: Name, Surname, Email address, phone number.
Appointment & Service Data: Appointment details (date, time, status), data from Google Calendar events (if integration is used by the User) , details of services selected by the User, communication content, User notes, complaints, or feedback related to the Client's services.

Sensitive Personal Data (Special Categories):
Health Data: Information regarding a User's health, symptoms, or condition, as provided by the User to the Client (Provider) through the Platform (e.g., in appointment notes, communications, or during a consultation). The Client (Provider) is solely responsible for ensuring a valid legal basis (e.g., explicit consent) under Article 9 of the GDPR for the processing of this data.

Categories of Data Subjects:
Users (i.e., the Client's own clients/patients) who interact with or book services from the Client (Provider) via the Platform.

Recipients of Personal Data (Sub-processors):
Hosting and Cloud Infrastructure Providers (e.g., AWS, Render).
Payment Service Providers (PSPs).
Analytics Service Providers (e.g., Google Analytics).
Marketing and Communication Service Providers (for facilitating communication).

Data Transfers:
Personal Data is stored primarily within the EEA (e.g., Germany).
Personal Data may be transferred outside the EEA to Sub-processors (e.g., in the USA) only where a valid transfer mechanism is in place, such as the European Commission’s Standard Contractual Clauses, in accordance with Clause 9 of this DPA .

Storage / Deletion:
Upon termination of the Agreement or at the written request of the Client (Provider), Personal Data shall be deleted or returned in accordance with Clause 7 of this DPA. The Company shall delete Personal Data within 3 years of termination unless otherwise required by law.