Data Processing Agreement

1. Parties and definitions

This agreement is made between:

• the Clinic using the RADAR Dental platform, acting as controller (the “Clinic”), identified by the legal details entered on acceptance; and
• Vitanic Sales LLC, a company registered in the State of Wyoming, USA, at 2232 Dell Range Blvd, Cheyenne, WY 82009, USA, which operates the RADAR Dental platform, acting as processor (“RADAR”), represented by Octavian Alupoaie, Managing Member. Contact: contact@radardental.ro.

This agreement is made under Article 28 of Regulation (EU) 2016/679 (“GDPR”) and, for UK clinics, the UK GDPR. It forms part of the RADAR Dental Terms and Conditions and, for data protection, takes precedence over them.

Definitions. “Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in Article 4 GDPR. In addition:

• Platform: the RADAR Dental application (patient questionnaire, Smart Briefing, consultation transcription and analysis, audit, follow-up scripts, call list, statistics).
• Sub-processor: a provider used by RADAR that processes personal data on the Clinic’s behalf (Annex 1).
• Patient consent: the consent given by the patient in the questionnaire or confirmed by the dentist in the Platform, with the date, time and version of the text.

2. What data is processed, why and for how long

RADAR processes personal data only on the Clinic’s behalf, only to provide the Platform and only on the Clinic’s documented instructions. The instructions are those in this agreement and those given by using the Platform’s features. If an instruction appears to breach the law, RADAR informs the Clinic immediately.

Nature of processing: collection through the questionnaire, storage, automatic transcription, analysis with artificial intelligence, display of results to the Clinic’s team, sending confirmation emails to the patient.

Purposes are only those accepted by the patient: preparing the consultation, documenting the conversation, feedback for the Clinic’s team on how it explained and presented the treatment, and preparing the follow-up with information about the proposed treatment plan.

What RADAR does not do with the data: it does not use it for its own purposes, does not sell it, does not use it for advertising and does not use it to train artificial intelligence models.

Duration: for the term of the Clinic’s subscription and until the data is deleted under clause 7.

3. RADAR’s obligations

1. Instructions. Processes the data only on the Clinic’s documented instructions, including with regard to transfers (Article 28(3)(a) GDPR), unless required to do otherwise by law. In that case it informs the Clinic beforehand, where the law allows.
2. Confidentiality. People authorised to process the data have committed in writing to confidentiality. RADAR staff access patient data only for support requested by the Clinic or to fix a technical problem.
3. Security. Applies the measures required by Article 32 GDPR, described in Annex 2, and updates them as technology and risks evolve.
4. Sub-processors. Complies with clause 5.
5. Patient requests. Helps the Clinic, through the Platform’s features and on request, to respond to requests for access, rectification, erasure, restriction, portability and objection. Withdrawing consent through the questionnaire link automatically blocks the analysis of the patient’s consultations. Requests received directly from patients are passed to the Clinic within 5 working days.
6. Assistance with the Clinic’s obligations. Helps the Clinic meet its obligations under Articles 32–36 GDPR: security, breach notification, data protection impact assessment (including through the DPIA template provided) and prior consultation.
7. Incidents. Notifies the Clinic under clause 6.
8. Deletion. Deletes or returns the data under clause 7.
9. Audit. Makes available the information needed to demonstrate compliance with Article 28 GDPR, under clause 8.
10. Artificial intelligence. The Platform’s results are suggestions for the Clinic’s team. The Platform makes no automated decisions with legal or similarly significant effects on patients (Article 22 GDPR), and the rules used to write the scripts prohibit false urgency and promises the Clinic has not configured (discounts, instalments, benefits).

4. The Clinic’s obligations

As controller, the Clinic is responsible for the lawfulness of the processing. In particular, it:

1. Lawful basis. Processes patient data on the basis of the patient’s explicit consent (Article 9(2)(a) GDPR), obtained through the questionnaire or, if the patient did not complete it, verbally at the start of the consultation and confirmed in the Platform.
2. No consent, no recording. Does not record or upload a consultation without the patient’s consent. Does not confirm in the Platform verbal consent that was not given.
3. Informing patients. Informs its patients under Article 13 GDPR. It may use the privacy notice provided by RADAR, adapted to the Clinic’s details.
4. Accepted purposes. Uses the Platform’s results only for the purposes accepted by the patient (clause 2). Does not use them to market other services, does not pass them to third parties and does not use the patient’s fears as pressure in follow-up calls.
5. Impact assessment. Carries out a data protection impact assessment (DPIA, Article 35 GDPR) before the first recording, using the template provided by RADAR.
6. Withdrawal of consent and patient requests. Respects the withdrawal of consent and responds to patient requests within the legal time limits.
7. Team access. Creates accounts only for members of its own team, trains them on confidentiality and removes access for people who leave.
8. Professional secrecy. Complies with the dentist’s professional confidentiality obligations under the law of its country.
9. Clinical records. The Platform does not replace the patient’s clinical record. Data the Clinic must keep by law is kept in the Clinic’s own systems.
10. Recording rules. Ensures that the people who record consultations follow the recording rules communicated by RADAR in the Platform: stopping the recording at the patient’s request, not recording minors without the consent of their legal representative, not mentioning other patients and deleting local copies of recordings. It also ensures that anyone present with the patient agrees to the recording. The Clinic is responsible for its staff’s compliance with these rules.

5. Sub-processors and transfers

General authorisation. The Clinic authorises the use of the sub-processors in Annex 1. RADAR notifies the Clinic by email at least 30 days before adding or replacing a sub-processor. The Clinic may object on reasonable grounds within that period. If the parties cannot find a solution, the Clinic may end its subscription without penalty, with a refund of the unused part of the month already paid.

Same obligations. RADAR imposes on each sub-processor, by contract, data protection obligations equivalent to those in this agreement. RADAR remains liable to the Clinic for how its sub-processors meet their obligations.

Transfers outside the European Economic Area take place only under Chapter V GDPR:

• to a recipient certified under the EU-U.S. Data Privacy Framework (the European Commission’s adequacy decision of 10 July 2023); or
• under the standard contractual clauses approved by Decision (EU) 2021/914, with supplementary measures where the transfer assessment requires them.

Vitanic Sales LLC is based in the USA. The Clinic acknowledges that the transfer to RADAR takes place under the standard contractual clauses (Module 2, controller to processor), which are incorporated into this agreement by reference.

UK clinics. The UK GDPR and the Data Protection Act 2018 apply. Transfers take place under the UK International Data Transfer Addendum to the standard contractual clauses or the UK Extension to the Data Privacy Framework.

6. Personal data breaches

RADAR notifies the Clinic without undue delay and no later than 48 hours after becoming aware of any personal data breach affecting the Clinic’s data. The notice includes, as far as known: the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, the measures taken and a contact person. Missing information is provided as it becomes available. The Clinic remains responsible for notifying the supervisory authority (ANSPDCP in Romania, the ICO in the UK) within 72 hours and, where required, the patients.

7. Deletion and return of data

• The audio recording is deleted automatically straight after transcription.
• The Clinic may delete a consultation (report, transcript and scripts) or a patient record from the Platform at any time.
• When the subscription ends, or when free access expires without moving to a paid plan, the Clinic may request an export of its data for 30 days. RADAR then deletes the data, including at sub-processors, unless the law requires it to be kept.
• Backups are overwritten in their normal rotation cycle of no more than 30 days.
• On request, RADAR confirms the deletion in writing.

8. Audit

RADAR makes available to the Clinic the information needed to demonstrate compliance with Article 28 GDPR: this agreement, the current list of sub-processors, a description of the security measures and the providers’ certifications. RADAR allows audits, including inspections, by the Clinic or an auditor it appoints, with at least 30 days’ notice, subject to confidentiality and no more than once a year. The annual limit does not apply after a personal data breach or at the request of an authority. The Clinic bears the cost of the audit.

9. Liability

Each party is liable for damage caused by breaching its obligations under this agreement and the GDPR (Article 82 GDPR). To the extent permitted by law, RADAR’s total liability is limited as set out in the Terms and Conditions. The limitation does not apply in cases of fraud, intent or gross negligence.

10. Term, governing law, changes

This agreement applies from its acceptance in the Platform until all of the Clinic’s data has been deleted. The governing law and competent courts are those in clauses 11 (Romania and the EU), 12 (United Kingdom), 13 (USA) and 14 (Australia), according to the Clinic’s country. Changes are announced by email at least 30 days in advance. The Clinic accepts them in the Platform or may end its subscription.

11. Provisions for Romania and the European Union

These apply if the Clinic is established in, or treats patients in, the European Economic Area.

1. Applicable law. The GDPR, Romanian Law no. 190/2018 and the law of the Clinic’s Member State. For clinics in Romania, the supervisory authority is ANSPDCP.
2. Profiling with health data. Analysis of the consultation and questionnaire with artificial intelligence takes place only on the basis of the patient’s explicit consent and with the safeguards in Annex 2, as required by Article 3(1) of Law no. 190/2018.
3. Medical confidentiality. The Clinic complies with Articles 21–25 of Law no. 46/2003 on patients’ rights. The patient’s confidential information reaches RADAR only with their explicit consent, under Article 22 of that law. RADAR and its staff keep that information confidential on the same terms.
4. Professional secrecy. Using the Platform does not release the dentist from the duty of professional secrecy under Law no. 95/2006 and the Code of Ethics for Dentists. RADAR does not share the data with anyone other than the sub-processors in Annex 1.
5. Impact assessment. The processing falls within the categories for which ANSPDCP Decision no. 174/2018 requires an impact assessment: health data, new technologies and systematic evaluation of individuals. The Clinic carries it out before the first recording, using the RADAR template.
6. EU representative. The representative of Vitanic Sales LLC in the European Union under Article 27 GDPR is Octavian Alupoaie, Bd. 1 Mai nr. 4, bl. J4, sc. A, ap. 16, Constanța, Romania, contact@radardental.ro. Supervisory authorities, the Clinic and data subjects may contact the representative on any issue related to the processing.
7. Transfer to the USA. Takes place under the standard contractual clauses (Decision (EU) 2021/914, Module 2 for the Clinic to RADAR and Module 3 for RADAR to its sub-processors), with a transfer assessment and the supplementary measures in Annex 2.
8. Governing law and courts. Romanian law; the competent courts at the Clinic’s registered office.

12. Provisions for the United Kingdom

These apply if the Clinic is established in, or treats patients in, the United Kingdom.

1. Applicable law. The UK GDPR and the Data Protection Act 2018. References to the GDPR in this agreement are read as references to the UK GDPR. The supervisory authority is the Information Commissioner’s Office (ICO).
2. Lawful basis for health data. The patient’s explicit consent (Article 9(2)(a) UK GDPR), obtained under clause 4.
3. Transfer to the USA. Takes place under the International Data Transfer Addendum issued by the ICO to the EU standard contractual clauses, or to recipients certified under the UK Extension to the EU-U.S. Data Privacy Framework.
4. UK representative. Vitanic Sales LLC appoints a representative in the United Kingdom under Article 27 UK GDPR.
5. Impact assessment. The Clinic carries out the DPIA required by Article 35 UK GDPR and the ICO’s guidance, using the RADAR template.
6. Professional obligations. The Clinic and its team comply with the General Dental Council’s standards on confidentiality and the protection of patient information. Using the Platform does not change them.
7. Incidents. The Clinic notifies the ICO within 72 hours, based on RADAR’s notice under clause 6.
8. Governing law and courts. The law of England and Wales; the courts of England and Wales.

13. Provisions for the USA: HIPAA addendum (Business Associate Agreement)

This applies if the Clinic is a “covered entity” under HIPAA (45 C.F.R. Parts 160 and 164). In that case RADAR is a “business associate” and patient data is “protected health information” (PHI). For PHI, this addendum prevails over the rest of the agreement.

Condition for starting. RADAR processes PHI for a US clinic only once every sub-processor that handles PHI has signed a business associate agreement with RADAR (45 C.F.R. § 164.502(e)(1)(ii)). Emails to US patients contain no PHI or are sent through a provider that signs such an agreement.

RADAR agrees to:

1. Use and disclose PHI only to provide the Platform to the Clinic, as set out in this agreement or as required by law, and only to the minimum extent necessary.
2. Apply the safeguards — administrative, physical and technical — required by the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) for electronic PHI.
3. Report to the Clinic any use or disclosure not permitted, any security incident and any breach of unsecured PHI (45 C.F.R. § 164.410), within 5 working days of discovery. The law allows 60 days.
4. Bind its sub-processors to the same restrictions and conditions through written agreements.
5. Make PHI available for patient access (§ 164.524), amendment (§ 164.526) and an accounting of disclosures (§ 164.528), at the Clinic’s request.
6. Make available to the U.S. Department of Health and Human Services (HHS) its practices, books and records relating to PHI, to determine compliance.
7. Not sell PHI, not use it for marketing and not use it to train artificial intelligence models.
8. Return or destroy PHI when the agreement ends. If that is not feasible, it extends the protections and limits further use to the purposes that make return infeasible.

Termination. If RADAR materially breaches this addendum and does not cure the breach within 30 days, the Clinic may terminate the agreement.

State laws. The Clinic is responsible for complying with the laws of its state, in particular:

• Recording conversations. In states that require the consent of all parties (for example California, Florida, Washington, Illinois, Pennsylvania and Massachusetts), the Clinic obtains the consent of the patient and of every team member present in the consultation.
• Consumer health data that is not PHI, under applicable state laws (for example the Washington My Health My Data Act). For that data, RADAR acts as the Clinic’s service provider or processor.

Governing law. The law of the Clinic’s state, without prejudice to HIPAA.

14. Provisions for Australia

These apply if the Clinic is established in, or treats patients in, Australia.

1. Applicable law. The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), together with the Clinic’s state or territory health records law where one applies: the Health Records Act 2001 (Victoria), the Health Records and Information Privacy Act 2002 (New South Wales) and the Health Records (Privacy and Access) Act 1997 (Australian Capital Territory). The regulator is the Office of the Australian Information Commissioner (OAIC). For Australia, references in this agreement to the GDPR are read as references to these laws, and “controller” and “processor” mean the Clinic and RADAR, which handles the data only on the Clinic’s behalf.
2. Health information. Health information is sensitive information. The Clinic collects it with the patient’s consent (APP 3.3), obtained under clause 4, and notifies the patient of the collection (APP 5), including that the data is handled outside Australia.
3. Handling outside Australia (APP 8). The data is stored in the European Union and processed by the sub-processors in Annex 1, including in the USA. RADAR undertakes to handle the information consistently with the APPs and imposes the same obligations on its sub-processors. The Clinic remains accountable to the patient under section 16C of the Privacy Act; RADAR supports it with the information it needs. For clinics in New South Wales, the transfer also complies with HPP 14 on transborder data flows.
4. RADAR’s undertaking. Whether or not RADAR falls within the small business exemption in the Privacy Act, RADAR contractually undertakes to comply with the APPs for the Clinic’s data, in particular APP 6 (use and disclosure), APP 11 (security and destruction) and APPs 12–13 (access and correction, through the Clinic).
5. Notifiable Data Breaches. RADAR notifies the Clinic without undue delay under clause 6, with the information the Clinic needs for its assessment. The Clinic assesses within 30 days whether the incident is an eligible data breach and, if so, notifies the OAIC and the affected patients as soon as practicable.
6. Impact assessment. The Clinic carries out a Privacy Impact Assessment in line with the OAIC’s guidance, using the RADAR template.
7. Automated decisions. The Platform does not make decisions based solely on automated processing that significantly affect patients. If the Clinic’s privacy policy must describe the use of computer programs in such decisions, RADAR provides the information needed.
8. Professional obligations. The Clinic and its team comply with the Dental Board of Australia’s and AHPRA’s requirements on confidentiality, informed consent and the use of artificial intelligence. Using the Platform does not change them. The Platform does not replace the clinical record, which the Clinic keeps under its state’s law.
9. Governing law and courts. The law of the state or territory in which the Clinic is established; the courts of that state or territory.

15. Entering into the agreement

The agreement is entered into by electronic acceptance in the Platform by the Clinic’s representative (Article 28(9) GDPR) or by signature of both parties. On electronic acceptance, RADAR keeps a record of: the Clinic’s legal name, registration number and registered address, the name and position of the person accepting, the account used, the date, time, IP address and version of the agreement. The Clinic receives an email confirming the acceptance.

Annex 1. Sub-processors

Subscription payments (Stripe) contain no patient data. For those, RADAR is a controller, not a processor.

Annex 2. Technical and organisational measures

• Encrypted communications (HTTPS/TLS) between browser, server and providers.
• Encrypted storage of the database and files, provided by the hosting provider.
• Separation of data between clinics through database-level access rules.
• Individual accounts for each team member, with roles (administrator, dentist, coordinator). Only the administrator sees performance and can delete data.
• Individual questionnaire links that expire after 14 days and can be cancelled by the Clinic.
• Audio files stored in private storage, accessible only through temporary links, deleted automatically after transcription.
• Consent log: the patient’s consent with the date, time and text version; analysis is blocked without consent and after it is withdrawn.
• The instructions given to the artificial intelligence system require phone numbers, addresses, email addresses and national identification numbers to be left out of reports.
• Technical logs without consultation content.
• Restricted access for RADAR staff, for support and fixes only.

Annex 3. Details of the processing