Data Processing Agreement

1. Parties

This Data Processing Agreement (“Agreement”) becomes binding when accepted by the Client and is entered into between:

These roles follow Article 4 of Ecuador's Organic Personal Data Protection Law (LOPDP). The Agreement takes effect upon acceptance of the current version shown above and supersedes earlier versions for acceptances made under them.

2. Purpose

The Agreement governs personal data processing by Saitooth on the Client's behalf when providing the dental clinical record management platform, under the Terms and Conditions of Use and the Privacy policy.

3. Duration

The Agreement remains in force while the Client's subscription is active and until data is returned or deleted under the Client's documented instructions and applicable regulations.

4. Nature and purpose of processing

The exclusive purpose is to enable the Client to:

• —Manage patients' dental clinical records.
• —Generate documents and records from information entered by the Client.
• —Use scheduling functions chosen by the Client.
• —Receive technical support for platform use.

Saitooth processes patient data only on the Client's behalf and instructions. It does not use that data for its own purposes, automated profiling, marketing, advertising or AI model training. Account, billing, support, security and technical log data may be processed under the Privacy Policy as needed to provide, protect and administer the service.

5. Data and data subject categories

Data subjects

• —Client patients (personal data and sensitive health data).
• —Practitioners and users authorized by the Client.

Data categories

• —Identity and contact data (name, national ID or RUC, email and phone).
• —Health data: history, diagnoses, clinical progress, odontograms and images.
• —Practitioner electronic signature metadata (public certificate, serial number and holder name); private keys (.p12) are never stored.
• —Billing and browsing data (system logs).

6. Documented instructions

Saitooth processes data only under the Client's documented instructions, expressed in this Agreement and the Client's platform configuration and use. Saitooth will inform the Client if it considers an instruction to violate the LOPDP or data protection regulations.

7. Technical and organizational measures

At the current MVP stage, Saitooth applies reasonable, risk-proportionate measures subject to continuous improvement:

• —Encryption in transit: communications use TLS/HTTPS encryption.
• —Infrastructure: cloud infrastructure uses the provider's security measures.
• —Multi-tenant isolation: data is isolated by organization.
• —Access control: individual credentials and platform permissions.
• —Local electronic signing: signing occurs on the practitioner's device through Saitooth Signer; the private key (.p12) is never transmitted to or stored on the platform.
• —Logging: technical records of relevant actions within MVP capabilities.

Saitooth claims no certifications or service, backup or availability levels it has not contracted and documented.

8. Subprocessors

Saitooth uses these subprocessors to provide the service:

• —Supabase for PostgreSQL databases and clinical document storage.
• —Vercel for platform hosting and execution.
• —Resend for transactional email (verification, authentication and notifications).
• —Cloudflare (Turnstile) for bot protection and traffic verification.

Each subprocessor's details and processed data are published in the subprocessor register, updated before integrating a provider receiving personal data. Subprocessors are bound by data protection duties at least equivalent to this Agreement. Saitooth will inform the Client of relevant subprocessor changes.

9. Security breach notification

Upon learning of a breach affecting personal data, Saitooth will notify the Client without undue delay and provide relevant incident information. Notification to the Personal Data Protection Authority (SIPDP) within the legal deadline, and to data subjects where applicable, is the Client's responsibility as Controller.

10. Data subject rights

The Client, as Controller, handles requests for access, rectification and updating, erasure where applicable, objection, suspension or restriction and portability. Saitooth assists with available technical means, such as data export, so the Client can meet these requests.

11. Data return and deletion

At service termination, Saitooth coordinates data return or deletion with the Client under documented instructions and applicable regulations. Clinical record retention remains the Client's duty as Controller.

Saitooth retains only data needed for its own obligations or defense of claims where a legal basis exists. Operational timeframes will be communicated when the procedure becomes available.

12. International transfers

Cloud infrastructure may involve international data transfers. Transfers occur only with LOPDP safeguards, such as an adequate level of protection or standard contractual clauses.

13. Parties' obligations

13.1 Client obligations (Controller)

• —Ensure lawful processing and appropriate legal bases, including data subject consent where required.
• —Ensure accuracy and integrity of data entered in the platform.
• —Use individual credentials and keep them confidential under the Acceptable Use Policy.
• —As Controller, be responsible for authorized users' access and use, including improper access to patient data.
• —Handle data subject rights and notify authorities as required by law.

13.2 Saitooth obligations (Processor)

• —Process data only on the Client's behalf and instructions.
• —Maintain data confidentiality and apply clause 7 security measures.
• —Assist the Client in fulfilling obligations within available technical means.
• —Notify the Client of security breaches it becomes aware of.