Einsteinn Data Protection Policy

provides an adequate level of protection for Protected Data by effectively upholding principles for the reasonable processing of personal information that are substantially similar to the conditions for lawful processing under POPIA (including, where applicable, protection of juristic persons), and

includes provisions that are substantially similar to section 72 of POPIA regarding any further onward transfer of personal information to third Parties in foreign countries.

a “security compromise” as contemplated in section 22 of POPIA, namely where there are reasonable grounds to believe that the Protected Data of a Data Subject has been accessed or acquired by any unauthorised person; and

any other actual or reasonably suspected unauthorised or unlawful destruction, loss, alteration, disclosure of, or access to, Protected Data Processed by the Processor on behalf of the Controller.

its determination of the purposes and means of Processing;

its decisions to use the Services; and

its provision of Protected Data to the Processor and its instructions for Processing.

is solely responsible for determining and documenting the lawful basis (for example, consent, performance of a contract, compliance with a legal obligation, legitimate interests) for Processing Protected Data through the Services;

warrants on an ongoing basis that it has obtained and will maintain all notices to, and permissions or consents from, Data Subjects that are required under Data Protection Laws for the Processing of Protected Data in connection with the Services; and

is responsible for ensuring that its privacy notices and any communications with Data Subjects accurately describe the Processing carried out through the Services.

is solely responsible for the legality, quality and accuracy of the Protected Data and for the means by which it acquired such data;

must ensure that Protected Data supplied to the Processor is adequate, relevant and limited to what is necessary in relation to the purposes for which it is Processed; and

must take reasonable steps to keep Protected Data accurate and, where necessary, up to date, including by correcting or deleting Protected Data in its source systems where the Controller becomes aware of inaccuracies.

special personal information / special categories of personal data (including information relating to an individual’s health, biometric identifiers, religious or philosophical beliefs, political opinions, trade-union membership, criminal behaviour, or similar categories defined in Data Protection Laws); or

personal information of children (as defined in Data Protection Laws).

warrants that such Processing is strictly necessary and that it has a valid legal basis and all required consents or authorisations to Process and disclose such data to the Processor; and

must notify the Processor in advance and cooperate with the Processor to implement any additional technical and organisational measures that the Processor reasonably requires in order to Process such data lawfully and securely.

is responsible for its configuration and use of the Services and for any Processing instructions it gives to the Processor (including through the use, configuration or integration of the Services by or on behalf of the Controller);

must ensure that its instructions, and its use of the Services, do not cause the Processor to breach Data Protection Laws or the rights of any Data Subject;

must not use the Services to collect or Process Protected Data in a way that is unlawful, misleading, discriminatory or otherwise infringes Data Protection Laws; and

is responsible for ensuring that only authorised users have access to the Services and that such users keep their authentication credentials secure and confidential.

it is authorised by the underlying responsible party / controller to appoint the Processor (and the Processor’s Sub-processors) as further operators / processors and to issue Processing instructions to them; and

the Processing activities that the Controller instructs the Processor to carry out are within the scope of, and consistent with, the written mandate and lawful instructions it has received from that underlying responsible party / controller.

keep and maintain all Protected Data in strict confidence, using such degree of care as is appropriate to avoid unauthorized access, use or disclosure.;

use and disclose Protected Data solely and exclusively for the purposes for which the Protected Data, or access to it, is provided pursuant to the terms and conditions of the Main Agreement, and not use, sell, rent, transfer, distribute, or otherwise disclose or make available Protected Data for the Practice’s own purposes or for the benefit of anyone other than the Practice, in each case, without Practice’s prior written consent; and

not, directly or indirectly, disclose Protected Data to any person other than Authorised Persons, without express written consent from the Practice, unless and to the extent required by government authorities or as otherwise, to the extent expressly required, by applicable law, in which case, the Provider must use reasonable efforts to notify the Practice before such disclosure or as soon thereafter as reasonably possible.

Controller personnel;

Controller’s patients and end-users;

Prospective patients and marketing contacts;

Controller’s suppliers and business partners;

Website and application visitors;

Support and communication contacts; and

Any other individuals whose Personal Information is uploaded to, received by, or otherwise processed via the Services by or on behalf of the Controller, in each case as determined and controlled by the Controller in its use of the Services.

Name;

Contact information such as email, phone number, or address;

Employment information such as employee ID or compensation;

Financial information such as bank account numbers;

Professional or biographic information such as resume or CV;

Transactional information such as account information or purchases;

User activity and analysis such as device information or IP address; and

Location information.

Receiving data, including collection, accessing, retrieval, recording, and data entry;

Holding data, including storage, organization, and structuring;

Using data, including analysis, consultation, testing, automated decision making, and profiling;

Updating data, including correcting, adaptation, alteration, alignment, and combination;

Protecting data, including restricting, encrypting, and security testing;

Sharing data, including disclosure, dissemination, allowing access, or otherwise making available;

Returning data to the data exporter or data subject; and

Erasing data, including destruction and deletion

for the term of the Main Agreement, including any renewals or extensions; and

thereafter, only for so long as (i) the Controller instructs the Processor in writing to retain Protected Data for specific purposes, or (ii) retention of Protected Data is required by applicable law or reasonably necessary for the establishment, exercise or defence of legal claims,

return all Protected Data to the Controller in a commonly used, machine-readable format; or

securely delete or irreversibly anonymise all Protected Data in its possession or under its control,

such backups are kept securely and are not accessed or used for any purpose other than backup and recovery; and

such backups are overwritten or destroyed in accordance with the Processor’s standard backup retention cycles.

access control and authentication mechanisms based on least-privilege principles;

physical and environmental security for office facilities;

logical separation of customer environments in multi-tenant systems;

encryption of Protected Data in transit over public networks and at rest where reasonably practicable;

network and application security controls, including firewalls, intrusion detection/prevention, vulnerability management and patching;

backup, business continuity and disaster recovery arrangements with defined recovery time and recovery point objectives;

secure development practices, including change management and security testing of material changes; and

staff awareness, confidentiality undertakings and regular training on data protection and information security.

the Restricted Transfer is required for the performance of the Services in accordance with the Main Agreement and this DPP; and

the recipient of the Protected Data benefits from Adequate Protection.

the applicable law, binding corporate rules or binding agreement relied upon to establish Adequate Protection is legally binding and enforceable on the recipient; and

such law, rules or agreement in substance (i) upholds principles for reasonable processing of personal information that are substantially similar to the conditions for lawful processing set out in POPIA, and (ii) restricts further onward transfers of Protected Data to third Parties in foreign countries on terms that are substantially similar to this clause.

promptly notify the Controller; and

restricts the Sub-processor’s processing of Protected Data to strictly necessary processing for the sole purpose of assisting the Processor to provide the Services to the Controller;

requires the Sub-processor to implement and maintain appropriate technical and organisational measures to protect Protected Data in a manner that is no less protective than the measures required of the Processor under this DPP and applicable Data Protection Laws;

imposes confidentiality obligations on all persons authorised to access Protected Data that are no less protective than those in this DPP;

requires the Sub-processor to assist the Processor, to the extent reasonably practicable, in meeting the Processor’s obligations under this DPP in relation to security, data-breach notification, data-subject rights, and deletion or return of Protected Data; and

requires the Sub-processor to delete or return all Protected Data to the Processor (at the Processor’s choice) when the Sub-processor’s services end, subject only to any retention that is strictly required by law and subject to continued compliance with this DPP while any Protected Data is retained.

not appoint, or cease to use, the relevant Sub-processor for processing Protected Data;

propose a reasonable change to the Services to avoid processing by that Sub-processor; or

permit the Controller to suspend or terminate the part of the Services that cannot reasonably be provided without that Sub-processor, without any early-termination charge for that part of the Services, but subject to payment of all fees properly accrued up to the effective date of suspension or termination.

the exercise of a Data Subject’s rights in respect of Protected Data (including any right of access, correction, deletion or objection under Data Protection Laws); or

any allegation that the Processing of Protected Data infringes Data Protection Laws.

promptly (and in any event within 5 business days of receipt) notify the Controller in writing, including reasonable details of the request; and

not respond to the request, other than to acknowledge receipt and direct the Data Subject or regulator to contact the Controller, except on the documented instructions of the Controller or where a response is required by applicable law.

respond to Protected Data Requests in accordance with Data Protection Laws; and

demonstrate its compliance with the Data Subject participation requirements under Data Protection Laws.

the Protected Data Request is manifestly unfounded, excessive or repetitive;

the requested assistance clearly falls outside the agreed scope of the Services,

notify the Controller of the Data Incident without undue delay, and in any event within 48 hours after becoming aware of the Data Incident; and

provide the Controller, as soon as reasonably practicable, with the information described below, to the extent known at the time of notification.

a description of the nature of the Data Incident, including, where possible, the categories and approximate number of affected Data Subjects and Protected Data records concerned;

the categories of Protected Data affected;

the likely consequences and risks for affected Data Subjects; and

the measures taken or proposed to be taken by the Processor to address the Data Incident, including, where appropriate, measures to mitigate its possible adverse effects.

take reasonable steps to contain, investigate and remediate the Data Incident, including implementing appropriate corrective and mitigating measures; and

cooperate with the Controller and provide reasonable assistance (at no additional charge for activities that are part of the Processor’s standard incident response) in (i) assessing the impact and risks of the Data Incident, (ii) preparing any notifications to regulators or Data Subjects that the Controller decides are required, and (iii) responding to any regulatory enquiries relating to the Data Incident.

determining whether a Data Incident is notifiable under Data Protection Laws; and

making any notifications to the Information Regulator, Data Subjects and/or other third Parties required by Data Protection Laws.

on the documented instructions of the Controller; or

where the Processor is required to do so by applicable law, in which case the Processor shall, where legally permitted, notify the Controller in advance of such notification or, where advance notice is not possible, as soon as reasonably practicable thereafter.