Auftragsverarbeitungsvertrag (AVV / revDSG DPA)

1. Scope, Parties & Electronic Execution

This Data Processing Agreement (“DPA” / Auftragsverarbeitungsvertrag – AVV) governs the processing of personal data and appointment-related health inquiries by Gexiro Global Enterprises Ltd (Eurotowers, 2 Europort Rd, GX11 1AA Gibraltar, Reg. No. 125187) acting as Processor (Auftragsverarbeiter) on behalf of the subscribing dental clinic or practice network acting as Controller (Verantwortlicher).

Electronic Execution: Subscribing clinics can execute this DPA electronically during onboarding and download a countersigned, clinic-personalized A4 PDF copy bearing a cryptographic audit timestamp.

2. Nature, Purpose & Categories of Data (Annex I)

• Subject Matter:Provision of the 24/7 GEXAURA Dental Concierge, emergency pain pre-triage routing, prophylaxis recall automation, and PVS calendar synchronization (§ 390 SGB V HL7 FHIR R4, VDDS-MMI, Dampsoft DS4, ZaWin, charly, CalDAV).
• Categories of Data Subjects: Prospective and existing clinic patients, legal guardians, and authorized clinic personnel.
• Categories of Personal Data: Contact details (name, phone, email), preferred appointment windows, insurance tier selection (e.g., SSO Dentotar, BEMA/GOZ), and voluntary patient-submitted inquiry/triage transcripts (Art. 9 GDPR / Art. 5 lit. c Swiss revDSG).
• Zero Model Training Guarantee: Patient and clinic data are strictly isolated per tenant and are never used to train public or foundation AI models.

3. Processor Obligations (Art. 28(3) GDPR & Art. 9 revDSG)

• Process personal data solely on documented instructions from the Controller.
• Ensure all authorized personnel are bound by statutory or contractual confidentiality obligations (aligned with § 203 StGB / Art. 321 Swiss StGB professional secrecy standards for external service providers).
• Notify the Controller without undue delay (and within 24 hours of confirmation) upon becoming aware of any personal data breach.
• Assist the Controller with Data Subject Rights requests (access, rectification, erasure, portability) and Data Protection Impact Assessments (Art. 35 GDPR / Art. 22 revDSG).
• Upon termination of the subscription, return or irreversibly purge all tenant records and isolated clinic knowledge indexes within 30 days.

4. Technical & Organizational Measures – TOMs (Annex II, Art. 32 GDPR)

• Cryptographic Transport & Storage: TLS 1.3 encryption in transit, AES-256 encrypted storage volumes at rest, adaptive cryptographic credential hashing, and mandatory multi-factor authentication (2FA) for authorized clinic personnel.
• Strict Multi-Tenant Data Isolation: Every subscribing clinic operates within cryptographically authenticated, strictly segregated per-tenant database and knowledge namespaces.
• Application Hardening: Strict browser content security policies, request authenticity verification, automated abuse rate-limiting, strict document validation, and outbound network isolation across practice management connectors.
• 3-2-1 Sovereign Backups: Automated daily encrypted snapshots with off-site replication and integrity verification.

5. Authorized Infrastructure & AI Sub-Processors (Annex III)

The Controller authorizes the following bound sub-processors under zero-data-training enterprise API configurations and EU Standard Contractual Clauses (2021/914/EU) + Swiss FDPIC Addendum where applicable:

• Primary Sovereign Hosting (EU / EEA): Certified European data center infrastructure (Germany / EEA) for encrypted application state and tenant-segregated clinic records.
• Edge Network & DDoS Protection: Enterprise European edge security and TLS 1.3 termination providers.
• Zero-Training Enterprise Language & Speech Processing: Contractual enterprise inference providers bound by zero-data-retention / zero-training agreements, EU Standard Contractual Clauses, and Swiss FDPIC safeguards (the current itemized Sub-Processor schedule is provided to contracted Controllers prior to onboarding).
• Optional Card & SEPA Processing:Stripe Payments Europe, Limited (Dublin, Ireland) — invoked only when the Controller elects online Stripe payment instead of direct Swiss QR-Bill / SEPA bank transfer.

6. Contact for Data Protection & DPA Execution

For custom enterprise DPA schedules, itemized Sub-Processor schedules, or security questionnaires, contact [email protected].