Data Processing Agreement

1. Subject Matter and Duration of Processing

This Data Processing Agreement (DPA) governs the processing of personal data by Viali UG (haftungsbeschränkt), Bruder-Klaus-Str. 18, 78467 Konstanz, Germany (Processor), on behalf of the clinic (Controller) in connection with the use of the Viali.app platform. Processing continues for the entire contract term.

2. Nature and Purpose of Processing

• Storage and processing of clinical and administrative documentation (including patient records, treatments, anesthesia documentation, scheduling, patient CRM, invoicing, staff and applicant management)
• Provision of the web-based application
• Performing backups and system maintenance
• Technical support and troubleshooting (access to the clinic's data only as set out in Section 6)

3. Type of Personal Data

• Patient master data (name, date of birth, weight, contact details)
• Health data (vital signs, diagnoses, medication, treatment and anesthesia documentation)
• User and staff data (name, email, user role, contracts, work logs, absences)
• Applicant data (contact details, CV and application documents)
• Audit data (access logs, change history) and the AI log (texts transmitted to AI providers and their responses, calls made through the AI connector; see Section 6)

4. Categories of Data Subjects

• Patients of the clinic
• Clinic employees (application users)
• Job applicants (careers/recruitment portal)

5. Obligations of the Processor

• Processing only according to documented instructions from the Controller
• Ensuring confidentiality by all employees
• Access by the Processor's staff to the clinic's data only with the Controller's consent; the sole exception is emergency access as set out in Section 6
• Implementing appropriate technical and organizational measures
• Support in fulfilling data subject rights
• Notification of data breaches within 24 hours

6. Technical and Organizational Measures

• Encryption of all data in transit (TLS 1.3) and at rest
• Access control through role-based permissions
• Support access only with consent: Viali staff see the clinic's data only while a clinic administrator has granted access – limited to 1 hour, 24 hours or 7 days, read-only by default, and for that one clinic only. Viali may request access; without consent no access is created.
• Emergency access: without prior consent, Viali may access the clinic's data only if (a) patient care, the ongoing operation of the service or the security of the data is at risk and (b) the clinic cannot be reached in time. Emergency access is read-only, lasts at most 2 hours and requires a written reason; all clinic administrators are notified immediately, and the access is logged. Every access – emergency access included – ends automatically when its duration runs out and can be ended by the clinic at once, at any time.
• Changes by support: support can change the clinic's data only if the clinic has expressly granted “read and edit” access; any other access is technically limited to reading. The support person works under their own personal Viali account and never under the account of a clinic employee; wherever the application records who made a change, the change appears under that person.
• Logging of support access: granting, requesting, declining and ending access are recorded with person, time, duration and scope and are visible to the clinic; every support access to a patient record is logged and shown to the clinic in that record under the “Access” tab as “Viali-Support”, with the person's name. These logs and the history of access grants are kept for as long as the clinic's patient records are kept.
• Regular security reviews
• Regular automatic backups of the managed database by the hosting provider (Exoscale, Switzerland)
• Audit trail for all security-relevant actions
• Limited roles: anyone who holds only the role “Cleaning staff” or “Marketing” (external agency) at a clinic has no access to patient data; this is enforced on the server. The marketing role sees only aggregated figures in its areas.
• AI log: every request to an AI provider is logged with the text as transmitted (after de-identification) and the response, images only as a placeholder (file type, size, checksum); likewise every call made through the AI connector (function, read or write, outcome, arguments passed and response transmitted). Purpose: traceability and security. Access to the logged texts: the clinic's administrators for their own clinic. For operation and security, Viali sees only technical metadata (e.g. time, function, model, status, cost); the texts themselves only within a support access granted by the clinic under the rules above. Because a logged text may contain details that de-identification did not detect, every opening of a logged text is itself logged. Entries are deleted automatically after 6 months (183 days) and are never passed to an AI provider or through the AI connector.
• AI connector: when a user of the clinic connects their own account with an AI assistant to Viali, the connector returns no patient data; every response is automatically checked for patient data before it is sent and withheld if any is found. The connection acts only within the current role of the person who set it up, every call is recorded in the AI log, and the clinic can revoke connections at any time.

7. Subprocessors

The following subprocessors are used:

• Exoscale AG, Switzerland - Server hosting and object storage
• Exoscale (Switzerland) - Database hosting
• Stripe Inc. - Payment processing (no patient data)
• Resend Inc. - Email delivery (system notifications only)
• VADIAN.NET AG (ASPSMS), Switzerland - SMS communications (appointment notifications, no patient data)
• Anthropic PBC, USA - AI-assisted processing (texts after de-identification; exception: monitor photos, see below)
• OpenAI, L.L.C., USA - AI-assisted processing (texts after de-identification; exception: monitor photos, see below)
• Mistral AI SAS, France - AI-assisted processing (texts after de-identification; exception: monitor photos, see below)
• Functional Software, Inc. (Sentry), USA - Error and crash logs
• Google Ireland Limited - Font delivery (transmits the IP address)

For subprocessors located outside Switzerland/the EEA (e.g. the US-based AI providers), transfers are safeguarded by the EU Standard Contractual Clauses (SCCs) with the Swiss addendum.

Transmission to AI providers: before transmission, personal data in texts is replaced with placeholders – known details (e.g. names, contact details) and typical patterns (e.g. dates, phone numbers, email addresses, AHV numbers), as well as further details detected by a self-hosted de-identification service. If that service is unavailable, some features send nothing; the other features send the text after known details and typical patterns have been removed. Features that process no patient data (e.g. job advertisements, SOPs, website and marketing texts, product photos) send their content without these steps. Exception – monitor photos: when staff photograph a patient monitor to take over vital values, the image is transmitted to an AI provider; the Controller ensures that the monitor shows no information identifying the patient (e.g. name, date of birth, patient number) when it is photographed. Automatic capture of the monitor screen via HDMI is switched off. Voice input is converted to text on Viali's own server; the recording is not transmitted to an AI provider.

AI connector: when a user of the clinic connects their own account with an AI assistant (e.g. Claude by Anthropic, ChatGPT by OpenAI) to Viali, what is retrieved through this connection goes into that account, under the responsibility of the Controller or that user and under the terms of the respective provider. The provider of the AI assistant is not Viali's subprocessor for this. The technical safeguards are set out in Section 6.

8. Deletion and Return of Data

• After contract termination: Deletion of all data within 30 days
• Upon request, Viali provides the Controller with an export of the data before deletion.
• Written confirmation of deletion upon request

9. Audit Rights

The Controller has the right to verify compliance with this agreement. This can be done by reviewing certifications, reports, or by on-site audits upon agreement.