Data Processing Addendum

1 Purpose and Definitions

This Data Processing Addendum describes how Ophthalytics processes personal and health data on behalf of its customers when they use the NSight360 platform. It is intended to sit alongside the services agreement between Ophthalytics and the customer and to be read with our Security Exhibit.

Terms such as Protected Health Information (PHI), Covered Entity and Business Associate carry the meanings given to them under the U.S. Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations. Where the two documents differ, the executed agreement between the parties governs.

2 Roles of the Parties

In most engagements the customer is the Covered Entity or acts on behalf of one, and Ophthalytics acts as a Business Associate, processing PHI only to provide the service. The customer determines the purposes for which patient data is processed, and Ophthalytics processes it on the customer's documented instructions.

Where data protection laws other than HIPAA apply to a particular engagement, the parties will give effect to the equivalent controller and processor roles through the applicable agreement.

3 Categories of Data and Individuals

The platform processes the following categories of data, all of which are classified as Restricted:

Retinal Images

Ophthalmic fundus images submitted for analysis and clinical interpretation.

Patient Demographics

Identifying and contextual information needed to associate an image with an individual and a report.

Report and Result Data

The diagnostic outputs generated by the platform and the reader interpretation associated with them.

Account and Access Data

Information about the clinicians and operators who use the service, used to authenticate and authorise access.

The individuals whose data is processed are the patients screened through the customer, and the customer's own users of the service.

4 Scope and Purpose of Processing

Ophthalytics processes patient data solely to provide, maintain, secure and support the NSight360 service, and for no other purpose. Patient data is not sold, and it is not used for advertising or for any secondary purpose that is not part of delivering the service to the customer.

Any use of data to improve the platform's algorithms is carried out only where permitted by the applicable agreement and applicable law, using de-identified or otherwise appropriately safeguarded data.

5 HIPAA Business Associate Obligations

As a Business Associate, Ophthalytics uses and discloses PHI only as permitted by the Business Associate Agreement and by law, implements administrative, physical and technical safeguards in line with the HIPAA Security Rule, and reports to the customer any use or disclosure not provided for in the agreement.

Ophthalytics ensures that subcontractors that create, receive, maintain or transmit PHI on its behalf agree in writing to the same restrictions and conditions, and makes its internal practices and records available as required to support the customer's HIPAA obligations.

6 Security Measures

The technical and organisational measures Ophthalytics applies to protect patient data are set out in full in the Security Exhibit, which forms part of this Addendum. In summary they include least-privilege role-based access with multi-factor authentication on privileged accounts, encryption of data in transit and at rest, isolation of production from development and test, centralised logging, independent penetration testing, and a documented incident response process.

These measures are reviewed and updated over time. Ophthalytics will not materially reduce the overall level of protection for patient data during the term of the agreement.

7 Confidentiality and Personnel

Access to patient data is limited to personnel who need it to deliver or support the service, and those personnel are bound by confidentiality obligations that survive the end of their engagement.

Personnel receive privacy and security training on joining and on a recurring basis, with additional guidance for roles that handle PHI directly.

8 Subprocessors

Ophthalytics engages a limited set of subprocessors to deliver the service, the most significant being the cloud infrastructure provider that hosts the platform. Subprocessors that may process PHI are engaged under written agreements that flow down the relevant obligations, including a Business Associate Agreement where required.

A current list of subprocessors is available to customers on request. Ophthalytics informs customers of material changes to that list so that customers can exercise any objection rights the agreement provides.

9 Data Location and International Transfers

The platform and the patient data it processes are hosted on cloud infrastructure located in the United States. Ophthalytics does not transfer patient data outside that location except as necessary to provide the service and as permitted by the applicable agreement.

Where an engagement requires data to remain in a particular jurisdiction, that requirement is addressed in the services agreement.

10 Individual Rights

Requests from patients to access, amend or obtain an accounting of disclosures of their information are directed to and handled by the Covered Entity, since it holds the direct relationship with the patient. Ophthalytics supports the customer in responding to such requests to the extent the data sits within the platform.

Ophthalytics does not respond directly to patient requests concerning PHI unless instructed to do so by the customer or required by law.

11 Retention, Return and Deletion

Patient data is retained only for as long as needed to provide the service and to meet the retention periods set by the applicable agreement and by law, including the record retention obligations of our quality management system.

On termination of the agreement, Ophthalytics returns or securely destroys the patient data it holds, at the customer's choice and where return or destruction is feasible. Secure destruction of media follows recognised sanitisation practice so that data cannot be reconstructed.

12 Incident and Breach Notification

Ophthalytics maintains a documented process for detecting, investigating and responding to security incidents. Where an incident results in a breach of unsecured PHI, Ophthalytics notifies the affected customer without undue delay and within the timeframes required by HIPAA and the agreement, and provides the information the customer needs to meet its own notification obligations.

Notifications include the information available at the time and are updated as an investigation progresses.

13 Audit and Assurance

Ophthalytics supports customer due diligence through this Addendum, the Security Exhibit, a self-assessment questionnaire, and supporting evidence released under NDA. A SOC 2 Type II readiness programme is underway and the resulting report will be made available on completion.

Where the agreement provides audit rights, those are exercised in a manner that protects the confidentiality and security of other customers' data and the integrity of the production environment.

14 Changes and Contact

Ophthalytics may update this Addendum to reflect changes in its practices, its subprocessors or the law. Material changes are communicated to customers through the channels set out in the agreement.

Questions about this Addendum, requests for the current subprocessor list, and data protection enquiries can be sent to support@ophthalytics.com.