This Data Processing Agreement ("DPA") supplements and is incorporated into the HERMES Terms of Service ("ToS") entered into between HUMANLAB ("HUMANLAB," "Processor") and the subscribing Customer ("Customer," "Controller"). In the event of a conflict between this DPA and the ToS regarding data processing matters, this DPA shall govern.
1.1 For the purposes of Republic Act No. 10173 (the "Data Privacy Act" or "DPA-Law," to distinguish from this document) and its Implementing Rules and Regulations, the Customer is the Personal Information Controller (PIC) with respect to Patient Data, and HUMANLAB is the Personal Information Processor (PIP), processing Patient Data solely on the Customer's documented instructions as set out in this Agreement and the ToS.
1.2 With respect to Clinic account, billing, and user data (as opposed to Patient Data), HUMANLAB acts as Personal Information Controller in its own right.
Subject matter: Processing of Patient Data and related personal data as necessary to provide the HERMES platform.
Duration: For the term of the Customer's subscription, plus any period thereafter during which HUMANLAB retains data under Section 8 of this DPA or Section 30 of the ToS.
Processing is carried out solely to provide, maintain, secure, and support the HERMES platform in accordance with the Customer's instructions, including:
HUMANLAB shall:
6.1 Process Patient Data only on the documented instructions of the Customer, including with regard to transfers to a third country, unless required to do otherwise by Philippine law, in which case HUMANLAB shall inform the Customer of that legal requirement before processing, unless prohibited from doing so.
6.2 Ensure that persons authorized to process Patient Data (employees, contractors) are bound by confidentiality obligations.
6.3 Implement the technical and organizational security measures described in Section 7 below.
6.4 Engage subprocessors only in accordance with Section 9 below.
6.5 Assist the Customer, insofar as reasonably possible, in fulfilling its obligations to respond to data subject rights requests (Section 10) and in ensuring compliance with security, breach-notification, and privacy-impact-assessment obligations under the DPA-Law, taking into account the nature of processing and information available to HUMANLAB.
6.6 Notify the Customer without undue delay after becoming aware of a personal data breach affecting Patient Data, in accordance with Section 11.
6.7 At the Customer's choice, delete or return all Patient Data after the end of the provision of services, and delete existing copies, except where Philippine law requires storage, subject to Section 8.
6.8 Make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to reasonable audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable notice, confidentiality, and scheduling to avoid disruption of service to other Customers.
HUMANLAB shall implement and maintain, at minimum, the following measures:
8.1 Patient Data shall be retained for the duration of the Customer's active subscription and processed according to the Customer's instructions regarding retention, subject to minimum retention periods required under applicable Philippine healthcare recordkeeping laws.
8.2 Upon termination of the subscription, the Customer may export Patient Data within thirty (30) days of termination. Following this period, HUMANLAB shall securely delete or anonymize Patient Data, except where retention is required by law.
8.3 Data in routine system backups shall be deleted according to the normal backup lifecycle following deletion from active systems, and in any case not longer than ninety (90) days thereafter.
9.1 The Customer provides general authorization for HUMANLAB to engage subprocessors necessary to provide HERMES (e.g., cloud hosting, database, email delivery, payment processing providers), subject to this Section.
9.2 HUMANLAB shall maintain a current list of subprocessors and shall make it available to the Customer upon request. As of the Last Updated date below, HERMES's subprocessors are:
9.3 HUMANLAB shall impose data protection obligations on each subprocessor that are substantially consistent with those set out in this DPA, and shall remain liable to the Customer for the performance of subprocessors' obligations.
9.4 HUMANLAB shall notify the Customer of any intended changes concerning the addition or replacement of subprocessors, giving the Customer the opportunity to object on reasonable data-protection grounds.
Where a data subject (patient) submits a request directly to HUMANLAB concerning their Patient Data, HUMANLAB shall promptly redirect the request to the Customer and shall not respond to the request itself, except to confirm receipt, unless otherwise instructed by the Customer or required by law. HUMANLAB shall provide reasonable technical assistance to enable the Customer to respond to such requests within legally required timeframes.
11.1 HUMANLAB shall notify the Customer without undue delay, and in any case within seventy-two (72) hours, of becoming aware of a personal data breach affecting Patient Data.
11.2 The notification shall include, to the extent reasonably available at the time:
11.3 HUMANLAB shall cooperate with the Customer and provide reasonable assistance to enable the Customer to comply with its own breach notification obligations to the National Privacy Commission and affected data subjects under the DPA-Law and applicable NPC Circulars (including NPC Circular 16-03 on Personal Data Breach Management).
11.4 The Customer remains responsible for making the final determination as to whether notification to the NPC and/or affected data subjects is required, as the Personal Information Controller.
Where Patient Data is processed or stored on infrastructure located outside the Philippines, HUMANLAB shall ensure that the recipient jurisdiction and/or contractual arrangements with the relevant subprocessor provide a comparable level of protection as required under the DPA-Law and applicable NPC guidance on cross-border transfers.
13.1 Each party shall be liable for damages arising from its own violation of this DPA or the DPA-Law.
13.2 HUMANLAB shall indemnify and hold the Customer harmless from third-party claims, fines, or penalties arising directly from HUMANLAB's failure to implement the security measures required under Section 7 of this DPA, or from HUMANLAB's unauthorized processing of Patient Data outside the Customer's documented instructions, except to the extent such claims arise from the Customer's own unlawful instructions or the Customer's failure to obtain a proper legal basis for processing.
13.3 This Section 13 operates as the "Section 43-A" indemnification referenced in the ToS Section 42.3(e) carve-out, and is subject to the liability cap and carve-outs in ToS Section 42, except that liability arising from HUMANLAB's failure to meet its security obligations under Section 7 shall not be subject to the cap in ToS Section 42.2.
The Customer may request, no more than once per twelve (12)-month period (or following a security incident), reasonable evidence of HUMANLAB's compliance with this DPA, which may be satisfied through provision of relevant security certifications, audit summaries, or documented responses to a reasonable security questionnaire, in lieu of an on-site audit, unless an on-site or third-party audit is required by a regulator.
This DPA remains in effect for as long as HUMANLAB processes Patient Data on behalf of the Customer. Sections 8, 11, 13, and 14 shall survive termination of the ToS to the extent necessary to give them effect.