Data Processing Agreement

Version 1.11 — effective 28 October 2026

Parties and application

This Data Processing Agreement, or DPA, is made between the customer identified in the account, checkout or order form, as controller, and SYNRADX TECHNOLOGIES S.R.L., with its registered office at Municipiul Brașov, Județul Brașov, Strada Zaharia Stancu, No. 8, Block 4, Floor 6, Apartment 601, Romania, tax ID 55403248, trade register J2026049057009, as processor.

Share capital: RON 1,000.

The DPA forms part of the IMORAY contract where the customer uses the service to process personal data in its own activities. Where a party independently determines a processing purpose, it is a separate controller for that activity.

Account, contract, billing and security data, including addresses and links to seats predesignated by the customer for a team order, are processed by SYNRADX for its own contracting, grant and reconciliation purposes described in the Privacy Notice. Those activities do not become customer instructions merely because they occur within the same commercial relationship. The DPA continues to apply to content and data processed on the customer's behalf.

Subject, duration and purpose

SYNRADX processes data on the customer's behalf to deliver, secure, maintain and support IMORAY during the contract and a limited return, recovery and deletion period.

Operations may include receiving, transmitting, organising, structuring, limited storage, display, retrieval, deletion and technical support. The purpose is to deliver customer-requested features: account, dictation, transcription, editable reports, impressions, revision, comparison, text OCR, templates, Pathology Summary, Xira and service administration.

Data subjects and data

Data subjects may include authorised users, customer personnel and contractors and, only where the customer lawfully enters anonymised or pseudonymised content, individuals referred to in professional documentation.

Data categories may include:

• professional identity, contact details and role;
• account, session and device identifiers;
• temporary audio dictation, dictated text, editable reports, impressions, templates, instructions and comparisons;
• anonymised images uploaded for text OCR;
• health data that may arise from professional content, without IMORAY requesting direct identifiers;
• usage, security, support and billing metadata.

The customer is not authorised to provide patient names, national identification numbers, contact details, case numbers or other direct patient identifiers. Criminal-conviction data, genetic data or other special categories must not be entered unless necessary, contractually permitted and protected by documented instructions.

Customer instructions

The terms, account configuration, user actions and authorised written requests constitute documented instructions. SYNRADX processes data only on those instructions unless legally required; where permitted, it informs the customer before legally required processing.

If an instruction appears to infringe the GDPR, SYNRADX informs the customer and may suspend the affected operation pending clarification.

Customer obligations

The customer:

• determines purposes, the Article 6 basis and, for health data, the Article 9 condition;
• gives required notices and respects data-subject rights;
• authorises only trained users and applies minimisation and anonymisation;
• verifies AI output and retains professional responsibility;
• configures retention, export and deletion according to its duties;
• does not use email or support channels for patient data.

SYNRADX obligations

SYNRADX:

• ensures authorised persons are bound by confidentiality;
• applies proportionate technical and organisational measures;
• assists the customer, taking account of the processing, with rights, security, incidents, DPIAs and prior consultation;
• keeps necessary records and supplies reasonable compliance information;
• does not sell data, use it for advertising or use clinical content to train its own general-purpose model;
• deletes or returns data on termination, subject to rotating backups and legal duties.

Technical and organisational measures

Measures include where appropriate:

• managed hosting in the configured European region and environment separation;
• TLS in transit and managed-service encryption at rest;
• opaque sessions, password and token hashing, role-based and least-necessary access;
• Secret Manager, credential separation and additional authentication for critical access;
• route authorisation, account isolation, validation, rate limiting, cost controls and fail-closed behaviour;
• controlled logs and intentional exclusion of clinical bodies from operational telemetry;
• backup, restoration, rollback, automated testing and vulnerability management;
• procedures for incidents, support access, deletion and change management.

Further information is in the Security Overview.

Subprocessors

The customer grants general authorisation for the public subprocessor list. SYNRADX imposes suitable data-protection duties and remains responsible to the customer for subprocessor performance within the GDPR and contract.

For a new subprocessor handling customer content, SYNRADX gives reasonable notice, ordinarily 30 days where practical. The customer may object on reasoned grounds; the parties will seek a reasonable alternative or may terminate the affected component.

International transfers

SYNRADX does not transfer data outside the EEA without a valid mechanism such as an adequacy decision, Standard Contractual Clauses or an applicable derogation and applies supplementary measures where assessment requires. The customer authorises transfers described in the subprocessor list and provider contracts.

Data-subject rights

If SYNRADX directly receives a request concerning data for which the customer is controller, it forwards the request without responding on substance unless instructed or legally required. SYNRADX provides reasonable features and assistance for access, rectification, erasure, restriction and portability.

Personal data breaches

SYNRADX notifies the customer without undue delay after confirming a personal data breach concerning data processed on the customer's behalf. Notice includes available information on nature, categories, consequences and measures. Communication is not an admission of fault.

Audit and compliance information

On reasonable request, SYNRADX supplies relevant available documentation. If insufficient, the customer may request no more than one audit per year during business hours, on notice, under confidentiality, without access to others' data and at customer cost unless a material breach is confirmed. Additional audits are allowed after a material incident or at an authority's request.

Return and deletion

The customer should export required data before termination. After termination or a valid deletion request, active data is deleted or anonymised after the displayed recovery period, ordinarily 30 days. Backup copies are isolated from current use and removed through rotation, ordinarily within 90 days, unless law, litigation or security requires longer.

Local browser data is also customer-controlled; logout and cleanup remove account-related data and the audio queue, while device preferences may require clearing site data.

Liability, law and contact

Liability is governed by the main contract and limits permitted by the GDPR. The DPA is governed by Romanian law without affecting supervisory-authority powers or mandatory data-subject rights.

Privacy contact: privacy@imoray.app. Security contact: security@imoray.app. Do not include patient data in email.

Priority and changes

For personal-data processing, the DPA prevails over general terms in a conflict. A material change will be communicated under the contract; a substantial reduction of protection will not apply retroactively without a valid basis.