Terms of Service

3.1 Eligibility

The Services are intended for veterinary professionals, veterinary clinics and their authorised personnel. The Clinic is responsible for ensuring that its use of the Services complies with any professional, licensing or regulatory requirements applicable to it.

3.2 Regulatory Compliance

The Clinic is responsible for ensuring that its use of the Services complies with all applicable laws, regulations and professional requirements in the jurisdiction where the Services are used. Unless expressly stated otherwise by DeepScan, the Clinic is also responsible for determining whether the Services are suitable for use in its jurisdiction. DeepScan does not represent or warrant that every Service is approved, authorised or available in every jurisdiction.

3.3 Account Information

You must provide accurate and current registration information and keep relevant account information up to date. DeepScan may request reasonable information to verify a Clinic or User and may refuse, suspend or terminate access where information is materially inaccurate or where there are reasonable security, compliance or misuse concerns.

3.4 User Accounts

Each User must use their own authorised account unless DeepScan expressly permits another arrangement. Login credentials must not be shared with unauthorised persons. The Clinic is responsible for:

• determining who is authorised to use its account;
• promptly removing or requesting removal of access when a User no longer requires it;
• maintaining appropriate internal security controls; and
• activity carried out by its Users through the Services.

3.5 Security Incidents

You must promptly notify DeepScan at support@deepscandx.com if you become aware of suspected unauthorised access to the Portal or compromise of any User credentials.

4.1 Test Orders

A test order is submitted when the Clinic completes the applicable ordering process through the Portal or another method accepted by DeepScan. DeepScan may refuse an order where reasonably necessary, including because of Sample quality, technical limitations, regulatory requirements, suspected misuse or circumstances preventing reliable analysis.

4.2 Sample Collection and Submission

The Clinic is responsible for:

• collecting Samples in accordance with DeepScan's then-current collection instructions;
• ensuring that Samples are of sufficient quantity and quality;
• labelling Samples accurately;
• storing and shipping Samples in accordance with DeepScan's instructions;
• providing accurate information relevant to the Sample and test order; and
• ensuring that it has the necessary legal authority to collect and submit the Sample and associated information to DeepScan.

Where applicable, the Clinic is responsible for providing any notices or obtaining any permissions or consents required under applicable law or professional obligations.

4.3 Sample Quality

Biological Samples may deteriorate or become unsuitable for testing as a result of collection, storage, transport, temperature variation, insufficient quantity, contamination or other factors. DeepScan may reject or decline to analyse a Sample where DeepScan reasonably considers it unsuitable for reliable analysis.

Where analysis cannot be completed, DeepScan may, depending on the circumstances:

• request a replacement Sample;
• repeat the analysis;
• cancel the test; or
• issue an appropriate credit or refund.

Fees may remain payable where processing has already commenced or where failure results from circumstances outside DeepScan's reasonable control, including improper collection, handling or shipping.

4.4 Turnaround Times

Any turnaround time communicated by DeepScan is a target or estimate unless expressly agreed otherwise in writing. Turnaround times may be affected by Sample quality, transportation, laboratory capacity, technical issues, public holidays or circumstances outside DeepScan's reasonable control.

4.5 Residual Samples

Unless otherwise agreed with the Clinic or prohibited by applicable law, DeepScan may retain residual Sample material following completion of testing for purposes including:

• quality assurance and quality control;
• assay validation;
• technical troubleshooting;
• reference-range development;
• scientific research;
• development and improvement of DeepScan products and services; and
• development of new diagnostic methods and products.

Any personal data associated with retained Samples will be processed in accordance with applicable data-protection law, DeepScan's Privacy Policy and Schedule 1 where applicable. DeepScan is under no obligation to retain residual Samples following completion of testing and may destroy Samples at any time unless retention is required by applicable law or expressly agreed in writing.

4.6 Pilot Services

DeepScan may make preview, beta, pilot or experimental Services or features available from time to time. Such Services are provided on an “as available” basis, may contain errors or limitations, may be modified, suspended or withdrawn at any time and may be subject to additional terms. Unless expressly stated otherwise, beta or pilot Services are not intended for routine clinical use.

5.1 Veterinary Professional Use

Results are intended for interpretation by appropriately qualified veterinary professionals. Results provide information that may assist clinical assessment but are not intended to replace:

• clinical examination;
• professional veterinary judgement;
• patient history;
• imaging;
• pathology;
• other laboratory investigations; or
• other diagnostic procedures appropriate to the individual animal.

5.2 No Standalone Diagnosis

Unless DeepScan expressly states otherwise for a particular product, a CFD® Result is not a standalone diagnosis of a particular disease or condition. A Result may indicate biological changes consistent with increased cell-free DNA but does not necessarily identify:

• a particular disease;
• tumour type;
• anatomical location;
• cause of an abnormal result; or
• appropriate treatment.

A Result within an expected range does not exclude the presence of disease.

5.3 Interpretation and Reference Information

DeepScan may provide reference ranges, thresholds, longitudinal comparisons, algorithms or other interpretive information to assist veterinarians. These may take into account characteristics of the animal or DeepScan's underlying reference datasets. DeepScan may update its analytical methodology, algorithms, reference data, interpretive criteria or reporting as scientific evidence and the Services develop. Different versions of the Services may therefore produce different analytical or interpretive information.

5.4 Clinical Responsibility

All diagnoses, clinical decisions, treatment decisions and communications with animal owners remain the responsibility of the attending veterinarian and Clinic. DeepScan does not practise veterinary medicine on behalf of the Clinic and does not establish a veterinarian-client-patient relationship with an animal owner through provision of the Services.

5.5 Communication of Results

The Clinic may communicate Results to:

• the relevant animal owner;
• veterinary professionals involved in the animal's care;
• referral hospitals or laboratories involved in the animal's care;
• insurers or other parties where authorised by the owner or otherwise permitted by law; and
• authorities where disclosure is required by law.

The Clinic remains responsible for the clinical interpretation and communication of Results to animal owners.

6.1 Availability

DeepScan will use reasonable efforts to make the Portal and Services available but does not guarantee uninterrupted or error-free availability. Access may be interrupted for reasons including:

• maintenance;
• upgrades;
• cybersecurity measures;
• technical failures;
• third-party infrastructure failures; or
• circumstances outside DeepScan's reasonable control.

6.2 Changes to the Services

DeepScan may improve, modify or update the Services, including analytical methodologies, Portal functionality, reporting formats, sample requirements and available products. Where a change materially reduces an existing paid Service, DeepScan will provide reasonable advance notice where practicable. DeepScan may discontinue a Service on reasonable notice unless immediate discontinuation is reasonably necessary for safety, regulatory, technical or legal reasons.

7.1 Acceptable Use Requirements

You must use the Services lawfully, professionally and in accordance with these Terms.

7.2 Prohibited Activities

You must not:

• allow unauthorised persons to access the Portal;
• submit Samples or information that you are not authorised to submit;
• access another Clinic's account or information;
• attempt to circumvent Portal security;
• interfere with, overload, probe or disrupt DeepScan's systems;
• copy, reverse engineer, decompile or attempt to derive DeepScan's software, algorithms, analytical methodology or proprietary technology except to the extent such restriction is prohibited by mandatory law;
• use the Services or Results, directly or indirectly, to develop, train, validate, benchmark or improve a competing diagnostic product or service without DeepScan's prior written consent;
• access or use the Services through automated means, including bots, crawlers, scraping tools or similar technologies, except where expressly authorised by DeepScan through written consent;
• resell or commercially redistribute the Services or Results except as expressly agreed with DeepScan;
• make misleading claims regarding DeepScan, CFD® or the clinical meaning of Results;
• remove proprietary notices from DeepScan reports or materials; or
• use the Services in violation of applicable professional or regulatory requirements.

7.3 Export Controls and Sanctions

The Clinic represents that neither it nor any person using the Services on its behalf is subject to applicable sanctions or export restrictions that would prohibit use of the Services. The Clinic will not use the Services in violation of applicable export control or sanctions laws.

8.1 Fees

Applicable fees are set out in the relevant pricing schedule, order, proposal, quotation or other commercial agreement between DeepScan and the Clinic (“Fee Schedule”). Unless otherwise agreed in writing, DeepScan may update its standard fees on at least 30 days' notice. Updated fees apply prospectively and do not change the price of orders already accepted.

8.2 Invoicing

Unless otherwise agreed, invoices are payable within 14 days of the invoice date.

8.3 Late Payment

Overdue amounts may accrue late-payment interest at the rate applicable to commercial contracts under the Finnish Interest Act (633/1982), together with reasonable recovery costs permitted by applicable law. DeepScan may suspend further orders or access to paid Services where undisputed invoices remain materially overdue after reasonable notice.

8.4 Taxes

Fees are exclusive of VAT and other applicable taxes unless expressly stated otherwise. The Clinic is responsible for applicable taxes associated with its purchase of the Services, other than taxes imposed on DeepScan's income.

8.5 Invoice Disputes

A Clinic disputing an invoice in good faith should notify DeepScan at support@deepscandx.com without undue delay, identifying the disputed amount and basis for the dispute. Undisputed amounts remain payable when due.

9.1 DeepScan Intellectual Property

DeepScan and its licensors retain all rights, title and interest in and to:

• the CFD® technology and methodology;
• software and Portal;
• analytical pipelines;
• algorithms and models;
• databases and reference datasets;
• reporting formats;
• know-how;
• documentation;
• trademarks;
• inventions;
• improvements; and
• other technology or materials developed or provided by DeepScan.

No intellectual property rights are transferred to the Clinic except for the limited rights expressly granted in these Terms. Without limiting the foregoing, DeepScan retains all rights, title and interest in any improvements, modifications, discoveries, developments, analytical methods, statistical models, machine-learning models, algorithms, reference datasets, derived datasets, know-how and other intellectual property created, developed or improved through operation of the Services, including where informed by Samples, Clinic Data or Results.

9.2 Licence to Use Results

DeepScan grants the Clinic a non-exclusive, perpetual licence to use Results relating to its patients for:

• veterinary care;
• patient records;
• communications with animal owners;
• internal clinical purposes;
• regulatory and professional recordkeeping; and
• other purposes expressly permitted under these Terms.

The Clinic may continue using historical Results for these purposes after termination of its DeepScan account. The Clinic may not use DeepScan reports, branding or Results to imply an endorsement by DeepScan or to develop or market a competing diagnostic product without DeepScan's written consent.

9.3 Clinic Data

As between the parties, the Clinic retains its rights in Clinic Data submitted to the Services. The Clinic grants DeepScan the rights reasonably necessary to host, process, analyse and otherwise use Clinic Data to:

• provide the Services;
• produce Results;
• operate and secure the Portal;
• provide support;
• comply with applicable law; and
• exercise the rights expressly provided in these Terms.

9.4 Animal, Sample and Derived Data

Information relating solely to an animal is not personal data merely because it identifies or distinguishes that animal. Subject to applicable law and the provisions concerning owner personal data below, DeepScan may use animal-level, Sample-derived and analytical data generated through the Services for purposes including:

• research and development;
• validation;
• quality assurance;
• scientific analysis;
• development and improvement of reference datasets;
• development and improvement of algorithms and analytical methods;
• development of existing and future diagnostic products;
• statistical analysis and benchmarking; and
• regulatory, scientific and commercial development activities.

Animal-level data does not need to be aggregated solely because it relates to a particular animal, provided it is not linked to an identifiable owner in a manner that constitutes personal data. DeepScan may also use such data to develop, train, validate, evaluate and improve statistical models, machine-learning systems, artificial intelligence systems and other analytical methodologies. Nothing in these Terms limits DeepScan's ownership of or rights to use any aggregated, anonymised, pseudonymised, derived or analytical data that does not constitute personal data or Confidential Information of the Clinic.

9.5 Owner Personal Data

Where animal, Sample or Result information is linked to an identifiable animal owner, the information relating to that owner will be processed in accordance with applicable data-protection law, the Privacy Policy and Schedule 1 where applicable. DeepScan may create anonymous or otherwise non-personal datasets by removing the link between animal information and identifiable owner information. Once information has been irreversibly anonymised so that an owner can no longer reasonably be identified, DeepScan may retain and use the resulting non-personal data for the purposes described in Section 9.4.

9.6 Service Data

DeepScan may collect and use technical, operational and statistical information about use and performance of the Services, provided such information is used in accordance with applicable data-protection law.

9.7 Feedback

If the Clinic or its Users provide suggestions, ideas or feedback concerning the Services, DeepScan may use that feedback without restriction or obligation, provided DeepScan does not disclose the Clinic's Confidential Information in doing so.

9.8 Scientific Publications

Nothing in these Terms prevents DeepScan from publishing scientific, technical or commercial analyses based on information that DeepScan is entitled to use under these Terms, provided that no Clinic Confidential Information or personal data is disclosed in violation of applicable law or these Terms.

9.9 Historical Results

DeepScan may update analytical methodologies, algorithms, reference datasets and reporting over time. Unless expressly agreed otherwise, DeepScan is under no obligation to retrospectively reanalyse previously submitted Samples or regenerate historical Results using updated methodologies.

10.1 Privacy Policy

DeepScan's processing of personal data for its own purposes is described in its Privacy Policy, available through the Portal and at deepscandx.com/privacy-policy.

10.2 Controller and Processor Roles

Depending on the processing activity, DeepScan may act as a data controller or data processor. Where the Clinic submits identifiable owner personal data and DeepScan processes that information solely on behalf of and on the documented instructions of the Clinic:

• the Clinic acts as data controller;
• DeepScan acts as data processor; and
• the Data Processing Terms in Schedule 1 apply.

The Clinic is responsible for ensuring that it has an appropriate lawful basis for its processing and disclosure of personal data to DeepScan and for providing information to affected individuals where required by law. Where DeepScan processes personal data for purposes that it independently determines, DeepScan acts as a data controller for that processing and the Privacy Policy applies.

10.3 Data Protection Requests

Where DeepScan receives a data-subject request concerning personal data processed solely on behalf of a Clinic, DeepScan may refer the request to the Clinic and will provide reasonable assistance in accordance with Schedule 1 and applicable data-protection law.

11.1 Confidential Information

Each party may receive non-public information belonging to the other party in connection with the Services (“Confidential Information”). Confidential Information includes information that is marked confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure.

11.2 Obligations

Each party will:

• protect the other party's Confidential Information using reasonable care;
• use it only for purposes connected with the Services; and
• disclose it only to employees, contractors, professional advisers or service providers who reasonably need access and are subject to appropriate confidentiality obligations.

11.3 Exclusions

Confidentiality obligations do not apply to information that the receiving party can demonstrate:

• is publicly available other than through breach of these Terms;
• was lawfully known without restriction before disclosure;
• is independently developed without use of the other party's Confidential Information;
• is lawfully obtained from another source without confidentiality restrictions; or
• must be disclosed by applicable law or binding legal process.

Where legally permitted, the receiving party will provide reasonable notice before a legally required disclosure. Confidential Information does not include information generated independently by DeepScan through analysis of Samples or data where such information does not disclose the Clinic's Confidential Information.

11.4 Results

Results and patient information must be handled confidentially by the Clinic in accordance with applicable professional and legal obligations.

12.1 DeepScan

DeepScan will perform the Services with reasonable skill and care and in material accordance with the applicable service description.

12.2 Biological and Analytical Limitations

The Clinic acknowledges that biological testing is inherently subject to limitations and variability. DeepScan does not warrant that:

• every Sample can be successfully analysed;
• every Result will be free from analytical variation or error;
• CFD® will detect every instance of disease;
• a particular Result will correspond to a particular diagnosis;
• a Result will predict a particular clinical outcome; or
• the Services will be suitable as the sole basis for a clinical decision.

12.3 Clinic Warranties

The Clinic represents and warrants that:

• it has authority to enter into these Terms;
• its use of the Services complies with applicable law and professional requirements;
• it is entitled to submit Samples and information provided to DeepScan;
• information provided to DeepScan is accurate to the best of its knowledge; and
• Results will be interpreted and communicated by appropriately qualified veterinary professionals where professional interpretation is required.

12.4 Other Warranties

Except as expressly stated in these Terms, and to the extent permitted by applicable law, DeepScan excludes implied warranties, conditions and representations concerning the Services.

13.1 Liability Cap

Subject to Section 13.4, DeepScan's total aggregate liability for all claims arising out of or relating to the Services or these Terms, whether in contract, tort (including negligence), breach of statutory duty or otherwise, regardless of the number of claims, will not exceed the total fees paid or payable by the Clinic during the twelve months preceding the event giving rise to the first claim.

13.2 Excluded Losses

Subject to Section 13.4, neither party will be liable for:

• loss of profit;
• loss of revenue;
• loss of business;
• loss of anticipated savings;
• loss of goodwill;
• indirect or consequential loss; or
• loss arising from business interruption,

except to the extent such exclusion is prohibited by mandatory law.

13.3 Clinical Decisions

DeepScan is not responsible for diagnoses, treatment decisions or other clinical decisions made by the Clinic or a veterinarian. The Clinic remains responsible for assessing whether and how a Result should be used in the care of an animal. DeepScan will not be liable for losses resulting from the Clinic's failure to consider the limitations of a Result or from use of a Result contrary to these Terms or DeepScan's applicable instructions.

13.4 Liability That Cannot Be Limited

Nothing in these Terms excludes or limits liability to the extent that such liability cannot validly be excluded or limited under applicable law, including liability arising from fraud, intentional misconduct or, to the extent applicable, gross negligence.

13.5 Clinic Indemnity

The Clinic will indemnify DeepScan against third-party claims, losses and reasonable costs to the extent arising from:

• the Clinic's material breach of these Terms;
• unlawful submission of a Sample or personal data;
• unauthorised or misleading representations made by the Clinic concerning DeepScan or the Results;
• use of the Services in violation of applicable law; or
• misuse of Results by the Clinic.

This indemnity does not apply to the extent a claim results from DeepScan's own breach of these Terms, negligence or unlawful conduct.

14.1 Term

These Terms apply from the date the Clinic first accepts them or uses the Services and remain in effect while the Clinic continues using the Services.

14.2 Termination by the Clinic

The Clinic may stop using the Services and request closure of its account at any time by contacting support@deepscandx.com, subject to any separately agreed minimum term or commercial commitment. Termination does not cancel an order where Sample processing has already commenced or eliminate fees already incurred.

14.3 Suspension or Termination by DeepScan

DeepScan may suspend or terminate access immediately where reasonably necessary because:

• use of the Services creates a material security risk;
• there is suspected fraudulent, unlawful or abusive use;
• the Clinic seriously misuses Results;
• continued provision would violate applicable law; or
• undisputed amounts remain materially overdue following reasonable notice.

For other material breaches capable of remedy, DeepScan will ordinarily provide reasonable notice and an opportunity to remedy the breach before termination. DeepScan may also discontinue the Services on reasonable advance notice.

14.4 Effect of Termination

On termination:

• the Clinic must stop using Services to which access has ended;
• outstanding amounts remain payable;
• provisions intended by their nature to survive termination remain effective; and
• personal data will be retained, returned or deleted in accordance with the Privacy Policy, Schedule 1 and applicable law.

Termination does not prevent the Clinic from retaining and using Results already provided for patient records, veterinary care, legal compliance or other purposes permitted under Section 9.2.

16.1 Governing Law

These Terms and any contractual or non-contractual dispute arising out of or relating to them are governed by the laws of Finland, excluding its conflict-of-law rules.

16.2 Dispute Resolution

The parties will first seek to resolve disputes through good-faith discussions. If a dispute cannot be resolved amicably, it will be subject to the exclusive jurisdiction of the Helsinki District Court (Helsingin käräjäoikeus) as the court of first instance. A separate written commercial agreement may provide for a different dispute-resolution mechanism.

17.1 Agreement Structure

These Terms operate together with, as applicable:

• an order form;
• Fee Schedule;
• quotation or proposal;
• the Data Processing Terms in Schedule 1;
• Privacy Policy; and
• any separately executed commercial agreement.

Where a separately executed written commercial agreement expressly conflicts with these Terms, that agreement prevails for the subject matter of the conflict. For matters concerning processing of personal data by DeepScan as a data processor, Schedule 1 prevails over conflicting provisions of these Terms.

17.2 Changes to These Terms

DeepScan may update these Terms from time to time. Material changes will be communicated through the Portal or by email with reasonable advance notice, normally at least 30 days before taking effect. Changes may take effect sooner where reasonably necessary for legal, security or regulatory reasons. If a material change substantially and adversely affects an existing paid Service, the Clinic may stop using that Service before the change takes effect, subject to any separately negotiated agreement.

17.3 Assignment

The Clinic may not assign these Terms without DeepScan's prior written consent. DeepScan may assign these Terms to an affiliate or in connection with a merger, financing, restructuring, acquisition, sale of business or transfer of substantially all assets relating to the Services.

17.4 Severability

If any provision of these Terms is held invalid or unenforceable, the remaining provisions remain in effect.

17.5 Waiver

Failure to exercise a right under these Terms does not waive that right.

17.6 Relationship

The parties are independent contracting parties. Nothing in these Terms creates a partnership, joint venture, agency, employment or franchise relationship.

17.7 No Third-Party Rights

Except where expressly stated otherwise, these Terms do not give rights to persons who are not parties to them.

17.8 Notices

Legal notices to DeepScan under these Terms should be sent to:

DeepScan may provide notices to the Clinic through the Portal or to the email address associated with the Clinic's account.

1. Scope and Roles

These Data Processing Terms apply where DeepScan processes personal data on behalf of the Clinic in connection with the Services (“Processor Personal Data”). For such processing:

• the Clinic is the data controller; and
• DeepScan is the data processor.

These Data Processing Terms do not apply to processing for which DeepScan determines the purposes and means and therefore acts as an independent data controller. The Clinic instructs DeepScan to process Processor Personal Data as reasonably necessary to provide the Services and as otherwise documented in these Terms, the Clinic's use of the Services or written instructions agreed between the parties.

2. Details of the Processing

The Services are not intended to require the Clinic to submit special categories of personal data concerning animal owners unless expressly agreed with DeepScan.

3. Processing Instructions

DeepScan will process Processor Personal Data only:

• on documented instructions from the Clinic;
• as necessary to provide the Services; or
• where processing is required by applicable EU or Member State law.

If applicable law requires DeepScan to process Processor Personal Data contrary to or beyond the Clinic's instructions, DeepScan will inform the Clinic before doing so unless legally prohibited from providing that information. DeepScan will promptly inform the Clinic if, in its reasonable opinion, an instruction infringes applicable data-protection law.

4. Confidentiality and Security

DeepScan will ensure that persons authorised to process Processor Personal Data are subject to appropriate confidentiality obligations. DeepScan will maintain appropriate technical and organisational measures designed to protect Processor Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Depending on the nature of the processing, these measures may include:

• access controls and authentication;
• encryption in transit and, where appropriate, at rest;
• role-based access restrictions;
• logging and monitoring;
• backup and recovery measures;
• vulnerability and security management;
• incident-response procedures; and
• organisational security policies and staff controls.

DeepScan may update its security measures as technology, risks and the Services evolve, provided the overall level of protection is not materially reduced.

5. Personal Data Breaches

If DeepScan becomes aware of a personal data breach affecting Processor Personal Data, DeepScan will notify the Clinic without undue delay. DeepScan will provide information reasonably available to it that the Clinic may require to assess and, where necessary, notify the breach under applicable data-protection law. DeepScan's notification of a breach does not constitute an acknowledgement of fault or liability.

6. Subprocessors

The Clinic gives DeepScan general written authorisation to engage subprocessors where reasonably necessary to provide the Services. DeepScan will:

• engage subprocessors that provide appropriate data-protection and security guarantees;
• impose data-protection obligations on subprocessors that are no less protective in substance than those applicable to DeepScan under these Data Processing Terms; and
• remain responsible for the performance of its subprocessors' data-protection obligations to the extent required by applicable law.

DeepScan will maintain information about its current subprocessors and make it available to the Clinic through the Portal, website or on request. DeepScan will provide reasonable advance notice of a material addition or replacement of a subprocessor that processes Processor Personal Data. The Clinic may raise a reasonable data-protection objection to a new subprocessor. The parties will work in good faith to address the objection. If no reasonable solution is available, DeepScan may, where practicable, offer an alternative arrangement or the affected Service may be terminated.

7. Data Subject Rights

Taking into account the nature of the processing, DeepScan will provide reasonable assistance to the Clinic with requests from individuals exercising their rights under applicable data-protection law. If DeepScan receives such a request directly concerning Processor Personal Data, DeepScan will not independently respond to the substance of the request unless authorised by the Clinic or required by law. DeepScan may refer the individual to the Clinic and will notify the Clinic where reasonably practicable.

8. Compliance Assistance

Taking into account the nature of the processing and information available to DeepScan, DeepScan will provide reasonable assistance to the Clinic with its obligations relating to:

• security of processing;
• personal data breach notifications;
• data protection impact assessments; and
• consultations with supervisory authorities,

where those obligations relate to DeepScan's processing of Processor Personal Data.

9. International Transfers

DeepScan will not transfer Processor Personal Data outside the European Economic Area except:

• on the Clinic's documented instructions;
• to a country or recipient covered by an applicable adequacy decision; or
• using another lawful transfer mechanism under applicable data-protection law.

Where required, DeepScan may use safeguards such as the European Commission's Standard Contractual Clauses and supplementary measures. The Clinic authorises international transfers made by authorised subprocessors in accordance with this Section.

10. Return and Deletion

Following termination of the relevant Services, DeepScan will, at the Clinic's choice and subject to reasonable technical procedures, delete or return Processor Personal Data and delete remaining copies unless applicable law requires continued retention. The Clinic must communicate any request for return of Processor Personal Data within a reasonable period following termination. DeepScan may retain data:

• where required by applicable law;
• in secure backup systems until overwritten or deleted in accordance with normal backup cycles; or
• where DeepScan independently acts as data controller for the relevant processing.

Any Processor Personal Data retained under a legal obligation will remain protected in accordance with applicable data-protection requirements. These requirements do not require deletion of information that has been irreversibly anonymised and is no longer personal data.

11. Information and Audits

DeepScan will make available information reasonably necessary to demonstrate compliance with its obligations as a processor under applicable data-protection law. Where reasonably sufficient, DeepScan may satisfy this obligation by providing:

• relevant policies or security information;
• third-party certifications or audit reports;
• responses to reasonable security or compliance questionnaires; or
• other appropriate documentation.

Where this information is not reasonably sufficient, the Clinic may request an audit relating specifically to DeepScan's processing of Processor Personal Data. Unless required by a supervisory authority or following a material security incident or substantiated compliance concern, audits will:

• occur no more than once in any 12-month period;
• be conducted on reasonable advance notice;
• take place during normal business hours;
• avoid unreasonable disruption to DeepScan's operations;
• comply with DeepScan's reasonable security and confidentiality requirements; and
• be conducted at the Clinic's expense.

If an audit identifies material non-compliance by DeepScan, DeepScan will take reasonable steps to remedy it, and reasonable audit costs directly attributable to that material non-compliance may be borne by DeepScan. Audits will not include access to DeepScan's source code, proprietary algorithms, trade secrets, confidential information relating to other customers or information that could reasonably compromise the security or integrity of the Services.

12. Controller Responsibilities

The Clinic is responsible for:

• complying with its obligations as data controller;
• ensuring that Processor Personal Data is collected and disclosed lawfully;
• providing required privacy information to individuals;
• determining an appropriate lawful basis for processing;
• issuing lawful and appropriate processing instructions to DeepScan;
• ensuring that personal data submitted to DeepScan is adequate, relevant and limited to what is necessary; and
• assessing whether the Services and DeepScan's safeguards are appropriate for the Clinic's processing activities.

13. Order of Precedence

If these Data Processing Terms conflict with another provision of the Terms concerning DeepScan's processing of Processor Personal Data as a processor, these Data Processing Terms prevail. If the Clinic and DeepScan later enter into a separately executed data processing agreement covering the same processing, that agreement will replace this Schedule for the processing it covers.