Data Processing Agreement

Introduction and Purpose

This Data Processing Agreement ("DPA") establishes the terms for processing personal data between Aeva Limited ("Processor") and the medical clinic ("Controller"), ensuring compliance with applicable data protection laws while enabling effective operation of Aeva's AI call receptionist service.

This agreement addresses requirements from major privacy frameworks including GDPR, APP, and NZPP, using framework-neutral language where possible.

Scope of Agreement

This DPA applies to all processing of personal data performed by Aeva, including:

• Collection and storage of call recordings and transcripts
• Processing of patient appointment information
• Data transfers between Aeva and authorized subprocessors
• Security measures, data subject requests, and breach management

Note: This DPA supplements existing service agreements between Aeva and the clinic.

Parties and Processing Details

Data Controller Information

The medical clinic should provide:

• Legal entity name and registration details
• Business address and contact information
• Authorized representative details

Data Processor Information

• Legal Entity: Aeva Limited
• Location: New Zealand
• Contacts: Louis (Technical) and Chris (Security), Co-founders
• Representatives: Chris or Louis as authorized signatories

Nature and Purpose

Core Processing Activities:

• Processing call recordings and transcripts
• Analyzing call content using AI
• Managing patient appointment information

Processing Purposes:

• Providing AI receptionist services for medical clinics
• Automating appointment scheduling
• Improving clinic efficiency and patient experience

Data Categories and Subjects

Data Types:

• Patient names, phone numbers, dates of birth and other contact details collected on calls
• Appointment information
• Call recordings and transcripts
• Clinic staff information
• Technical data (e.g., practice-management credentials, stored encrypted)

Data Subjects:

• Patients of the medical clinic
• Clinic staff and representatives
• Callers to the medical clinic

Duration of Processing

• Term of the subscription agreement
• Up to 60 days after termination, for data deletion (see Data Return or Deletion)

Processor Obligations

Processing Instructions

Aeva will process personal data only on documented instructions from the clinic, maintaining records of all processing activities, seeking clarification when needed, and notifying the clinic of any instructions that may violate data protection laws. The clinic, as controller, is responsible for determining and maintaining a lawful basis for the processing, including under Article 6 and, where applicable, Article 9 of the GDPR or UK GDPR.

Confidentiality and Security Measures

Aeva ensures that all personnel:

• Sign confidentiality agreements
• Receive data protection training
• Access data only as necessary

Technical Measures:

• Multi-factor authentication
• Encryption in transit and at rest
• Heroku database encryption
• Regular security testing

Subprocessor Management

Aeva will:

• Obtain prior authorization before engaging new subprocessors
• Maintain an up-to-date list (current subprocessors: Microsoft Azure, Heroku (Salesforce), Vapi, Twilio, Soniox, AssemblyAI, ElevenLabs, Cartesia, Google, OpenAI, Anthropic, Cerebras, ClickSend, Postmark, Stripe, SolarWinds, Slack, Intercom, HubSpot, GoHighLevel, Google Workspace; purposes and locations are set out in our Privacy Policy). The clinic's practice-management system is the clinic's own system, accessed on its behalf, and is not an Aeva subprocessor.
• Impose equivalent data protection obligations
• Provide 30 days notice for new subprocessors
• Remain liable for subprocessor performance

Data Subject Rights and Breach Management

Data Subject Requests

Aeva will support the clinic with:

• Forwarding direct requests within 2 business days
• Providing technical assistance within 5 business days
• Supporting access, correction, erasure, and portability requests
• Maintaining records of all requests and actions taken

Data Breach Handling

In case of a breach, Aeva will:

• Notify the clinic without undue delay, and within 24 hours of becoming aware of the breach
• Provide details on scope, affected subjects, consequences, and measures taken
• Assist with notifications to authorities and affected individuals
• Document incident details and maintain records for 5 years

International Transfers and Compliance

Transfer Safeguards

For international data transfers, Aeva implements:

• Call recordings, transcripts and call logs are stored in Australia (Microsoft Azure). Real-time call processing and AI analysis occur in the United States, and Aeva's application database is hosted in the United States, under the safeguards below.
• Standard Contractual Clauses for transfers outside adequate jurisdictions
• For UK personal data: the UK Addendum to the EU SCCs or the UK International Data Transfer Agreement (IDTA), or reliance on the UK Extension to the EU–US Data Privacy Framework where the subprocessor is certified; transfers to Aeva in New Zealand are covered by UK adequacy regulations
• Technical measures including encryption and access controls
• Regular assessment of subprocessor privacy practices
• For Australian and New Zealand personal information: overseas disclosures are made under APP 8 and IPP 12, with recipients contractually bound to protect the information and Aeva remaining accountable for its handling

Audit and Compliance

The clinic may audit Aeva's data protection practices with 30 days notice. Aeva will:

• Provide documentation of security measures
• Maintain processing records
• Demonstrate staff training
• Share incident response procedures
• Notify the clinic of regulatory requests

Termination and General Provisions

Data Return or Deletion

Upon termination, Aeva will:

• Return data in machine-readable format if requested
• Delete all call recordings, transcripts, call logs and patient-related data within 60 days of termination
• Retain only the clinic's account record (clinic name, staff user logins, settings and billing history) for reactivation and legal and tax obligations, and delete it on request. The account record contains no patient data.
• Provide deletion confirmation within 30 days
• Offer 30 days of transition support

Liability and Governing Law

Aeva will indemnify the clinic for damages resulting from:

• DPA breaches
• Unauthorized processing
• Security failures
• Subprocessor violations

This DPA is governed by New Zealand law and applicable data protection laws in the clinic's jurisdiction, with the higher standard of protection taking precedence in conflicts.

Amendment Process

Changes require written documentation signed by authorized representatives, with emergency changes for critical data protection implemented immediately and documented within 5 business days.

Contact Information

For questions regarding this Data Processing Agreement, please contact:

This DPA forms part of Aeva's Terms and Conditions and applies automatically to all processing of personal data on a clinic's behalf when the clinic accepts those Terms. Aeva will countersign a copy of this DPA on request.