Corsmed Data Processing Agreement

This Data Processing Agreement (“DPA”) applies to Corsmed’s provision of an educational MRI simulation software platform for the purpose of facilitating the education of current and future MRI personnel, such as students, radiographers, technologists, radiologists, engineers, researchers, consultants and other healthcare professionals, as further described on https://www.corsmed.com/ (the “Services”) and is an integral part of the agreement between Corsmed AB, reg. no. 559093-1779 (“Corsmed”), and the customer (the “Customer”), consisting of Corsmed’s General Terms and Conditions (the “Terms”) and the applicable Order Confirmation(s) (together, the “Agreement”).

Corsmed and Customer are hereinafter also referred to as a “Party” and together as “Parties”. Any capitalized terms used herein shall have the same meaning as defined in the Agreement unless specifically defined otherwise in this DPA.

1. The Services

1.1 As part of the Services provided under the Agreement, Corsmed will be processing certain personal data on behalf of the Customer. Customer is the data controller and Corsmed is the data processor regarding the processing of personal data described herein.

1.2 This DPA governs the conditions for Corsmed’s processing of, and access to personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (”GDPR”), the UK GDPR (as defined in section 3(10) of the UK Data Protection Act 2018) and the UK Data Protection Act 2018, to the extent applicable, and other relevant data protection legislation (all together ”Data Protection Legislation”). Where the UK GDPR applies, references in this DPA to the GDPR and to EU or Member State law shall be read as references to the UK GDPR and the laws of the United Kingdom, as applicable.

1.3 The DPA consists of this document and the Schedules. In the event of any contradictions between this document and the Schedules or the Agreement, this document shall take precedence.

1.4 For the avoidance of doubt, the Customer’s written instructions regarding Corsmed’s processing of Included Personal Data are set out in this DPA and specifically in Schedule 1 (Instruction). Any additional instructions must be provided separately in writing and accepted by Corsmed.

1.5 All terms defined in Article 4 of the GDPR shall have the same meaning in the DPA, unless expressly stated otherwise.

1.6 This DPA is published at https://www.corsmed.com/legal/dpa and forms part of the Agreement pursuant to Section 8 of the Terms. It applies without a separate signature. Upon the Customer’s request, Corsmed will provide a copy of this DPA signed by Corsmed. If the Customer and Corsmed have signed a separate data processing agreement, that agreement applies instead.

2. Scope of processing

2.1 The personal data processed under this DPA ("Included Personal Data”) is described in Schedule 1.

2.2 Corsmed shall only process Included Personal Data in accordance with the Customer’s written instructions, which are set out in this DPA and specifically detailed in Schedule 1, unless further processing is required under applicable EU or Member State law to which Corsmed is subject. In such case Corsmed shall inform the Customer of this legal obligation unless such disclosure is prohibited by law. Corsmed shall immediately inform the Customer if, in Corsmed’s opinion, an instruction infringes Data Protection Legislation.

3. Security and assistance

3.1 Corsmed will apply suitable technical and organizational safeguards to protect Included Personal Data, as required under Article 32 of the GDPR. This includes implementing measures for preventing accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to the Included Personal Data. Corsmed’s security measures are listed in Schedule 2 and further described in Corsmed’s Security Policy, available at https://www.corsmed.com/legal/security, as updated from time to time. Corsmed may update its security measures, provided that such updates do not materially reduce the overall level of protection of Included Personal Data.

3.2 Corsmed shall assist the Customer in fulfilling its obligations under Articles 32 to 36 in the GDPR, especially regarding the security of processing and personal data breaches. Corsmed shall notify the Customer without undue delay and within 48 hours after Corsmed has learned of a personal data breach affecting the Included Personal Data.

3.3 Corsmed will assist the Customer in meeting its obligations under Chapter III of the GDPR, including data subject rights such as access, deletion, correction, and data portability. Corsmed will notify the Customer without undue delay of any such requests from data subjects.

4. Sub-processing

4.1 Corsmed has the Customer’s general authorization to engage sub-processors for the processing of Included Personal Data on behalf of Customer (“Sub-processors”), provided that if Corsmed engages Sub-processors, Corsmed shall enter into a sub-processing agreement with the same obligations as in this DPA. The Customer’s general authorization under this Section 4 constitutes the Customer’s consent to the disclosure of Included Personal Data to Sub-processors engaged in accordance with this DPA, including for the purposes of Section 5.3 of the Terms.

4.2 Corsmed shall notify the Customer by publishing the intended change on Corsmed’s sub-processor page at https://www.corsmed.com/legal/processors (the “Sub-processor Page”) at least 14 days in advance of any intended addition or replacement of a Sub-processor. Corsmed will also notify by e-mail any Customer that has subscribed to such notifications via the Sub-processor Page or by e-mail to info@corsmed.com. The Customer is otherwise responsible for regularly checking the Sub-processor Page for such updates. The Customer is entitled to object to such changes, based on objective grounds relating to the security of the processing under the DPA. If the Customer has not objected prior to the change taking effect, the Customer is assumed to have approved the engagement. If the Customer makes an objection and Corsmed does not accept to replace the Sub-processor or refrain from using it, either Party is entitled to terminate the affected service, by giving the other Party 30 days’ written notice. Where Corsmed needs to add or replace a Sub-processor urgently, for example for reasons of security or service continuity or because a Sub-processor ceases to provide its services, Corsmed may do so on shorter notice. In such case, Corsmed shall notify the Customer as soon as reasonably possible, and the Customer’s right to object and terminate under this Section 4.2 shall apply accordingly.

4.3 Corsmed shall be fully liable for the actions and performance of any Sub-processors engaged in the processing of Included Personal Data on behalf of the Customer.

4.4 Corsmed shall maintain an updated list of Sub-processors and shall submit a copy of the list to the Customer upon request. The current Sub-processors are listed in Schedule 3 and on the Sub-processor Page. Where the Sub-processor Page has been updated in accordance with Section 4.2, the Sub-processor Page shall prevail over Schedule 3.

5. Third country transfers

Corsmed has the Customer’s general authorization to, by itself or through its Sub-processors, process Included Personal Data outside of the European Economic Area (EEA) or, where the UK GDPR applies, outside the United Kingdom, provided that prior to commencing such transfer or provision of access, Corsmed or Sub-processor, as applicable, meets the requirements and undertakings regarding third-country transfers under the GDPR, including implementation of an appropriate transfer mechanism such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or participation in an approved adequacy framework (e.g. EU–U.S. Data Privacy Framework). Corsmed shall upon request provide the Customer with information on the specific transfer mechanism applied. The transfer mechanism relied on for each Sub-processor is set out in Schedule 3.

For transfers subject to the UK GDPR, the appropriate transfer mechanism may be the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner, the UK International Data Transfer Agreement, or UK adequacy regulations (including the UK Extension to the EU–U.S. Data Privacy Framework), or any other mechanism permitted under the UK GDPR, as applicable.

6. Confidentiality

6.1 Corsmed shall restrict access to Included Personal Data solely to those of its employees, consultants, representatives and Sub-processors who require access for the sole purpose of providing the Services. Corsmed shall ensure that all such employees, consultants, representatives and Sub-processors are bound by confidentiality, either through commitment or statutory obligation.

6.2 Corsmed shall not disclose Included Personal Data or any information related to its processing under this DPA to third parties without express instruction from the Customer. This obligation excludes:

(a) disclosure to Sub-processors for fulfilment of their obligations under a sub-processing agreement,

(b) information that is publicly known (due to other reasons than a breach of the DPA),

(c) information compelled by mandatory law or regulation. In such cases, Corsmed shall promptly inform Customer and request guidance.

6.3 The confidentiality obligations herein shall apply without limitation in time.

7. Audit and inspection

7.1 Corsmed shall, upon the Customer’s written request and without undue delay, make available to the Customer all information reasonably necessary to demonstrate Corsmed’s compliance with this DPA and Article 28 of the GDPR. Such information may include this DPA, Corsmed’s Security Policy, the current list of Sub-processors and available certifications or audit reports of Corsmed’s hosting providers.

7.2 If the information provided under Section 7.1 is not reasonably sufficient to demonstrate such compliance, or if an audit is required by a supervisory authority, Corsmed shall allow for and contribute to audits, including inspections, conducted by the Customer or by an independent auditor mandated by the Customer, provided that:

(a) the Customer gives Corsmed at least 10 business days’ written notice;

(b) audits take place no more than once per calendar year, unless required by a supervisory authority or following a personal data breach affecting Included Personal Data;

(c) the audit is conducted during normal business hours and without unreasonable disruption to Corsmed’s operations; and

(d) the auditor is bound by appropriate confidentiality obligations and is not a competitor of Corsmed.

7.3 Audits shall not give access to data relating to Corsmed’s other customers, or to Corsmed’s trade secrets beyond what is necessary for the audit. With respect to Sub-processors, Corsmed may fulfil its obligations under this Section 7 by providing the relevant Sub-processor’s audit reports or certifications. The Customer shall bear its own costs and the costs of any auditor mandated by the Customer.

8. Term and termination

8.1 The DPA shall remain in force as long as Corsmed processes personal data on behalf of the Customer.

8.2 Corsmed shall upon termination of the Agreement or upon notice from the Customer, at the Customer’s choice, return or delete all Included Personal Data processed under the DPA, unless Corsmed is required to retain such to comply with mandatory law or regulation.

8.3 Unless otherwise instructed by the Customer, Corsmed will delete Included Personal Data within three (3) months from termination or expiry of the Agreement, but not before the expiry of the period during which the Customer may request a copy of its data under Section 10.5 of the Terms. Copies held in Corsmed’s backups will be deleted or overwritten in the ordinary course of Corsmed’s backup cycle, and in any event within ninety (90) days, and shall, until then, remain protected in accordance with this DPA.

8.4 Where the Customer instructs Corsmed during the term of the Agreement to delete specific Included Personal Data, for example an individual Authorized User’s account, Corsmed shall do so without undue delay and no later than thirty (30) days after receiving the instruction.

8.5 The Customer instructs Corsmed that, when an Authorized User’s access under the Agreement ends, the Authorized User’s account may continue as a free account under the Authorized User’s own agreement with Corsmed, unless the Customer instructs Corsmed to delete it (generally or for individual Authorized Users). From that point, Corsmed processes that account data as an independent controller in accordance with Corsmed’s Privacy Policy, and Sections 8.2 and 8.3 shall not apply to it. Corsmed shall inform the Authorized User when the account continues as a free account. Customer Material is not included in the free account.

9. Notices

Unless otherwise specified, all notices under this DPA must be in writing and sent by e-mail to info@corsmed.com in the case of notices to Corsmed, and to the e-mail address of the Customer’s contact person or administrator stated in the Order Confirmation or registered in the Customer’s account in the case of notices to the Customer. Notices are deemed received on the date of transmission, provided the sender does not receive a delivery failure message. Either Party may change its e-mail address for notices by providing written notice to the other Party.

10. Compensation

Corsmed shall be entitled to reasonable compensation for all work and all costs that arise due to Customer’s instructions for processing if these exceed the features and level of security that Corsmed normally applies to its services or provides to its customers, e.g., in the case that Corsmed’s systems and/or Services require special adjustments or development following special requests from Customer. Corsmed is not entitled to compensation for costs arising directly under applicable Data Protection Legislation.

11. Liability and indemnification

Subject to mandatory law, the limitations of liability set out in the Agreement shall apply to this DPA. Notwithstanding the above, the Parties acknowledge that each Party shall bear any administrative fines pursuant to GDPR Article 83 imposed on the Party by the relevant supervisory authority.

12. Governing law and dispute resolution

This DPA shall be governed by the substantive law of Sweden. Disputes arising from this DPA shall be finally settled in accordance with the resolution of disputes clause stated in the Agreement.

Schedule 1

INSTRUCTION

Schedule 2

SECURITY MEASURES

Corsmed applies the following technical and organisational measures to protect Included Personal Data. Further details are set out in Corsmed’s Security Policy, available at https://www.corsmed.com/legal/security.

• Hosting and physical security: The Services are hosted by Amazon Web Services (mainly eu-west-1, Ireland, and us-east-1, N. Virginia) and Google Cloud Platform (EU and US regions), whose data centres are accredited under ISO 27001, SOC 1 and SOC 2, PCI DSS Level 1 and FISMA Moderate. Physical access to Corsmed’s office premises is restricted to authorised staff.

• Access control: Access to systems and Included Personal Data follows the principle of least privilege. Two-factor authentication is used wherever possible for systems containing user data, SSH keys are password-protected, and a certified password manager and strong passwords are required. Access levels are reviewed yearly, and all access is revoked when employment or an engagement ends.

• Personnel: All personnel with access to user information are bound by confidentiality undertakings, have their identity and stated background verified at onboarding, and receive security training at the start of employment and yearly thereafter.

• Encryption: Included Personal Data is encrypted at rest. TLS is used on all connections, so data is encrypted in transit between users’ browsers and Corsmed’s servers.

• Segregation: Customer data is logically separated to ensure integrity and confidentiality.

• User authentication: User passwords are hashed and salted and are never visible to Corsmed. Users can reset their passwords themselves by e-mail, and inactive sessions are automatically timed out.

• Payment data: Card payments are processed by Stripe, a PCI DSS-compliant payment processor. Corsmed never sees or handles card details.

• Availability and resilience: Data is backed up continuously, and an automatic failover system is in place if the main system fails.

• Secure development: Code conventions enforced by static code analysis, peer review of all code, continuous integration and testing, well-known frameworks protecting against common attack vectors (such as XSS, CSRF and SQL injection), continuous updating of libraries, and passwords and secrets kept in password safes or configuration.

• Vulnerability management: Regular penetration testing by a third-party vendor, with findings rated under CVSS. High-severity vulnerabilities are fixed within two weeks, medium within six weeks and low within eight weeks.

• Workstation security: Firewalls are enabled on all workstations, screens are locked when unattended, and firewall settings are verified yearly.

• Incident management: A documented incident management process is in place. Security incidents are reported to the CEO, documented and evaluated, and an action plan with mitigating measures is made for each incident. Personal data breaches affecting Included Personal Data are notified to the Customer in accordance with Section 3.2.

• Use of AI tools: AI services are used only through Corsmed-approved business accounts covered by a data processing agreement, under which the providers may not use Customer data to train their models.

• Review: These measures and the Security Policy are reviewed at planned intervals and whenever significant changes occur.

Schedule 3

SUB-PROCESSORS

The Customer approves that Corsmed engages the following Sub-processors as at the date of this DPA:

The current list of Sub-processors is maintained on the Sub-processor Page at https://www.corsmed.com/legal/processors. Where a Sub-processor processes Included Personal Data only within the EU/EEA or in a country covered by an adequacy decision, no further transfer mechanism is required.