Practice agreements

NuviaMy Data Processing Agreement

Version NUVIA DPA 2026 10 29 standard v2

This agreement governs personal data handled by Richard Andres Marles Bonilla, trading as NuviaMy, on behalf of the professional customer identified below. It supplements the customer’s accepted service agreement. The Standard Processing Schedule forms part of this agreement.

1 Parties and representatives

Provider and processor: Richard Andres Marles Bonilla, trading as NuviaMy, Calle Paciente Inglés 22, 50019 Zaragoza, Spain. Contract and privacy contact: richard@nuviamy.com. Operational contact: support@nuviamy.com. Fiscal identification is supplied through the legal notice and contractual records; it is not repeated in this agreement.

The Customer is the legal entity or sole practitioner named in the electronic acceptance receipt, at its recorded registered address and country. The receipt identifies the workspace, authorized representative and title, account email and acceptance time. The account email is the monitored contract, privacy and incident contact.

The Customer determines the purposes and essential means of its practice-record processing. If it acts for another controller, it identifies that controller and its authority in the Schedule; NuviaMy then acts as a subprocessor. Account administration, NuviaMy subscription invoicing and its own statutory business records are handled separately under the privacy notice, rather than automatically being Customer-controlled processing under this agreement.

2 Scope and commencement

The retained receipt identifies the exact accepted Terms of Use, this DPA and the Standard Processing Schedule, with their versions, full texts and acceptance time. The Schedule identifies the subjects, data, operations, purposes, duration, locations, safeguards, recipients and exit instructions covered by this agreement.

This agreement takes effect when the authorized Customer representative accepts this published offer electronically, during signup or from Contracts. It covers the free trial and subsequent subscription without a second signature on conversion. The Standard Processing Schedule defines the ordinary service scope; excluded data and external integrations require a separate arrangement. Duties arising from data actually received remain enforceable.

The parties shall meet the data-protection laws applicable to their respective activities. The processor obligations below are contractual commitments modeled on GDPR Article 28 and apply to the agreed processing; they do not represent that every Customer is itself territorially subject to GDPR. A BAA is additionally required where HIPAA applies. This agreement is not an international-transfer standard contractual clause, patient authorization or clinical certification.

3 Instructions and permitted purposes

NuviaMy shall process Customer data only to provide the operations described in the Schedule and on documented Customer instructions, including instructions about transfers. Instructions consist of this agreement, the Standard Processing Schedule, authorized workspace actions and authenticated written service requests. The Customer shall provide lawful instructions, the necessary notices and legal grounds for its practice processing, including any applicable condition for health data.

If Union or Member State law binding NuviaMy requires processing outside those instructions, NuviaMy shall inform the Customer before processing unless the law prohibits that information. NuviaMy shall promptly flag an instruction it believes infringes applicable data-protection law, suspend the affected instruction where necessary, and seek clarification. It shall not suspend unrelated lawful access unnecessarily. Other legal demands shall be assessed under applicable data-protection and transfer law before disclosure.

NuviaMy shall not sell Customer clinical data, use it for advertising or AI model training, combine it for an independent commercial purpose, or create an independent de-identified dataset under this agreement. Any additional purpose requires a separate lawful arrangement and documented instructions where required.

4 Confidentiality and access

Persons authorized by NuviaMy to process Customer data shall be bound by confidentiality obligations or an appropriate statutory duty. NuviaMy shall limit and review access according to assigned duties. Support access shall be restricted to an authenticated request, incident response or other documented operational necessity, with an audit record appropriate to the activity. Confidentiality survives the end of the service.

The Customer shall manage its personnel, grant appropriate permissions, remove access when no longer needed and protect its accounts and devices. These duties do not transfer NuviaMy’s own security responsibilities to the Customer.

5 Security and continuity

NuviaMy shall implement and maintain technical and organizational measures appropriate to the risks and applicable law, including GDPR Article 32 where applicable. The accepted Standard Processing Schedule shall specify the implemented measures and division of responsibilities for authentication, authorization, audit, encryption and keys, uploads, backups, recovery, incident handling and testing.

Measures shall be reviewed when risks, services or locations materially change. NuviaMy shall not materially reduce the agreed protection without a lawful, documented replacement. No uptime, response time, recovery point, recovery time, security certification or universal encryption coverage is promised unless expressly stated in the Standard Processing Schedule. This does not limit mandatory security obligations.

6 Subprocessors

The Customer gives general written authorization only for subprocessors expressly listed as authorized in the Standard Processing Schedule, for their stated functions and locations. Listing a commercial brand in an inventory is not authorization and does not demonstrate an executed contract. Before a subprocessor begins the processing, NuviaMy shall bind it to substantially the same applicable data-protection duties, including safeguards and confidentiality. NuviaMy remains responsible to the Customer for the subprocessor’s performance of those duties as required by applicable law.

NuviaMy shall give at least 30 calendar days’ prior written notice of an intended addition or replacement, with enough information for review. The Customer may object on reasonable data-protection grounds during that period. The parties shall seek an alternative; the disputed subprocessor shall not receive affected data before the objection is resolved. If no lawful alternative exists, the affected processing shall be suspended and the Customer may terminate that affected service. Mandatory emergency action shall not be used to bypass required authorization.

7 Locations and international transfers

The approved locations include storage, backups and remote administrative access; they are recorded in the Schedule. Administration from Spain is expressly disclosed. A future move to New York is not approved by signing this agreement and requires an updated location and transfer assessment before migration.

Where GDPR Chapter V applies, NuviaMy shall ensure an applicable transfer mechanism and any required assessment or supplementary measures before a restricted transfer. An adequacy decision or applicable standard contractual clauses must cover the actual legal entities, roles, services and transfer. This agreement alone is not a transfer mechanism. The Schedule records the selected basis, executed documents and remaining restrictions.

8 Assistance and individual rights

Taking account of the nature of processing and available information, NuviaMy shall assist the Customer with access, correction, erasure, restriction, portability, objections and other applicable individual rights. Requests received directly shall be forwarded promptly to the verified Customer contact; NuviaMy shall not independently decide clinical-record disclosure or erase records without lawful authority.

NuviaMy shall provide information and assistance sufficiently promptly for applicable deadlines, including assistance with security, breach evaluation, impact assessments and prior consultation where required. Corrections to signed notes shall preserve the original and use an appropriate linked amendment rather than silently rewriting a signed record. Access by a patient’s representative remains subject to the Customer’s verified instructions and applicable law.

9 Personal data breaches

NuviaMy shall notify the Customer without undue delay after becoming aware of a personal data breach affecting the agreed processing. It shall provide available facts about the event, affected data and persons, likely consequences, mitigation, contact point and further action, then supply updates as information becomes available. Initial notification shall not wait for a complete forensic investigation.

The parties shall use the monitored contacts in the Schedule and move sensitive details to an agreed secure channel. General support email must not contain patient names, notes or attachments containing clinical data. NuviaMy shall preserve relevant evidence and cooperate with investigation, containment and legally required notices. The Customer normally decides its regulator and individual notifications unless law or a separate written delegation provides otherwise. A controller’s possible 72-hour GDPR deadline is not an automatic 72-hour allowance for the processor.

10 Evidence and audits

NuviaMy shall make information necessary to demonstrate these processor obligations available to the Customer and allow and contribute to audits, including inspections, by the Customer or an authorized auditor. Reasonable confidentiality, scheduling and protection for other customers may apply, but may not defeat a legal audit right, regulator access or an urgent investigation. No certification is represented unless identified with its actual scope in the Schedule.

11 Duration and exit

Processing continues only for the agreed service and any lawful exit or retention period specified in the Schedule. Ending a subscription does not itself authorize destruction of clinical records. The Customer remains responsible for identifying applicable clinical retention duties, including state, profession, age and legal-hold requirements. HIPAA documentation retention shall not be treated as a universal medical-record retention period.

At the end of the processing service, NuviaMy shall, at the Customer’s choice, return or delete the personal data and delete existing copies unless Union or Member State law requires retention where GDPR applies, or another legal retention duty lawfully applies. The Standard Processing Schedule sets out export availability, backup lifecycle and the authenticated closure process. The parties document the Customer’s return or deletion instructions, applicable legal holds and the completion timetable before closure; routine trial expiry is not an instruction for erasure and does not create indefinite storage rights. Retained data remains protected and shall not be used for other purposes. NuviaMy shall document completion or the lawful reason and safeguards for continuing retention.

12 Priority and execution

This agreement prevails over conflicting service terms concerning processing instructions and data protection. An applicable BAA prevails for HIPAA-specific protections; where both laws apply, the parties shall satisfy both. No provision limits statutory individual rights or regulator powers. Material amendments require written agreement, including an attributable electronic agreement; changing a public webpage alone does not amend this executed version.

The parties may sign in counterparts or by a legally valid electronic method. The retained record shall identify each party, representative, authority, agreement and Schedule version, signing action, date and time. NuviaMy expressly offers and agrees to this standard agreement through its publication by Richard Andres Marles Bonilla. The Customer’s explicit acceptance concludes it without a separate manual countersignature. Neither a subscription payment nor an employee’s login is treated as acceptance.

## Electronic execution

Richard Andres Marles Bonilla, trading as NuviaMy, expressly offers and agrees to this standard agreement. The Customer is the legal entity or sole practitioner identified in the electronic acceptance receipt. That receipt records its address, authorized representative, title, account email, workspace, exact texts, versions, document digest and acceptance time. The Customer’s explicit checkbox and submission conclude the agreement. Publication alone does not imply acceptance by any customer. Material amendments require a new attributable agreement; an existing signed copy is not silently replaced.

NuviaMy HIPAA Business Associate Agreement

Version NUVIA BAA 2026 10 20 standard v1

This agreement sets the obligations for NuviaMy’s handling of protected health information on behalf of the HIPAA-regulated Customer identified below. It supplements the parties’ service agreement and any Data Processing Agreement. The Standard Processing Schedule is incorporated into this agreement.

1 Parties and HIPAA roles

Business Associate: Richard Andres Marles Bonilla, trading as NuviaMy, Calle Paciente Inglés 22, 50019 Zaragoza, Spain. Contract contact: marleswebinfo@gmail.com. Operational contact: support@nuviamy.com.

The Customer, registered address, workspace and authorized representative are identified in the electronic acceptance receipt. Its account email is the monitored HIPAA privacy, security and incident contact. The receipt retains the exact Terms of Use, DPA, BAA and Standard Processing Schedule, including versions and acceptance time.

This BAA applies when the Customer is a covered entity or a business associate and the service involves PHI. If the Customer is an upstream business associate, NuviaMy acts as its subcontractor and Customer obligations apply consistently with that relationship and applicable law. The Customer must have authority from its upstream entity and provide relevant restrictions without disclosing unrelated confidential terms.

Terms such as Protected Health Information or PHI, Electronic PHI, Breach, Security Incident, Designated Record Set, Individual, Secretary, Use and Disclosure have the meanings in 45 CFR Parts 160 and 164. HIPAA Rules means the applicable Privacy, Security, Breach Notification and Enforcement Rules, as amended. The agreement does not assert that every therapist or every NuviaMy customer is a HIPAA covered entity.

2 Permitted activities and limitations

NuviaMy may create, receive, maintain and transmit PHI only as necessary to provide the Customer’s approved workspace operations in the Schedule, on the Customer’s lawful instructions, or as required by law. These operations may include practice records, scheduling, approved documentation, secure storage, controlled access, export, recovery and necessary support. Only approved integrations and recipients may be used.

NuviaMy shall not use or disclose PHI in a way that would violate the Privacy Rule if done by the Customer, except to the extent expressly permitted by HIPAA and this agreement. It shall observe applicable minimum-necessary requirements and the Customer’s communicated lawful restrictions. It shall not sell PHI, use it for advertising, AI model training or an independent research or commercial purpose, or perform independent data aggregation or de-identification under this agreement.

This agreement does not authorize a separate management-and-administration disclosure outside the approved service. A disclosure required by law shall be limited to what is required, with notice to the Customer where lawful. No blanket permission for marketing, analytics, public release or sharing with another practice is given.

3 Safeguards and workforce

NuviaMy shall use appropriate safeguards and comply with the applicable HIPAA Security Rule requirements for ePHI, including 45 CFR Part 164 Subpart C. It shall document and manage risks to confidentiality, integrity and availability, maintain appropriate administrative, physical and technical safeguards, and bind authorized personnel to confidentiality and role-appropriate access.

The Schedule identifies the actual infrastructure, controls, responsibility allocation and approved administrative locations. Administration from Spain is disclosed. No representation of HIPAA certification, full encryption of every data category, completed external security review or availability guarantee is made by this agreement. Such statements require specific supporting evidence. These qualifications do not waive the Business Associate’s statutory duties.

4 Incidents and breach notification

NuviaMy shall report to the Customer any use or disclosure not permitted by this agreement and any Security Incident of which it becomes aware. It shall investigate, mitigate harmful effects where practicable, preserve relevant evidence and cooperate with the Customer. Any agreed summary reporting for unsuccessful security attempts must be defined in the Schedule and shall not suppress a successful compromise or Breach report.

For a Breach of unsecured PHI, NuviaMy shall notify the Customer without unreasonable delay and within the outer limit in 45 CFR 164.410, currently no later than 60 calendar days after discovery, except a lawful delay under 45 CFR 164.412. Discovery includes what reasonable diligence would have revealed and knowledge attributed under that rule. The statutory ceiling is not a routine waiting period. A shorter applicable legal requirement or expressly agreed Schedule deadline shall be observed.

The notice shall identify affected individuals to the extent possible and include available information needed for the Customer’s notices, including the event, dates, data types, mitigation and contact details. Further information shall be supplied promptly as it becomes available; uncertainty shall not delay the initial notice. Sensitive material shall use a secure channel. The Customer retains responsibility for notices to individuals, HHS and other authorities unless a lawful written delegation states otherwise. NuviaMy shall still make any notification independently required of it.

5 Subcontractors

Before any subcontractor creates, receives, maintains or transmits PHI on NuviaMy’s behalf, NuviaMy shall obtain a written agreement imposing the applicable restrictions, conditions and Security Rule duties required by 45 CFR 164.502(e) and 164.308(b). This includes a cloud provider that only holds encrypted PHI and lacks the key when it is a business associate under HIPAA.

The Schedule shall identify the legal entity, exact service, region, eligible plan and executed agreement reference for each approved PHI subcontractor. A customer-signed BAA, ordinary GDPR DPA, provider brand listing or encrypted backup alone does not establish downstream BAA coverage. NuviaMy shall address a known material subcontractor violation through reasonable corrective steps and end the affected arrangement if required when correction is unsuccessful.

6 Access and individual rights

NuviaMy shall make PHI in the Designated Record Set available to the Customer as necessary for it to meet 45 CFR 164.524. It shall implement or facilitate Customer-directed amendments under 45 CFR 164.526 and maintain and provide information needed for an accounting of disclosures under 45 CFR 164.528. Signed clinical content shall retain its original with any linked amendment; the application must not silently replace the signed version.

Requests from individuals shall be forwarded promptly to the verified Customer contact, rather than independently approved by NuviaMy unless expressly instructed and lawful. The parties shall cooperate sufficiently promptly to satisfy the applicable legal deadlines. A dispute about payment shall not be used to withhold PHI in violation of HIPAA.

To the extent NuviaMy carries out a Customer obligation under the Privacy Rule, it shall comply with the requirements applicable to that obligation. It shall make its relevant internal practices, books and records available to the Secretary for determining HIPAA compliance. Contractual confidentiality or audit conditions shall not obstruct lawful HHS access.

7 Customer instructions and special records

The Customer shall provide relevant limitations in its privacy notices, changes in patient permissions and restrictions that affect the agreed service. It shall not instruct NuviaMy to perform an act that would be impermissible under HIPAA. The Customer remains responsible for clinical decisions, its workforce, lawful collection and its independent regulatory duties.

The approved scope covers ordinary practice records and progress notes only as selected in the Schedule. Separately maintained psychotherapy notes as defined by HIPAA and records subject to 42 CFR Part 2 are excluded unless a separate signed addendum and suitable technical controls expressly approve that category. A substance-use reference in an ordinary record does not by itself settle Part 2 applicability; the Customer must identify regulated scope. State protections and other applicable confidentiality laws remain in force.

8 Term and termination

This BAA takes effect on the Customer’s electronic acceptance of NuviaMy’s published offer where the Customer is a HIPAA covered entity or business associate and the service involves PHI. It covers the free trial and paid service and continues while NuviaMy holds PHI. The Standard Processing Schedule defines the service scope. Duties for PHI actually received remain enforceable regardless of any scope error.

The Customer may terminate this agreement and the affected service for a material breach by NuviaMy. It may provide a reasonable written cure period when correction is feasible; termination may be immediate when cure is not feasible or applicable law requires it. NuviaMy shall take reasonable steps to cure or end a known material violation in an upstream Customer relationship and terminate the affected arrangement where HIPAA requires if correction is unsuccessful.

9 Return and protection after termination

On termination, NuviaMy shall return or destroy PHI received, created or maintained for the Customer, including copies held by subcontractors, if feasible, as directed by the Customer and consistent with law. The Schedule specifies the return format, exit window, deletion process and backup expiry. No universal medical-record retention period is established by this agreement.

If return or destruction is infeasible, NuviaMy shall explain why, preserve the agreement’s safeguards, and limit further use and disclosure to the purposes making return or destruction infeasible for as long as it retains the PHI. Any necessary statutory retention shall be identified and limited. NuviaMy shall document completed return or destruction and any continuing protected retention. Subscription cancellation alone is not an instruction to erase patient records.

10 Interpretation and signing

HIPAA-specific protections in this agreement prevail over conflicting service terms. Concurrent applicable data-protection duties remain enforceable; no party is required to act unlawfully. The parties shall amend the agreement where necessary for applicable HIPAA changes. A mutable public webpage does not amend an executed BAA, and any material change requires an attributable written agreement.

The parties may execute this agreement in counterparts or with electronic signatures valid under applicable contract law. The evidence shall identify the parties, authorized representatives, versions, signing actions and dates. No nonparty’s signature is implied. Nothing in this agreement claims government approval, grants a clinical license, or removes the need to satisfy the documented safeguards and downstream contracts.

## Electronic execution

Richard Andres Marles Bonilla, trading as NuviaMy, expressly offers and agrees to this standard agreement. The Customer is the legal entity or sole practitioner identified in the electronic acceptance receipt. That receipt records its address, authorized representative, title, account email, workspace, exact texts, versions, document digest and acceptance time. The Customer’s explicit checkbox and submission conclude the agreement. Publication alone does not imply acceptance by any customer. Material amendments require a new attributable agreement; an existing signed copy is not silently replaced.

NuviaMy Standard Processing Schedule Version NUVIA SCHEDULE 2026 10 29 standard v2

Parties and duration The Customer and authorized representative are identified in the electronic acceptance receipt. Provider: Richard Andres Marles Bonilla, trading as NuviaMy, Calle Paciente Inglés 22, 50019 Zaragoza, Spain. Privacy and incident contact: richard@nuviamy.com; service contact: support@nuviamy.com. The Customer’s account email is its monitored contract and incident contact; keep it current. Sensitive details must use an authenticated secure channel, never general email.

The DPA and, where applicable, BAA apply from explicit acceptance, including the 30-day cardless trial and any subsequent paid subscription. Ordinary service does not require preparation of a bespoke packet. The Customer remains responsible for lawful collection, patient information and consent, professional obligations, staff access and its own retention instructions.

Processing scope On Customer instructions, NuviaMy collects, stores, organizes, displays to authorized users, signs, amends, exports, backs up, restores and deletes ordinary practice records. Data subjects are clients, their representatives, emergency contacts and practice personnel. Data includes contact details, appointments, intake responses, health history, diagnoses, treatment plans, ordinary progress notes and signatures, documents, invoices and security records. The Customer selects relevant data through its authorized workspace actions. Real client records within this scope may be used during the trial under these agreements.

Separately maintained HIPAA psychotherapy notes and records governed by 42 CFR Part 2 are excluded without an additional written arrangement and suitable controls. For minors, the Customer must establish lawful representative authority and appropriate access restrictions before entering their data. NuviaMy does not provide medical advice, emergency care, patient consent or a government compliance certification. Customer clinical data is not sold, used for advertising or used for independent AI training.

Infrastructure and external services The production application and PostgreSQL database run on Amazon EC2 with encrypted EBS storage in us-east-1 (Northern Virginia, United States). Private documents, encrypted database backups and the audit log destination use separate Amazon S3 buckets in that region. EC2 snapshots support recovery. AWS CloudTrail records infrastructure activity across regions, including global service events; IAM and CloudFormation support access and infrastructure administration. These are not promises that every service control-plane operation or support activity remains in one region.

The AWS account identifies Amazon Web Services EMEA SARL as its contractual service provider. The applicable AWS Data Processing Addendum also identifies Amazon Web Services, Inc. and the AWS contracting party or parties. AWS is the infrastructure subprocessor; its service-specific subprocessor list applies to the services and locations used. The AWS Business Associate Addendum is active for the production account, subject to eligible-service and configuration conditions. Administration by NuviaMy is from Spain. This is neither an EU-only nor a US-only access commitment.

Amazon SES in us-east-1 sends account authentication, invitation, recovery and service communications using encrypted API submission and required delivery TLS. Message destinations, account/service content and temporary authentication links are processed for delivery. No clinical notes, diagnoses or patient attachments are included in those communications. Delivery necessarily passes to the recipient's email provider; the recipient selects and secures their mailbox. This infrastructure description does not authorize sending clinical records to a personal mailbox.

Bounce and complaint metadata goes to an encrypted Amazon SNS topic and encrypted Amazon SQS queue in us-east-1. AWS KMS protects the SNS topic. This private queue retains messages for at most 14 days unless reviewed earlier; evidence requiring longer retention is separately protected under incident instructions. Original email headers are excluded, and SES feedback forwarding by email is disabled. Operational monitoring checks only queue counts and sends generic failure codes to the operator, without recipient lists or clinical details. The AWS feedback channel is not an SMS or external email subscription.

Cloudflare provides DNS with DNS-only production routing. Cloudflare Email Routing and the operator's Gmail inbox remain administrative/support channels, outside the approved clinical-content scope. Brevo is no longer the active application mail transport; any historical material requires restricted review and authorized disposition. General support must not contain clinical records, passwords or authentication codes.

Google Calendar is optional and limited to the connected user's owned calendar. Exported appointment blocks use 'Reserved time', without patient names, attendees, location, notes or clinical links. Event times and account identifiers may still be personal data; the Customer must evaluate the exact Google account, service and instructions. OAuth approval does not constitute a Google BAA or approve a clinical transfer. Gmail and Drive capabilities are disabled and are not offered by this Schedule.

Sentry, if enabled, receives sanitized structural technical diagnostics, excluding clinical content, user identities, request URLs, request bodies, breadcrumbs and local variables. Provider-side historical data and retention require separate review. Stripe handles hosted SaaS subscription payments and commercial billing data; card details are entered on its hosted page. Patient payments remain a separate assessed flow and are not approved merely by this subscription-processing description. Do not put diagnoses or clinical notes in payment metadata.

Changes of clinical subprocessors follow the DPA notice and objection procedure. A provider name alone does not establish contractual coverage for additional flows. Legacy infrastructure is not an authorized destination for new clinical records.

EEA data and transfers For practice records the Customer normally acts as controller and NuviaMy as processor, unless the Customer has documented another lawful role. NuviaMy's own account administration and subscription billing purposes are addressed separately in its privacy notice. The Customer supplies the applicable Article 6 basis and Article 9 health-data condition, patient notices and any required authorizations; acceptance of this Schedule is not patient consent.

Customer data is hosted in the United States as described above, with remote administration from Spain. The AWS Service Terms incorporate the AWS DPA, its Supplementary Addendum and transfer clauses subject to their conditions. For clinical records processed on behalf of the Customer, the processor-to-processor module is the relevant SCC module where SCCs apply; for NuviaMy's own controller processing, the controller-to-processor module may apply. The actual transfer instrument and any alternative mechanism must be recorded for the exact entities, data and flow. This Schedule is not itself a set of SCCs and does not select an adequacy mechanism merely because an AWS entity appears on a certification list.

The EU-U.S. DPF can cover health-related personal data when the recipient certification covers the data; it is not a separate health-service certification. AWS Inc. is listed as a covered entity in Amazon's active non-HR certification. This Schedule does not treat that listing alone as conclusive coverage of all hosted Customer Data or extend AWS's account-information notice to patient records. The transfer assessment distinguishes hosted records and backups, private support, logs, transactional messages, delivery feedback and the recipient's mailbox. Patient communications may reveal a care relationship even when their body is generic. This assessment does not establish transfer coverage for employment-context HR or occupational-health files.

Before approving an EEA clinical scope, NuviaMy must document the applicable transfer mechanism, any required transfer assessment and supplementary measures, and the Customer's authorized instructions. Acceptance of this Schedule does not record that assessment as complete or authorize a transfer without the applicable safeguards. Encryption at rest, TLS, encrypted tokens and an AWS BAA do not establish that all processing is end-to-end encrypted or that keys are exclusively held outside the hosting environment. A move to an EU region requires a separately validated change and does not follow automatically from accepting this text.

The Customer identifies countries, autonomous communities or states, professional obligations and adult/minor scope. Health-record retention is determined for those circumstances, not by a single HIPAA or EU-wide number. Patient rights are handled under the DPA, with authenticated authority, applicable legal limits and preservation of signed originals through amendments. NuviaMy assists risk and impact assessments; no EIPD or DPO appointment is represented as completed by this Schedule.

Safeguards and assistance Controls include HTTPS, practice-scoped authorization, protected audit evidence, encrypted integration tokens, session expiration/revocation, email two-step sign-in, mandatory authenticator enrollment for platform staff and superusers, immutable signed notes with linked addenda, encrypted EC2 storage, private encrypted/versioned S3 storage, encrypted database backups and daily encrypted instance snapshots. The Customer manages workforce permissions and device security. No certification, guaranteed uptime or recovery time is promised. NuviaMy remains responsible for appropriate safeguards and downstream obligations under the DPA and applicable BAA.

Incident reporting and cooperation follow the DPA and BAA. Initial reporting does not wait for a complete investigation. Individual requests go to the verified Customer; NuviaMy assists authorized requests promptly enough for applicable deadlines. Authorized exports include JSON records, available files and signature information; PDF summaries are not the complete archive.

Expiry, return and deletion Trial expiry and subscription cancellation do not automatically delete data. Authorized reading and export remain available while creation and edits are restricted by subscription status. There is no automatic charge at trial expiry, no universal medical-record retention period and no promise of indefinite storage. The Customer identifies its professional, state, age-related and legal-hold obligations.

The Customer may request return or deletion through an authenticated owner request. NuviaMy verifies authority, offers a complete export and agrees a documented closure timetable before erasure, taking account of lawful holds. No unilateral routine deletion starts merely because a trial ends. If return/destruction is infeasible, safeguards continue and uses are limited to the reason for retention under the DPA/BAA. Completion or lawful restricted retention is documented.

Current backup lifecycle: current S3 database backups expire after 35 days; noncurrent backup versions expire 35 days after becoming noncurrent, so this is not a maximum total age. Instance snapshots retain seven daily recovery points. Document versions have no automatic deletion lifecycle and must be included in verified closure instructions. Deletion requests must cover active copies, versions, snapshots and prevention of reintroduction on restore; a backup expiry guarantee is not implied by these operational settings.