Oxxy Data Processing Agreement (DPA)

1. Roles

1.1. The Controller decides for what purpose and how the data it records in Oxxy is processed and is responsible for the legal basis, including for sensitive data such as patients' health data.

1.2. Oxxy processes this data only to provide the contracted service, according to the Controller's instructions, which are this agreement, the contract, and the Controller's use of the system.

1.3. For account registration, billing, usage, and security data, Oxxy is the controller and follows the Privacy Policy.

2. Data and data subjects

3. Oxxy's obligations

Oxxy undertakes to:

• process the data only to provide the service and not use it for any other purpose of its own, nor sell it;
• maintain confidentiality and require the same of anyone with access to the data;
• apply the security measures described in Annex 1;
• notify the Controller of a security incident affecting its data within 48 hours after becoming aware of it, with whatever is known at that point (nature of the data, affected data subjects, risks and measures taken), so that the Controller can meet the ANPD's (Brazilian National Data Protection Authority's) deadlines;
• help the Controller respond to data subject requests and ANPD inquiries, forwarding to it any requests Oxxy receives;
• keep a record of the processing operations it carries out (LGPD, Brazil's General Data Protection Law, Law 13.709/2018, Art. 37);
• notify the Controller if any of its instructions appears to be contrary to the LGPD;
• at the end of the contract, allow the Controller to request an export of the data before deletion and then delete or anonymize it, except where retention is required by law; medical records follow the legal retention period applicable to the Controller.

4. Sub-processors

4.1. The Controller authorizes the use of the sub-processors listed in Annex 2.

4.2. Oxxy notifies the Controller 15 days in advance before adding a new sub-processor. The Controller may object for a reasonable reason related to data protection; if no agreement is reached, it may terminate the affected service.

4.3. Oxxy requires sub-processors to meet data protection obligations equivalent to those in this agreement and is liable for them to the Controller, as provided by law.

5. International transfer

When a sub-processor processes data outside Brazil, Oxxy uses the safeguards of the LGPD, Art. 33, applicable to each case.

6. Audit

Upon reasonable request and no more than once a year, Oxxy provides the Controller with the information needed to demonstrate compliance with this agreement. On-site audits require prior agreement on scope, date, and confidentiality.

7. Liability

Each party is liable for the damages it causes by violating the LGPD or this agreement, within the limits of the contract and the law.

8. Term

This agreement remains in effect for as long as the contract lasts and, after it ends, for as long as Oxxy keeps the Controller's data.

9. Contact

Oxxy's data protection officer: Humberto Cardoso, privacidade@oxxy.ai.

Annex 1. Security measures

• Login with email, Apple, or Google, and role-based permissions.
• Logical separation of each company's and each user's data.
• Audit logs and medical-record access trail.
• Access over an encrypted connection (HTTPS) and encrypted external backups.
• Two-step verification available; the Controller decides who must use it.
• Daily backups with a retention cycle, without restoring deleted accounts.
• Face ID and fingerprint checked only on the device.
• No advertising tracking.
• Times recorded in UTC and displayed in Brasília time.

Annex 2. Sub-processors

Login with Apple or Google processes account data, for which Oxxy is the controller; that is why it appears in the Privacy Policy and not here.