Data Processing Agreement - DPA

  1. Purpose and Scope

1.1. This DPA governs TeleVU’s Processing of Organization Personal Data in connection with the Services.

1.2. The Parties acknowledge that, as between the Parties, Organization determines the purposes and means of Processing Organization Personal Data, and TeleVU Processes Organization Personal Data only on behalf of Organization and in accordance with the Agreement, this DPA, and Organization’s documented instructions.

1.3. This DPA applies to all Organization Personal Data Processed by TeleVU or TeleVU Sub-processors in connection with the Services, including Organization employee or contractor account information, session metadata, live session communications, optional recordings, support information, and other information submitted, transmitted, generated, stored, or otherwise Processed through the Services.

1.4. To the extent Organization Personal Data includes information subject to applicable privacy, security, data-protection, health, employment, consumer, or other laws, the Parties will comply with their respective obligations under those laws.

  1. Definitions

For purposes of this DPA:

2.1. “Applicable Data Protection Laws” means all privacy, data protection, data security, breach notification, and similar laws applicable to a Party’s Processing of Organization Personal Data under the Agreement, including, as applicable, Canadian privacy laws, U.S. federal and state privacy and breach notification laws, the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, and other applicable laws.

2.2. “Business Purpose” means the limited purpose of providing, securing, maintaining, supporting, improving, and administering the Services for Organization, and complying with legal obligations, in each case as permitted by the Agreement and this DPA.

2.3. “Controller” means the entity that determines the purposes and means of Processing Personal Data. For purposes of this DPA, Organization is the Controller unless otherwise agreed in writing.

2.4. “Data Subject” means an identified or identifiable natural person to whom Organization Personal Data relates, including Organization employees, contractors, administrators, users, clients and other individuals whose Personal Data is Processed through the Services.

2.5. “Personal Data” means any information relating to an identified or identifiable natural person, including “personal information,” “personally identifiable information,” “personal data,” “personal health information (PHI)” or similar terms under Applicable Data Protection Laws.

2.6. “Process,” “Processing,” or “Processed” means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, deletion, or destruction.

2.7. “Processor” means the entity that Processes Personal Data on behalf of a Controller. For purposes of this DPA, TeleVU is the Processor unless otherwise agreed in writing.

2.8. “Security Incident” means an actual or reasonably suspected unauthorized access to, acquisition of, disclosure of, use of, corruption of, deletion of, or other unauthorized Processing of Organization Personal Data, or a compromise of the confidentiality, integrity, or availability of Organization Personal Data.

2.9. “Services” means the TeleVU TelePresence AR platform, video-enabled remote support functionality, support services, administrative portal, and related services provided to Organization under the Agreement.

2.10. “Sub-processor” means any third party engaged by TeleVU to Process Organization Personal Data on TeleVU’s behalf in connection with the Services.

2.11. “Organization Personal Data” means Personal Data Processed by TeleVU on behalf of Organization in connection with the Services.

2.12. “Organization Data” means all data, content, records, files, audio, video, images, messages, session metadata, account data, support data, and other information submitted to, transmitted through, generated by, or stored in the Services by or on behalf of Organization, including Organization Personal Data.

  1. Roles and Responsibilities

3.1. Organization is responsible for determining the lawful basis, notices, consents, authorizations, and instructions required for the Processing of Organization Personal Data through the Services.

3.2. TeleVU will Process Organization Personal Data:

  1. to provide, secure, maintain, support, and improve the Services for Organization;
  2. in accordance with Organization’s documented instructions;
  3. as required by the Agreement or this DPA;
  4. as required by applicable law; or
  5. as otherwise expressly authorized by Organization in writing.

3.3. TeleVU will not sell Organization Personal Data.

3.4. TeleVU will not use Organization Personal Data for cross-context behavioral advertising.

3.5. TeleVU will not retain, use, disclose, or otherwise Process Organization Personal Data outside the direct business relationship between TeleVU and Organization except as permitted by the Agreement, this DPA, Organization’s documented instructions, or applicable law.

3.6. TeleVU will not combine Organization Personal Data with Personal Data received from or on behalf of another customer, except as necessary to provide, secure, maintain, or support the Services, or as otherwise permitted by Applicable Data Protection Laws.

3.7. TeleVU will not attempt to re-identify anonymized, de-identified, or aggregated Organization Data except as required to provide the Services, investigate security issues, or comply with law.

3.8. Individuals under the age of majority. Organization acknowledges that the Services contain no paediatric-specific functionality and that TeleVU does not verify the age of any individual Organization enrols, records, or otherwise Processes through the Services. Where Organization uses the Services in relation to any individual under the age of majority in the applicable jurisdiction, Organization warrants that before doing so it has: (a) determined that such use is lawful; (b) established a lawful basis for the Processing, including any condition required for special-category or health data under Applicable Data Protection Laws; (c) obtained any consent or authorization required from a parent or legal guardian, or satisfied itself that the individual has capacity to consent under applicable law, and maintains a record of it; and (d) completed any data protection impact assessment or equivalent assessment required. Organization will indemnify TeleVU against any claim arising from Organization’s failure to comply with this Section.

  1. Documented Instructions

4.1. Organization instructs TeleVU to Process Organization Personal Data for the purposes described in this DPA, the Agreement, applicable order forms, and Schedule 1.

4.2. TeleVU will promptly notify Organization if, in TeleVU’s reasonable opinion, an instruction from Organization infringes Applicable Data Protection Laws, unless prohibited by law from doing so.

4.3. TeleVU will not be required to comply with any instruction that would require TeleVU to violate applicable law or materially compromise the security of the Services.

 

  1. Categories of Data and Processing Activities

5.1. Categories of Organization Personal Data may include:

  1. user registration information, including name, email address, username, role, portal association, and account credentials or authentication identifiers;
  2. device information, including device identifiers, device type, model, operating system, browser/client application information, IP address, language preference, and application version;
  3. usage information, including session information, access logs, timestamps, pages or features used, system events, and support interactions;
  4. TelePresence AR session data, including live audio, live video, screen or camera view, session metadata, and network/session telemetry;
  5. optional recordings, photographs, or videos captured through the Services where recording or capture functionality is enabled and initiated by an authorized user;
  6. support and troubleshooting information submitted by Organization users or administrators; and
  7. other Personal Data submitted by Organization or its authorized users through the Services.
  8. patient intake, consent, assessment, visit, or other forms completed through the Services, including notes, patient information as entered by authorized users, visit details, observations, history, reason for visit, clinical or operational comments, and other information collected or submitted in connection with a session, consultation, assessment, or visit;

5.2. Organization Data may include operational content visible, discussed, captured, or transmitted during a TelePresence AR session. The Parties agree that such content should be handled as confidential customer data, and if it includes Personal Data, it will be handled as Organization Personal Data.

 

  1. Confidentiality

6.1. TeleVU will ensure that personnel authorized to Process Organization Personal Data are bound by confidentiality obligations.

6.2. TeleVU will restrict access to Organization Personal Data to personnel who require such access for a legitimate business need related to providing, securing, maintaining, or supporting the Services.

6.3. TeleVU will maintain internal policies requiring personnel to protect confidential and sensitive information and to report actual or suspected security incidents.

 

  1. Security Measures

7.1. TeleVU will implement and maintain reasonable and appropriate administrative, technical, and other safeguards designed to protect the confidentiality, integrity, availability, and resilience of Organization Personal Data.

7.2. TeleVU’s security measures will include, at a minimum:

  1. encryption of data in transit using secure protocols such as HTTPS/TLS, WebSocket, WebRTC, SSH, or other secure protocols appropriate to the Services;
  2. encryption of data at rest;
  3. access controls based on least privilege and need-to-know;
  4. unique accounts and authentication controls for personnel and users;
  5. multi-factor authentication where available and required for applicable administrative systems, cloud infrastructure, email, and version control;
  6. documented onboarding and offboarding controls, including timely revocation of access upon termination or role change;
  7. audit logging and monitoring of production systems, applications, databases, servers, message queues, load balancers, critical services, and IAM user/admin activities;
  8. secure retention of logs for at least one year, unless a longer period is required by the Agreement or applicable law;
  9. controls designed to prevent unauthorized access, deletion, or tampering with logging facilities and log information;
  10. vulnerability and patch management processes;
  11. change management procedures for production infrastructure, systems, and applications;
  12. separation of development and production environments where necessary;
  13. asset inventory and configuration management processes;
  14. secure disposal and sanitization of media and devices containing confidential or personally identifiable information; and
  15. incident response procedures.

7.3. TeleVU will maintain a written information security program aligned with recognized security frameworks and appropriate to the nature, size, and complexity of TeleVU’s business operations.

7.4. TeleVU will review and update its security policies and plans at least annually, and will track findings to resolution.

7.5. TeleVU will not materially decrease the overall security of the Services during the term of the Agreement.

  1. Data Location and Cross-Border Processing

8.1. TeleVU processes Personal Information through Amazon Web Services for computing and storage purposes. TeleVU is committed to honoring customer data sovereignty and data residency requirements by utilizing AWS infrastructure in the customer’s applicable geographic region, where AWS Regions are available. For example, Personal Information for Canadian customers is processed and stored in Canada, and U.S. customers are served through an appropriate AWS Region within the United States.

Managed services used to operate the Services, such as authentication, are provided through AWS services within the AWS Region selected for the applicable deployment. Certain other service providers may Process limited Personal Data outside Canada where required to support the delivery, security, and operation of the Services, as described in Schedule 2.

8.2. Subject to the Agreement, TeleVU will Process Organization Personal Data in the locations necessary to provide the Services.

8.3. If Organization requires a specific data residency commitment, the Parties will document that commitment in the Agreement, or an order form.

8.4. TeleVU will not intentionally transfer Organization Personal Data to a new country or region that materially changes the risk profile of the Services without providing Organization with notice, unless the transfer is required by law or is necessary to maintain the security or continuity of the Services.

8.5. If a transfer mechanism is required under Applicable Data Protection Laws, the Parties will implement an appropriate transfer mechanism, such as Standard Contractual Clauses, an international data transfer agreement, or another lawful transfer mechanism.

8.6. TeleVU personnel who administer, support, secure, and maintain the Services are primarily located in Canada. Access to Organization Data by TeleVU personnel is limited to authorized personnel with a legitimate business need, including for support, troubleshooting, security, maintenance, incident response, and service administration. Such access is controlled through role-based access controls, least-privilege permissions, authentication controls, confidentiality obligations, and audit logging where applicable. Any access to Organization Data from outside Canada, including by authorized Sub-processors or service providers, will be handled in accordance with this DPA, the Agreement, applicable law, and any required transfer safeguards.

  1. Sub-processors

9.1. Organization authorizes TeleVU to use Sub-processors to provide, secure, maintain, and support the Services, subject to the requirements of this Section.

9.2. TeleVU will conduct risk-based due diligence on Sub-processors that Process Organization Personal Data, including security and privacy review appropriate to the nature of the services and data involved.

9.3. TeleVU will enter into a written agreement with each Sub-processor that requires the Sub-processor to maintain privacy, confidentiality, and security obligations no less protective in substance than those required by this DPA.

9.4. TeleVU will maintain a list of Sub-processors used to provide the Services and will make the list available to Organization upon request.

9.5. TeleVU will provide at least thirty (30) days’ advance written notice of any new Sub-processor that will Process Organization Personal Data. Organization may object to a new Sub-processor on reasonable privacy or security grounds within 15 days of notice. If Organization reasonably objects, the Parties will work in good faith to resolve the objection.

9.6. The current known categories of Sub-processors and service providers may include cloud infrastructure providers, authentication providers, network transmission providers, customer support/ticketing providers, security providers, analytics or product-support providers, and other providers necessary to deliver the Services.

9.7. The initial Sub-processor list is set out in Schedule 2.

 

  1. AI/ML Processing

10.1. TeleVU will not use Organization Data, including Organization session data, audio, video, recordings, transcripts, notes, images, or metadata, to train, fine-tune, or improve any AI or machine-learning model, except with Organization’s prior written authorization.

10.2. TeleVU will not disclose Organization Data to any AI/ML provider unless:

  1. the AI/ML Processing is expressly enabled by Organization or authorized in the Agreement;
  2. the AI/ML provider is listed as a Sub-processor or otherwise approved in writing by Organization;

10.3. Any optional AI features, including automated notetaking, summarization, transcription, or translation, must be capable of being disabled at the organizational level for Organization.

10.4. TeleVU will provide Organization with written documentation identifying each AI/ML provider, the AI feature supported, the categories of Organization Data Processed, retention practices, no-training commitments, and opt-in/opt-out controls before enabling any AI feature for Organization.

 

  1. Data Subject Rights and Assistance

11.1. Taking into account the nature of the Processing and the information available to TeleVU, TeleVU will reasonably assist Organization in responding to Data Subject requests relating to Organization Personal Data.

11.2. If TeleVU receives a request directly from a Data Subject relating to Organization Personal Data, TeleVU will direct the Data Subject to Organization or Organization’s portal administrator, unless otherwise required by applicable law.

11.3. TeleVU will not respond substantively to a Data Subject request regarding Organization Personal Data without Organization’s prior instruction, unless required by law.

11.4. TeleVU will provide reasonable assistance to Organization to access, correct, export, delete, or restrict Organization Personal Data to the extent such functionality is available through the Services or reasonably available to TeleVU.

 

  1. Return and Deletion of Organization Data

12.1. TeleVU will retain Organization Data for as long as Organization’s account is active, as needed to provide the Services, as set out in the Agreement, or as required by applicable law.

12.2. Upon Organization’s written request, or upon termination or expiration of the Agreement, TeleVU will delete or return Organization Data in accordance with the Agreement, this DPA, and TeleVU’s data retention and disposal practices. Unless a longer retention period is required by applicable law, regulatory obligation, contractual obligation, dispute-resolution need, security investigation, backup-retention limitation, or other legitimate legal or operational requirement, TeleVU will delete customer-requested Organization Data within thirty (30) days of Organization’s written request.

12.3. TeleVU may retain limited information as necessary to comply with legal obligations, resolve disputes, enforce agreements, maintain security records, preserve evidence relating to an actual or suspected Security Incident, or complete ordinary-course backup and archival retention, provided such retained information remains protected in accordance with this DPA.

12.4. TeleVU will limit the number of personnel authorized to delete customer data.

12.5. Upon Organization’s request, TeleVU will provide written confirmation of deletion, subject to legal, security, and operational limitations.

 

  1. Security Incident Notification

13.1. TeleVU will maintain a security incident response process for actual or reasonably suspected unauthorized access to, use of, disclosure of, acquisition of, corruption of, deletion of, or other unauthorized Processing of sensitive information.

13.2. TeleVU will notify Organization without undue delay and in any event within forty-eight (48) hours after TeleVU becomes aware of a Security Incident affecting Organization Data.

13.3. Security Incident notices will be sent to:

Organization Security Contact/s:

TeleVU Data Processing Officer: dpo@televu.ca

TeleVU Security Contact: security@televu.ca
TeleVU Privacy Contact: privacy@televu.ca

13.4. TeleVU’s notice will include, to the extent known at the time:

  1. a description of the Security Incident;
  2. the date and time of discovery;
  3. the categories of Organization Data affected or reasonably believed to be affected;
  4. the categories and approximate number of affected Data Subjects, if known;
  5. the known or suspected cause;
  6. mitigation and containment measures taken or planned;
  7. steps Organization may take to reduce risk;
  8. whether law enforcement, regulators, or forensic investigators are involved; and
  9. a TeleVU point of contact for follow-up.

13.5. TeleVU will investigate, contain, mitigate, document, and remediate Security Incidents in accordance with its incident response process.

13.6. TeleVU will preserve relevant evidence and maintain incident logs or corrective action plans as appropriate.

13.7. TeleVU will not notify regulators, law enforcement, Organization users, Organization employees, Organization customers, or the public about a Security Incident involving Organization Data unless required by law, authorized by Organization, or necessary to protect the security or integrity of the Services. Where legally permitted, TeleVU will consult with Organization before making such notification.

13.8. Following resolution of a Security Incident, TeleVU will conduct a post-incident review and determine whether additional safeguards, policy updates, or corrective actions are appropriate.

 

  1. Audits, Assessments, and Compliance Information

14.1. Upon Organization’s reasonable written request and subject to confidentiality obligations, TeleVU will provide information reasonably necessary to demonstrate compliance with this DPA, including applicable security policies, summaries of penetration testing or security assessments, compliance certificates, Sub-processor information, and other relevant documentation.

14.2. If TeleVU has current third-party certifications, audit reports, penetration-test executive summaries, or similar evidence applicable to the Services, TeleVU will provide such materials under NDA upon reasonable request, subject to redaction for security, confidentiality, or third-party restrictions.

14.3. TeleVU maintains a written information security program aligned with ISO/IEC 27001. If Organization requires any additional security, privacy, or compliance certification, assessment, registration, or equivalent attestation that is not available, TeleVU will state so in writing and, where applicable, provide any planned assessment timeline.

14.4. Upon reasonable prior written notice, subject to scheduling agreed between the Parties, and at Organization’s sole cost and expense, Organization may conduct a reasonable audit of TeleVU’s compliance with this DPA no more than once annually, unless a Security Incident affecting Organization Data or a material compliance concern reasonably requires an additional audit.

14.4.1 Audits must be conducted during normal business hours, with reasonable advance notice, in a manner that does not disrupt TeleVU operations or compromise the confidentiality, availability, or security of TeleVU systems or other customers’ data.

14.4.2 TeleVU may satisfy an audit request by providing independent third-party audit reports, certification materials, security questionnaires, or other documentation that reasonably addresses Organization’s audit objectives.

 

  1. Legal Requests

15.1. If TeleVU receives a subpoena, court order, search warrant, government request, regulatory inquiry, or similar legal request seeking disclosure of Organization Data, TeleVU will promptly notify Organization unless prohibited by law, court order, or exigent circumstances.

15.2. TeleVU will make reasonable efforts to allow Organization to seek a protective order or other appropriate remedy before disclosure.

15.3. TeleVU will disclose only the minimum Organization Data legally required in response to a valid legal request.

 

  1. Assistance with Compliance

16.1. TeleVU is committed to supporting Organization’s reasonable privacy, security, and compliance needs in connection with the Services. Taking into account the nature of the Processing and the information available to TeleVU, TeleVU will reasonably assist Organization with:

  1. security and privacy due diligence;
  2. data protection impact assessments;
  3. security assessments;
  4. regulator inquiries;
  5. breach notification obligations;
  6. Data Subject requests; and
  7. documentation of Processing activities.

16.2. Assistance that is within TeleVU’s standard support obligations will be provided as part of the Services. If Organization requests assistance, deliverables, reviews, documentation, technical support, legal support, audit support, or other services that exceed TeleVU’s standard support obligations, the Parties will mutually agree in writing on the applicable scope of work, timeline, fees, and expenses before TeleVU performs such additional services.

 

  1. Confidentiality of Organization Data

17.1. Organization Data is Organization Confidential Information.

17.2. TeleVU will not disclose Organization Data except as permitted by the Agreement, this DPA, Organization’s documented instructions, or applicable law.

17.3. TeleVU will ensure that personnel with access to Organization Data are subject to confidentiality obligations and receive security awareness training as required by TeleVU policy.

 

  1. Optional Recordings and Session Content

18.1. TeleVU will Process live TelePresence AR session audio, video, and metadata only as necessary to provide, secure, maintain, and support the Services.

18.2. TelePresence AR sessions will not be recorded by TeleVU unless recording functionality is enabled and recording is initiated by an authorized Organization user or otherwise expressly authorized by Organization.

18.3. Optional recordings, photos, or videos captured through the Services are Organization Data and will be protected under this DPA.

18.4. TeleVU will make optional recordings available only to authorized users based on role-based access permissions established and configured by Organization.

18.5. Organization may request deletion of recordings in accordance with Section 12.

 

  1. Portal Isolation and Customer Data Segregation

19.1. TeleVU will implement logical access controls designed to prevent unauthorized access to Organization Data by other customers or unauthorized personnel.

19.2. TeleVU will maintain access controls based on least privilege and need-to-know and will restrict administrative access to production servers and databases to personnel with a business need.

19.3. TeleVU personnel will not access Organization Data except as necessary to provide, secure, maintain, support, or improve the Services, investigate or respond to a security issue, comply with law, or as otherwise authorized by Organization.

19.4. Upon Organization’s reasonable request, TeleVU will provide a written description of the logical portal-separation controls applicable to the Services, including database, storage, application, and network-layer isolation controls, to the extent disclosure does not compromise security or confidentiality.

 

  1. Business Continuity and Disaster Recovery

20.1. TeleVU will maintain business continuity and disaster recovery plans designed to support continued operation or recovery of the Services in the event of a significant disruption.

20.2. TeleVU will test, review, and update its business continuity and disaster recovery plans at least annually.

20.3. TeleVU will maintain backup processes designed to support recovery of critical systems, records, and configurations in the event of disaster or media failure.

 

  1. Return, Suspension, and Termination

21.1. This DPA will remain in effect for as long as TeleVU Processes Organization Personal Data.

21.2. Upon termination or expiration of the Agreement, TeleVU will return or delete Organization Data as set out in Section 12.

21.3. Sections intended by their nature to survive termination will survive, including confidentiality, deletion, audit, legal requests, and liability provisions.

 

22A. HIPAA

22A. HIPAA. Where Organization is a Covered Entity or Business Associate as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”), and TeleVU Processes Protected Health Information on Organization’s behalf, the Parties will execute TeleVU’s Business Associate Agreement prior to any such Processing. The Business Associate Agreement is incorporated into this DPA by reference and, in respect of Protected Health Information, controls to the extent of any conflict with this DPA.

22B. Order of Precedence

In the event of conflict between this DPA and the Agreement regarding Processing of Organization Personal Data, this DPA will control.

 

  1. Liability

23.1. Each Party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement, unless prohibited by Applicable Data Protection Laws.

23.2. Nothing in this DPA limits liability that cannot be limited under applicable law.

 

  1. Governing Law

This DPA will be governed by the laws of the Province of Ontario, excluding conflict-of-law principles.

 

Schedule 1: Details of Processing

  1. Subject Matter

TeleVU’s Processing of Organization Personal Data in connection with the provision of TelePresence AR platform access, video-enabled remote support, optional recording functionality, user administration, support, security, maintenance, and related services.

  1. Nature and Purpose of Processing

TeleVU will Process Organization Personal Data to:

  1. create and administer user accounts;
  2. authenticate users;
  3. provide live TelePresence AR sessions;
  4. transmit live audio, video, and session metadata;
  5. store optional recordings, photos, or videos where enabled and initiated;
  6. provide customer support;
  7. maintain, secure, monitor, and troubleshoot the Services;
  8. comply with legal obligations;
  9. investigate suspected fraud, abuse, or Security Incidents;
  10. improve the Services, provided that Organization Personal Data is not used to train AI/ML models unless expressly authorized by Organization; and
  11. perform other Processing documented in the Agreement or authorized by Organization.
  1. Duration of Processing

TeleVU will Process Organization Personal Data for the term of the Agreement and for such further period as is necessary to complete return or deletion in accordance with Section 12, or as required by applicable law. Retention of specific categories of Organization Personal Data is governed by Section 12 and any retention schedule agreed in the Agreement or an applicable order form.

  1. Categories of Data Subjects
  1. patients and other individuals receiving care, assessment, consultation, or assistance through Organization’s use of the Services, who may include individuals under the age of majority;
  2. family members, guardians, caregivers, or other individuals present during or participating in a session;
  3. Organization employees, contractors, and administrators;
  4. clinicians, specialists, and other healthcare personnel using the Services;
  5. Organization users of connected devices or remote specialist portals;
  6. individuals who communicate with TeleVU support on behalf of Organization; and
  7. any other individual whose image, voice, or Personal Data is captured or submitted through the Services.
  1. Categories of Personal Data
  1. name;
  2. business email address;
  3. username or account identifier;
  4. role or permission level;
  5. authentication and login metadata;
  6. IP address;
  7. device identifier;
  8. device type, model, operating system, application version, browser/client information, and language preference;
  9. usage information;
  10. session metadata;
  11. support communications;
  12. audio, video, images, or recordings where captured through the Services;
  13. optional user profile information;
  14. other Personal Data submitted by Organization or its authorized users;
  15. health and clinical information, including patient identifiers, intake and consent form contents, assessment and visit records, clinical notes, observations, medical and family history, reason for visit, and clinical or operational commentary entered through the Services; and
  16. audio, video, and photographic recordings of consultations, assessments, or procedures, which may reveal health information about the individuals recorded.

 

  1. Special Categories of Personal Data

The Services are used to Process special-category personal data within the meaning of Article 9(1) of the GDPR and the UK GDPR, namely data concerning health, and equivalent categories of sensitive personal information under Canadian and U.S. privacy laws, including personal health information.

Applied restrictions and safeguards: strict purpose limitation to the Business Purpose; encryption of the data in transit and at rest; role-based access control restricting access to personnel who require it to perform the Services; logging of access to health data; mandatory privacy and security training for personnel with access; background checks where legally permissible; contractual restrictions on onward transfer; and secure deletion at the end of the applicable retention period.

Organization remains responsible for identifying and documenting the condition under Article 9(2) of the GDPR, or the equivalent basis under other Applicable Data Protection Laws, on which it relies for the Processing of such data.

Schedule 2: Sub-processors List

The Data Processor (TeleVU Innovation Ltd.) uses the following sub-processors in connection with the tasks which the Data Processor carries out for the Data Controller (Organization). By entering into the Data Processing Agreement, the Data Controller approves the use of these sub-processors.

 

Sub-processor 1: Amazon Web Services

Sub-processor
Company’s full name Amazon Web Services Canada, Inc.
Services Amazon Web Services Canada, Inc. provides access to AWS cloud infrastructure and related services. Personal data processed by TeleVU’s platform will be stored and processed in the AWS North America region selected for the applicable deployment, such as Canada Central, Canada West, US East, US West, or another agreed AWS North America region. AWS does not publish the physical addresses of its data centers.

Backups, snapshots, replicas, and routine storage are configured by TeleVU to remain within the selected AWS region unless otherwise agreed with the customer. Limited AWS support, security, maintenance, or administrative access may be performed by AWS personnel or AWS affiliates from other locations in accordance with the AWS Data Processing Addendum and applicable AWS service terms.
Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement? Yes. TeleVU’s use of AWS is governed by the applicable AWS Customer Agreement, AWS Service Terms, and AWS Data Processing Addendum. The AWS Data Processing Addendum is incorporated into the AWS Service Terms and applies when AWS services are used to process customer data. Where required, the AWS terms incorporate the applicable Standard Contractual Clauses, UK GDPR Addendum, Swiss Addendum, and other applicable data protection terms.
Data processing which the sub-processor participates in Cloud infrastructure hosting and related services, including compute, database, object storage, authentication, monitoring, logging, networking, backup, availability, and native AWS security services. This may include AWS services such as EC2, RDS, S3, Cognito, CloudWatch, CloudTrail, IAM, KMS, load balancing, and other AWS infrastructure and security services used by TeleVU’s telemedicine platform.

All personal data processed by TeleVU on behalf of the customer is hosted on AWS infrastructure within the selected AWS North America region, subject to the customer’s selected deployment configuration and any agreed data residency requirements.
Categories of personal data processed by the sub-processor All personal data processed by TeleVU on behalf of the customer, including account and authentication data of clinicians and administrative users, session metadata, real-time call media processed transiently, recordings of consultations if recording is enabled by the customer, images and files uploaded by users, patient identifiers, clinical content entered through the TeleVU Patient Portal if used, device data where applicable, audit logs, and aggregate platform performance metrics.
Categories of data subjects Patients receiving care through the customer’s telemedicine service, clinicians and other healthcare staff using the platform, administrative users who manage the platform, and other authorized users invited to participate in TeleVU-supported care, consultation, training, or support workflows.
Transfer to third countries
Does the sub-processor process personal data in a third country? Yes.
If yes, list all third countries Canada and, where the Organization’s deployment is configured for a United States AWS Region, the United States. All data at rest and in regular processing remains within the AWS Canada or US Region selected for the Organization’s deployment. Backups, snapshots, and replicas are restricted to the same Region.
If yes, state the basis for transfer (e.g. EU Commission’s SCC or Binding Corporate Rules) For transfers to Canada, the European Commission adequacy decision for Canada (Decision 2002/2/EC of 20 December 2001) in respect of recipients subject to PIPEDA. For transfers to or access from the United States, and in the event AWS provides global support involving limited and authenticated access from outside Canada or the United States, the AWS Data Processing Addendum incorporates the Standard Contractual Clauses as the lawful transfer mechanism.

 

Sub-processor 2: Zoho Canada Corporation

Sub-processor
Company’s full name Zoho Canada Corporation (operating as Zoho’s contracting entity for Canadian customers, part of the Zoho Corporation group)
Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement? Yes. TeleVU has accepted the Zoho Data Processing Addendum, which includes the EU Standard Contractual Clauses as the basis for transfers where required and prohibits Zoho’s use of customer data for any purpose other than providing the contracted services.
Data processing which the sub-processor participates in Support ticket management and TeleVU’s internal support tooling. Zoho receives only the contents of support tickets raised by Organization staff with TeleVU, and any live chat conversations initiated by Organization staff from TeleVU’s website. Zoho does not have access to the telemedicine platform itself or to patient call data.
Categories of personal data processed by the sub-processor Contents of support tickets raised by Organization staff, names and contact details (typically work email address) of Organization staff who submit support tickets or initiate live chat, and any other information voluntarily included by Organization staff in support correspondence. TeleVU’s support guidance instructs users to avoid including patient data in tickets.
Categories of data subjects Organization staff (clinicians and administrators) who initiate support requests or live chat with TeleVU. Patient data subjects are not expected to be present in this processing.
Transfer to third countries
Does the sub-processor process personal data in a third country? Yes.
If yes, list all third countries Canada.
If yes, state the basis for transfer (e.g. EU Commission’s SCC or Binding Corporate Rules) Adequacy decision. Canada is recognised as providing an adequate level of protection for personal data under European Commission Decision 2002/2/EC of 20 December 2001 (the Canada adequacy decision), in respect of recipients subject to the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). Zoho Canada Corporation is subject to PIPEDA.

 

Sub-processor 3: LiveKit, Inc.

Sub-processor
Company’s full name LiveKit, Inc.
Does the Data Processor have an agreement with the sub-processor which fulfils the requirements of the Data Processing Agreement? Yes. TeleVU has accepted the LiveKit Data Processing Addendum, which incorporates the EU Standard Contractual Clauses (Module 3, Processor-to-Processor) for transfers outside the EEA.
Data processing which the sub-processor participates in Real-time WebRTC media routing and signaling for the Organization’s telemedicine consultations. LiveKit does not store call audio, video, or data streams; recordings, if enabled, are uploaded directly to TeleVU’s AWS S3 bucket in the region selected for the Organization’s deployment. LiveKit’s analytics telemetry is retained encrypted for a maximum of 14 days.
Categories of personal data processed by the sub-processor Call audio and video streams transiting LiveKit’s regional infrastructure during active sessions, signaling metadata (participant identifiers, session identifiers, connection quality metrics), and IP addresses of session participants. No patient identifiers or clinical content from the Patient Portal are transmitted to LiveKit.
Categories of data subjects Patients and clinicians who participate in telemedicine consultations through the Organization’s deployment of the TeleVU platform.
Transfer to third countries
Does the sub-processor process personal data in a third country? Yes.
If yes, list all third countries United States (LiveKit Inc.’s corporate operations, support, and engineering access). Routine signaling and media processing for the Organization’s project is pinned to geographic regions.
If yes, state the basis for transfer (e.g. EU Commission’s SCC or Binding Corporate Rules) EU Standard Contractual Clauses (Module 3, Processor-to-Processor) per the LiveKit Data Processing Addendum, supplemented by region pinning as a technical measure that restricts data flows to the North America Region selected for the Organization’s deployment during normal operation.