1. Introduction
This agreement governs data processing carried out through the MedFix platform between the customer as the "data controller" and MedFix as the "data processor", in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443H, as amended, and its implementing regulations. It forms an integral part of the Terms and Conditions and the Privacy Policy.
2. Roles
Data Controller
The Customer, which determines the purposes and means of processing the data entered into the system.
Data Processor
The MedFix platform, which processes, operates and hosts the data on the Customer's instructions and for the purpose of providing the service.
3. Scope of processing
MedFix may process data for the following purposes only: operating the system, hosting data, providing technical support, backup, data recovery, protecting system security, and complying with legal obligations.
4. Customer obligations
The Customer undertakes to: enter data lawfully and legitimately, obtain the necessary consents where required, comply with the relevant laws, and ensure the accuracy of the data entered.
5. MedFix obligations
MedFix undertakes to: process data within the scope of the service and the customer's documented instructions; not use data for unauthorized purposes; apply appropriate protection measures; restrict access to data to authorized persons only and bind them to confidentiality; and reasonably assist the customer in meeting its legal obligations, including impact assessments and responding to data subject requests.
6. Confidentiality
MedFix undertakes to keep the data confidential and not to disclose it except: with the Customer's consent, where there is a legal obligation, or at the request of a competent judicial or regulatory authority.
7. Incident notification
MedFix will notify the customer without undue delay, and no later than forty-eight (48) hours after becoming aware, of any breach, destruction of or unlawful access to data it processes on the customer's behalf, providing available information on the nature of the incident, the data affected and the measures taken, so that the customer can meet its obligation to notify the competent authority within the period required by law.
8. Sub-processors
MedFix may engage technical service providers, hosting providers or technical support parties as sub-processors where needed to provide the service. MedFix will choose providers that apply appropriate levels of data protection, bind them to protection obligations no less than those in this agreement, and remain responsible to the customer for their obligations. MedFix keeps an up-to-date list of sub-processors, provides it to the customer on request, and notifies the customer at least fourteen (14) days before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds; if no solution can be reached, the customer may terminate the subscription.
9. Data transfers
MedFix does not transfer personal data outside the Kingdom of Saudi Arabia, or disclose it to a party outside it, except in accordance with the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, in a way that ensures a level of protection no lower than that required by law. MedFix provides the customer, on request, with information about where its data is hosted.
10. Data subject requests
The parties will cooperate to a reasonable extent in handling requests relating to personal data in accordance with applicable laws.
11. Verification and audit
On reasonable request, MedFix will provide the customer with the information needed to demonstrate compliance with this agreement, including a description of the security controls in place, and will cooperate with any assessment or audit carried out by the customer or an independent party it appoints, with reasonable prior notice and without compromising the confidentiality of other customers' data or the security of the platform.
12. End of service
When the contractual relationship ends, the customer may request a copy of its data under the approved technical procedures within the ninety (90) day retention period from the end date. After that period MedFix will securely delete or destroy the data unless a law requires it to be kept, and backups are deleted at the end of their own retention cycle. The customer may request confirmation that deletion has been completed.
13. Order of precedence
In the event of a conflict between this agreement and any other agreement relating to data processing, this agreement prevails with respect to data processing.