The Article 28 instrument behind your Privacy Policy consent.

This Data Processing Agreement ("DPA"), version 1.0.0, forms part of the Terms of Use between you or your clinic ("Controller", "you") and Grandiosa Vision FZCO, trading as "Faurenis", established in Dubai, United Arab Emirates ("Processor", "we", "us"). It applies whenever we process personal data on your behalf as part of the Service, and reflects Article 28 GDPR.

Where these terms conflict with the Terms of Use on a matter this DPA specifically governs, this DPA controls for that matter; otherwise the Terms of Use govern.

Subject matter: the processing of personal data submitted to, or generated within, the Service in the course of you or your clinic using it for clinical documentation, charting, and related workflow support.

Duration: for as long as your Subscription is active, plus the retention and deletion window described in the Privacy Policy.

Purpose and nature of processing: hosting, storage, transmission, AI-assisted drafting (ambient scribe, voice charting, copilot), document processing, and display of the data back to you and your authorised staff — solely to provide the Service as described in the Terms of Use.

Categories of data subjects: your patients, and your clinic's staff who use the Service.

Categories of personal data: patient identification and contact details, clinical and dental history, audio recordings of clinical encounters, AI-drafted and clinician-accepted clinical notes, periodontal chart data, treatment plans, and documents or images submitted for document intelligence. This may include special category health data within the meaning of Article 9 GDPR.

We will:

• process personal data only on your documented instructions, including with regard to international transfers, unless required to do otherwise by law that applies to us — in which case we will inform you before processing, unless that law prohibits this on important grounds of public interest;
• ensure that persons authorised to process the personal data are bound by confidentiality obligations;
• implement the technical and organisational security measures described in the Privacy Policy's "How we protect data" section, having regard to the state of the art, cost of implementation, and the risk to data subjects;
• assist you, insofar as reasonably possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR;
• assist you with your obligations under Articles 32 to 36 GDPR (security, breach notification, and data protection impact assessments), taking into account the information available to us;
• at your choice, delete or return all personal data at the end of the provision of Service, and delete existing copies, except where applicable law requires retention — as further described in the Privacy Policy's retention section;
• make available to you the information reasonably necessary to demonstrate compliance with this Article, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice and confidentiality.

You provide general authorisation for us to engage the sub-processors described in the Privacy Policy's "Sub-processors and other recipients" section to assist in providing the Service, on the terms and with the limitations described there — including that a payment sub-processor never receives clinical or patient data.

We will inform you of any intended addition or replacement of a sub-processor that will process your clinic's data with at least 30 days' notice, giving you the opportunity to object on reasonable data-protection grounds, consistent with the commitment already published on our Trust Centre. Every sub-processor we engage is bound by data-protection obligations equivalent to those in this DPA.

Where personal data is transferred outside the EU/EEA — including, where applicable, in connection with a sub-processor's support or operational functions — that transfer is governed by Standard Contractual Clauses or another transfer mechanism recognised under GDPR, as described in the Privacy Policy's "International data transfers" section, which forms part of this DPA by reference.

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf, providing the information reasonably available to us to help you meet your own notification obligations under Articles 33 and 34 GDPR. This notification obligation exists independently of, and does not replace, your own obligation to assess and notify supervisory authorities and data subjects where required.

Liability arising out of or relating to this DPA is subject to the limitation of liability set out in the Terms of Use, applied to this DPA as if fully restated here, except for liability that cannot lawfully be limited under applicable data-protection law.

This DPA takes effect on the date you accept it and remains in force for as long as we process personal data on your behalf under the Terms of Use, terminating automatically when that processing ends, without prejudice to any provision that by its nature should survive termination, including deletion/return obligations and confidentiality.

This DPA is governed by the same governing law and forum as the Terms of Use.

We may update this DPA to reflect a change in our sub-processors, security measures, or applicable law; where a change is material, we will notify you and, where required, seek renewed acceptance under a new version number. Questions about this DPA can be sent to info@faurenis.ai, or in writing to Grandiosa Vision FZCO, Dubai, United Arab Emirates.