Data Processing Agreement (AVV)

Parties

Controller (the Practice): the medical or dental practice identified below.

Practice name / address: ____________________________________

Represented by: ____________________________________

Processor: H2F Group GmbH, trading as Auralinx, Seestrasse 13a, 6315 Oberägeri, Switzerland. contact@auralinx.ch.

1. Roles, scope and duration

The Practice is the controller and decides why and how the data is processed. Auralinx is the processor and acts only on the Practice's instructions. Auralinx operates an AI telephone assistant that answers inbound patient calls, books appointments, performs administrative triage, and records call outcomes and transcripts, as agreed at onboarding. The categories of data and data subjects are summarised in Annex A. This agreement runs for the term of the service agreement and until the deletion or return of data is complete. Where it conflicts with the service agreement on data protection, this agreement prevails.

2. How Auralinx may use the data

Auralinx processes the data only on the documented instructions of the Practice, the initial set of which is the configuration agreed at onboarding. It informs the Practice without undue delay if an instruction appears to breach data protection law. Auralinx does not use the data for its own purposes, never uses patient data to train artificial intelligence models, and never sells or shares it. The service performs administrative intake and triage only; medical assessment and decisions remain with the Practice.

3. Confidentiality and security

Everyone authorised to process the data is bound by confidentiality, consistent with the professional-secrecy duties of a medical practice. The following measures apply:

• Encryption in transit (TLS) and at rest (AES-256)
• Hosting on ISO 27001-certified infrastructure within the EU
• Role-based access and multi-factor authentication for accounts processing health data
• Audit logging of access to health data, and logical separation between client accounts
• Zero-retention configurations with the speech-to-text and voice providers

4. Sub-processors

Auralinx engages vetted sub-processors to provide the service and binds each of them in writing to data-protection obligations equivalent to those here. Patient health data is processed within a healthcare-designated configuration that restricts the providers, regions and retention used for such data. A current list of sub-processors, with their roles and processing locations, is available to the Practice on request at contact@auralinx.ch. Auralinx gives at least 30 days' notice of any new or replacement sub-processor, and the Practice may object on reasonable data-protection grounds. Every sub-processor handling patient health data processes it within the EU, or in a country covered by an applicable adequacy decision.

5. Where the data is processed

Patient health data is hosted and processed within the European Union. Hosting, speech-to-text, voice synthesis and language-model processing are performed by sub-processors located in the EU, and providers located outside the EU are contractually excluded from processing patient health data. Telephony and phone numbers are provided through a sub-processor under an equivalent data processing agreement. Where any transfer of non-health operational data to a third country occurs, it is covered by the EU Standard Contractual Clauses and the Swiss Addendum. The identity of each sub-processor is available to the Practice on request at contact@auralinx.ch.

6. Patient rights

Auralinx assists the Practice in responding to patients who exercise their rights of access, rectification, erasure, restriction, objection or data portability. If a patient contacts Auralinx directly, Auralinx forwards the request to the Practice and does not respond on its own. On the Practice's instruction, Auralinx erases the relevant calls, transcripts and appointment data within the configured deletion cycle.

7. Data breaches

Auralinx notifies the Practice without undue delay after becoming aware of a personal-data breach affecting the Practice's data, and provides the information reasonably available to support the Practice's notifications to the FDPIC (Art. 24 revDSG) and, where applicable, to a supervisory authority and to data subjects (Art. 33 and 34 GDPR). Notifications to authorities and patients remain the responsibility of the Practice.

8. AI transparency and recording

At the start of each call the assistant discloses that the caller is speaking with a digital assistant (Art. 50 of the EU AI Act); the Practice is the deployer for that purpose. Call recording is off by default and is enabled only on the Practice's documented instruction, with callers informed as required by law.

9. Audit

The Practice may request the certifications and security information that Auralinx and the platform provider hold. Audits are conducted by report (such as security summaries, penetration-test letters and policies), remotely, and no more than once per 12 months. On-site audits take place only where required by law or by a competent supervisory authority, on reasonable notice and subject to confidentiality.

10. Retention, deletion, liability and law

Calls, transcripts and appointment data are retained for the period agreed at onboarding, up to a maximum of 180 days. Call metadata and logs may be kept for up to 12 months. When data is deleted or the agreement ends, it is removed from active systems and backups are purged within the platform's standard cycle, unless retention is required by law. On termination, Auralinx returns or deletes the data at the Practice's choice. To the extent permitted by mandatory law, Auralinx's total liability under this agreement is limited to CHF 1’500; this limit does not apply to liability that cannot be limited under mandatory law. This agreement is governed by Swiss law, with place of jurisdiction Zug. Amendments require written form.

Annex A. Processing at a glance

Data subjects

Patients and other callers; practice staff named in routing rules

Personal data

Name, phone number, details given on the call; appointment data; transcripts and, if enabled, recordings

Special-category data

Health data (Art. 9 GDPR / revDSG) disclosed by the caller during intake and triage

Purposes

Answering calls, appointment booking and reminders, administrative triage, routing emergencies and human-requested calls to the Practice

Channels

Voice (primary); SMS and email where activated

Retention

As configured, up to 180 days. Recording off by default

Annex B. Sub-processors

Auralinx uses vetted sub-processors to deliver the service. Each is bound in writing to data-protection obligations equivalent to this agreement, and every sub-processor handling patient health data processes it within the EU. A current list of sub-processors, with each one's role and processing location, is available to the Practice on request at contact@auralinx.ch. Auralinx notifies the Practice of any change at least 30 days in advance, and the Practice may object on reasonable data-protection grounds.