Data Processing Agreement

This agreement is entered into between the center that contracts Vanty ABA (the "Center"), as data controller, and Andrew Jonathan Manasias Martínez Albitres, RUC 10763965312, trade name "Vanty", Jr. Francisco Pizarro 387, Bellavista, Callao, Perú ("Vanty"), as data processor, under Peru's Personal Data Protection Law (Law No. 29733) and its regulations.

Its purpose is to regulate how Vanty processes, on behalf of the Center, the personal data that the Center and its users record in the platform. It complements the Terms of Service and the Privacy Policy; in case of conflict regarding the processing of the Center's data, this agreement prevails.

• Patients (including minors): identification data, date of birth, diagnosis, assessments, therapy programs, session records, progress, clinical documents and reports. This is sensitive health data.
• Families and guardians: name, contact details, relationship with the patient, messages and forms.
• Center staff: name, email, phone, role, specialty and activity in the platform.
• Administrative data: appointments, payments and receipts recorded by the Center.

Vanty processes the data only to provide the platform to the Center (clinical management, scheduling, communication with families, reports and, if the Center turns them on, AI features) and following the Center's documented instructions, which are the use and configuration it makes of the platform.

Vanty does not use the Center's data for its own purposes, does not sell it, does not use it for advertising and does not use it to train artificial intelligence models.

• Confidentiality: only people bound by confidentiality access the data, and only when necessary to provide or support the service.
• Security: apply the technical and organizational measures described in this agreement.
• Legality: inform the Center if, in its opinion, an instruction infringes data protection law.
• Records: keep activity and audit logs of relevant actions on the platform.

The Center authorizes Vanty to use the following sub-processors, which are bound by confidentiality and security obligations equivalent to those of this agreement:

• Supabase Inc. database, authentication and file storage (servers in São Paulo, Brazil).
• Vercel Inc. hosting of the application (United States).
• Google LLC email delivery; and Google Calendar, only if a user links it (United States).
• Microsoft Corporation Outlook Calendar, only if a user links it (United States).
• Groq, Inc. · DeepInfra, Inc. artificial intelligence, only if the Center turns on AI features; DeepInfra only as a backup (United States).
• Tavily · OpenAlex internet and academic search for ARIA; they only receive the general question, without patient data (United States).

As an additional contractual commitment of Vanty (not a period required by Law No. 29733), Vanty will inform the Center of any change of sub-processor through the platform or by email at least 15 days in advance. If the Center objects on reasonable grounds, it may terminate the service without penalty.

Because the sub-processors host or process data outside Peru, the Center authorizes these cross-border data flows, which are carried out with appropriate safeguards under the applicable regulations.

• Encryption at rest (AES-256) and in transit (TLS).
• Isolation by center through row-level security policies.
• Role-based access and two-step verification available for every account.
• Minimal data to AI only with the Center's prior authorization, which can be withdrawn at any time.
• Backups and activity logs to detect and investigate incidents.

Vanty will notify the Center immediately and without undue delay from the moment it becomes aware of a security incident that affects personal data processed on behalf of the Center, by email to the account that created the center. The notice will include, as far as the information is available, the nature of the incident, the categories of data and data subjects affected, the possible consequences and the measures taken or proposed; Vanty will not wait to complete the investigation before giving the first notice.

Vanty will cooperate with the Center so it can meet in time the notification obligations that correspond to it under the applicable regulations, including those towards the National Authority for Personal Data Protection and the data subjects, and will keep an internal record of incidents with the facts, their effects and the measures taken.

Requests for access, rectification, erasure or objection concerning patients and families are answered by the Center, as controller. Vanty will provide the platform tools (editing, export and deletion) and, if it receives a request directly, will forward it to the Center without responding on its behalf.

• Legal basis: have the consent of patients or of their parents or legal guardians, or another legal basis, to record their data and, if it turns them on, to use the AI features.
• Registration: register its own personal data banks (patients) with the National Registry of Personal Data Protection when required.
• Accounts: manage who has access, deactivate accounts of people who stop working with it and keep credentials confidential.
• Accuracy: record accurate data and only what is necessary for care.

While the service is active, the Center can export its information from the platform. When the Center deletes its account, Vanty deletes the Center's data, its files and the accounts linked only to that center, except what the law requires it to keep. Backups are deleted according to the backup retention cycle of our infrastructure provider (currently, no more than 30 days).

Clinical-record retention periods are the Center's responsibility: before deleting its account, the Center must keep, outside the platform, the information it is legally required to preserve.

Vanty will provide the Center, upon reasonable request to vantysupport@gmail.com, the information necessary to demonstrate compliance with this agreement, including the list of sub-processors and a description of the security measures in force.

The Center accepts this agreement when it creates its account in the platform or when its management accepts it in the platform notice, and it remains in force while Vanty processes data on its behalf. Vanty may update it to reflect regulatory or service changes; relevant changes will be announced in the platform and will require a new acceptance.