Data Processing Agreement

This page describes how AIkER SRL processes personal data in connection with platform operation. For certain processing activities, AIkER may act as a processor under contract (in accordance with Article 28 GDPR), and for other activities (such as security, fraud prevention, legal compliance, operational analytics) as an independent controller. The treating physician remains the independent controller for medical acts and clinical decisions. AIkER provides a technological platform that:

• Provides orientation based on user-provided information at triage;
• Provides clear recommendations (🟢 home monitoring, 🟡 teleconsultation, 🔴 emergency);
• Facilitates secure connections with authorized doctors for video consultations;
• Stores and manages consultation records and electronic prescriptions;
• Processes digital payments through a secure third-party payment provider.

AIkER processes:

• Identification data: Name, email, phone;
• Medical data: Symptoms, medical history, assessments, consultation records, prescriptions;
• Financial data: Payment transaction data (amounts, transaction identifiers); card details are handled solely by our PCI-DSS-compliant payment provider and are not stored by AIkER;
• Usage data: IP, browser, timestamps, cookies.

The purposes of processing include, as applicable, the provision and management of the platform's services, facilitating teleconsultations, managing medical records and prescriptions, payment processing, as well as security, fraud prevention, legal compliance, and operational improvement of the Platform.

Processing is based on:

• Art. 6(1)(a) GDPR: Explicit patient consent;
• Art. 6(1)(b) GDPR: Execution of service contract;
• Art. 6(1)(c) GDPR: Legal obligation (HG 1133/2022, GDPR, tax laws);
• Art. 6(1)(f) GDPR: Legitimate interest (security, fraud detection, audit).

The legitimate interests pursued include the security of the Platform and of data, the prevention and detection of fraud, protection against misuse, and the performance of necessary checks and audits.

For special-category (health) data, processing additionally relies on:

• Art. 9(2)(a) GDPR: the patient's explicit consent, for AIkER's own processing, such as the storage and routing of consultation data;
• Art. 9(2)(h) GDPR: provision of healthcare, where AIkER acts as processor for the treating physician (the controller), who is bound by professional secrecy.

For the conclusion and performance of the services, the provision of certain personal data is mandatory. In the absence of such data, AIkER may be unable to provide the requested services. The provision of other data not necessary for the provision of the services may be optional, as applicable.

AIkER implements appropriate technical and organizational measures to protect personal data, in accordance with Article 32 GDPR. These include, among others: encryption of data in transit (HTTPS/TLS); role-based access controls that limit access to authorized persons on a need-to-know basis; and processing of payment card data exclusively through a PCI-DSS-compliant payment provider, so card details are never stored by AIkER. No method of transmission or storage is completely secure; AIkER reviews and, where applicable, improves these measures based on identified risks and technological developments.

AIkER uses third-party service providers (subprocessors) to support platform operations, including for infrastructure and hosting services, payment processing, communications, and video services. These providers are selected and used in accordance with applicable GDPR requirements. Information about the subprocessors used by AIkER may be updated periodically, depending on operational, regulatory, or security requirements.

AIkER does not retain data longer than necessary for the purposes for which it is processed, in accordance with the storage limitation principle set out in Article 5(1)(e) GDPR. Retention periods may vary depending on the nature of the data and applicable legal, fiscal, medical, regulatory, or operational obligations. Upon expiry of the applicable period, data is deleted or anonymized, as appropriate.

In accordance with GDPR, patients have rights to:

• Access (Art. 15): Copy of data within 30 days;
• Rectification (Art. 16): Correction of inaccurate data;
• Erasure (Art. 17): "Right to be forgotten" under certain conditions;
• Restriction (Art. 18): Restriction of processing;
• Portability (Art. 20): Transfer data to another provider;
• Objection (Art. 21): Refusal of processing for marketing.

To exercise these rights, contact: contact@aiker.ro. AIkER will respond to requests without undue delay and, in any event, within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by up to two further months, with the data subject informed within one month of receipt of the request and provided with the reasons for the delay. In accordance with GDPR, users also have the right to lodge a complaint with the competent supervisory authority (ANSPDCP in Romania).

In accordance with Articles 33 and 34 GDPR, AIkER notifies the competent authority of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, without undue delay and, where feasible, within 72 hours of becoming aware of it. Data subjects will be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms, under the conditions set out in the GDPR.

AIkER prioritizes data storage within the European Union. Where data is transferred outside the European Union, AIkER uses transfer mechanisms compliant with GDPR requirements, including, as applicable, Standard Contractual Clauses (SCC) and assessments of the transfer's impact and the applicable level of protection.

AIkER may perform periodic internal reviews and compliance assessments, based on identified needs and risks. Competent supervisory authorities may exercise their powers granted under applicable law.

AIkER may modify, supplement, or update this document periodically to reflect legal, regulatory, or operational developments. The updated version will be published on this page, indicating the date of the last update. Continued use of the Platform after such changes are published constitutes acceptance of those changes, subject to compliance with applicable legal requirements.

AIkER SRL

• contact@aiker.ro

Data Protection Contact

• contact@aiker.ro

National Supervisory Authority (ANSPDCP)

• Address: Bucharest, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336
• Telefon: +40.318.059.211
• Web: https://www.dataprotection.ro/

Any person who considers that their rights under the GDPR have been infringed may lodge a complaint with ANSPDCP, under the conditions set out in the GDPR.