Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Grounded Scribe Pty Ltd (ABN 69 695 177 818) ("Processor", "we", "us") and the organisation or individual subscribing to our services ("Controller", "you"). This DPA governs the processing of personal information in connection with Grounded Scribe's clinical documentation platform.

1. Definitions

• Personal Information has the meaning given in the Privacy Act 1988 (Cth).
• Processing means any operation performed on personal information, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, or destruction.
• Data Breach means unauthorised access to, unauthorised disclosure of, or loss of personal information.
• Sub-processor means a third party engaged by us to process personal information on your behalf.

2. Scope and Purpose

We process personal information solely to provide our clinical documentation services as described in our service agreement. The categories of personal information processed include:

• Practitioner profiles (name, email, profession, practice details)
• Client and patient names and contact details
• Clinical session recordings (temporarily, for transcription purposes only)
• Transcripts and clinical notes
• Assessment responses and outcomes

The categories of data subjects whose personal information may be processed include practitioners, their clients and patients, and students (for school customers).

3. Our Obligations

As Processor, we undertake to:

• Process personal information only on your documented instructions, unless required to do so by Australian law
• Ensure that all personnel authorised to process personal information are bound by appropriate confidentiality obligations
• Implement and maintain appropriate technical and organisational security measures to protect personal information
• Assist you in responding to requests from data subjects exercising their rights under applicable privacy legislation
• Delete or return all personal information to you upon termination of services, at your election, unless retention is required by law
• Make available to you all information necessary to demonstrate our compliance with this DPA

4. Security Measures

We implement and maintain the following technical and organisational measures to protect personal information:

• Encryption of data in transit and at rest
• Role-based access controls and multi-factor authentication
• Comprehensive audit logging of access to personal information
• Regular security assessments and vulnerability scanning
• All data hosted within Australian cloud infrastructure

5. Sub-processors

We engage a limited number of sub-processors to assist in delivering our services. A current list of sub-processors, including details of the processing they perform and the countries in which they operate, is available to customers on request by contacting privacy@groundedscribe.com.

We will provide you with reasonable notice of any intended changes to our sub-processors, giving you the opportunity to object to such changes. We remain fully responsible for the acts and omissions of our sub-processors as if they were our own.

6. Data Breach Notification

In the event of a data breach affecting personal information processed on your behalf, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach. Our notification will include:

• The nature of the breach
• The categories and approximate number of data subjects and records affected
• The likely consequences of the breach
• The measures taken or proposed to address and mitigate the breach

We will cooperate with you and take reasonable steps to assist in the investigation, mitigation, and remediation of any data breach, including meeting obligations under the Notifiable Data Breaches scheme.

7. International Transfers

All primary data storage and processing occurs within Australia. Where any sub-processor processes personal information outside Australia, we ensure that appropriate safeguards are in place consistent with Australian Privacy Principle 8 (cross-border disclosure of personal information). We take reasonable steps to ensure that overseas recipients handle personal information in accordance with the Australian Privacy Principles.

8. Data Retention and Deletion

• We retain personal information for the duration of your subscription and as necessary to provide the services
• Upon termination of your subscription, all personal information is deleted within 90 days, unless retention is required by applicable law
• Audio recordings are deleted immediately after successful transcription and are never permanently stored
• You may request a full export of your data at any time during the term of your subscription

9. Your Rights and Responsibilities

As Controller, you:

• Are responsible for obtaining all necessary consents from data subjects prior to processing their personal information through our services
• Are responsible for ensuring the lawfulness of the processing instructions you provide to us
• May audit our compliance with this DPA upon reasonable written notice, subject to confidentiality obligations and during normal business hours
• Warrant that your use of our services complies with all applicable privacy and data protection legislation

10. Term and Termination

This DPA is effective for the duration of your subscription to Grounded Scribe and automatically terminates upon the expiry or termination of your subscription. Our obligations with respect to the deletion of personal information, confidentiality, and data breach notification survive the termination of this DPA.

11. Governing Law

This DPA is governed by and construed in accordance with the laws of Victoria, Australia. Any disputes arising under or in connection with this DPA are subject to the exclusive jurisdiction of the courts of Victoria.

12. Contact

For data protection enquiries related to this DPA, please contact us at:

• Email: support@groundedscribe.com
• Address: Grounded Scribe Pty Ltd, Melbourne, Victoria, Australia