Medical Practitioner Contractor Agreement
| Company | Holyland Medical Pty Ltd (ABN 37 692 644 367) 196D Riversdale Road, Hawthorn, Victoria 3122 Australia Email: holylandmedical@gmail.com |
| Medical Practitioner | [INSERT FULL NAME] [INSERT ADDRESS] Email: [insert] |
| Commencement Date | [INSERT DATE] OR Date of last signature to this Agreement |
| Term | 3 years |
| Services | The Services to be provided by the Medical Practitioner are limited to the provision of second medical opinion consultations, and include:
The Services expressly exclude:
|
| Contractor Payment | The amount payable by the Company to the Medical Practitioner in respect of each Consultation conducted through the Platform, being the Consultation Fees for the relevant Consultation, less:
|
| Platform Service Fee | 15% of the Consultation Fees set by the Medical Practitioner |
| Special Terms | Not applicable |
Signed by Holyland Medical Pty Ltd in accordance with section 127 of the Corporations Act 2001 (Cth) by: Signature of Ruslan Fatikov who is the sole director and sole secretary | Signed by [insert Medical Practitioner name] in the presence of: Signature of witness |
Signature of [insert Medical Practitioner name] | Name of witness (print) |
General Terms
1. Interpretation
1.1. In this Agreement, unless the context otherwise requires:
- capitalised terms have the meanings given to them in the Details section of this Agreement or clause 18 (Definitions);
- a reference to a person includes a natural person, corporation, trust, partnership, joint venture, association, body corporate, government body, or other entity;
- a reference to a party includes that party's successors and permitted assigns;
- the singular includes the plural and vice versa;
- headings are for convenience only and do not affect interpretation;
- a reference to a statute or statutory provision includes all amendments, re-enactments, and subordinate legislation made under it from time to time;
- the word including and similar expressions are not words of limitation; and
- a reference to dollars or $ is a reference to US dollars.
2. Term
2.1. This Agreement commences on the Commencement Date and continues for the Term, unless terminated in accordance with clause 14.
3. Nature of Engagement
3.1. The Company engages the Medical Practitioner, and the Medical Practitioner accepts the engagement, to provide the Services to Patients using the Platform on the terms and conditions of this Agreement.
The Medical Practitioner is engaged as an independent contractor and not as an employee, agent, partner, or joint venturer of the Company. Nothing in this Agreement creates or is intended to create a relationship of employment, agency, partnership, or joint venture between the parties.
The Medical Practitioner acknowledges and agrees that:
- they are solely responsible for their own taxation, pension, social security, superannuation and similar obligations arising from any payments made under this Agreement, and the Company has no obligation to withhold, remit or make such payments on behalf of the Medical Practitioner unless required by Applicable Laws;
- they are not entitled to, and waive any claim to, any employment-related entitlements or benefits from the Company under the laws of the jurisdiction in which the Medical Practitioner is located and licensed to practise, including but not limited to wages, leave entitlements, redundancy pay, social security contributions, pension or retirement benefits;
- they are free to provide similar services to other persons, businesses or platforms, provided that such services do not:
- conflict with the Medical Practitioner's obligations under this Agreement or adversely affect their ability to provide the Services in accordance with this Agreement;
- involve any use of the Company's Confidential Information or Intellectual Property, or Patient Information obtained through the Platform; or
- involve soliciting, diverting or providing services outside the Platform to Patients introduced through the Platform, except with the prior written consent of the Company.
- the Company does not guarantee any minimum number of Patients or Consultations during the Term;
- they are not entitled to any minimum volume of work, payment or exclusivity of engagement; and
- the Company may determine, acting reasonably and subject to Applicable Laws, how the Platform operates, including but not limited to allocation of Patients, practitioner availability settings and Platform access arrangements.
3.2. The Medical Practitioner must not represent to any person that the Medical Practitioner is an employee or agent of the Company.
4. Services
4.1. The Medical Practitioner must provide the Services:
- in accordance with this Agreement and the Platform Operational Guidelines;
- with the degree of skill, care, and diligence expected of a competent and experienced Medical Practitioner;
- in compliance with all Applicable Laws, including the laws, regulations, professional standards, codes, guidelines and ethical requirements of the relevant regulatory or licensing bodies governing the Medical Practitioner in the jurisdiction in which:
- the Medical Practitioner is located and licensed to practise; and
- the relevant Patients are located,
- only in respect of Patients located in jurisdictions for which the Medical Practitioner is appropriately licensed, authorised or otherwise permitted to provide the Services; and
- in a manner that is consistent with generally accepted standards of telehealth practice and the best interests of Patients.
4.2. The Medical Practitioner must:
- be available to provide Consultations during the hours and on the days nominated by the Medical Practitioner on the Platform, as updated by the Medical Practitioner from time to time in accordance with the Platform Operational Guidelines;
- use the Platform to conduct all Consultations with Patients who have booked the Consultation through the Platform, except where the Medical Practitioner identifies that the Patient requires the type of care that must be referred to an emergency or in-person service in accordance with clause 4.2.c;
- immediately direct any Patient that requires urgent, emergency or in-person medical assessment to contact their local emergency services or seek immediate in-person medical care;
- create and maintain accurate, complete and contemporaneous Medical Records on the Platform for each Consultation in accordance with Applicable Laws, regulations, professional standards, codes, guidelines and ethical requirements of the regulatory or licensing bodies governing the Medical Practitioner in the relevant jurisdiction;
- only issue referrals, written opinions, and/or other clinical documents where clinically appropriate and permitted under Applicable Laws in both the jurisdiction in which the Medical Practitioner is located and the jurisdiction in which the Patient is located;
- respond to Patients and the Platform within a reasonable time and in any event within 2 Business Days of receiving any communication requiring a response (or such shorter period as may be required in the event of clinical urgency); and
- promptly provide all information, documents and reasonable assistance requested by the Company in connection with any complaint, incident, patient safety concern, investigation or regulatory matter relating to the Services.
4.3. The Medical Practitioner must, at their own cost:
- provide and maintain all equipment, devices, internet connectivity, telephone services, software, workspace and other resources necessary to provide the Services safely, securely and professionally;
- ensure that any equipment, devices and networks used to access the Platform are secure, reliable and suitable for handling Patient Information and conducting the Consultations in compliance with this Agreement, Privacy Laws and applicable professional standards; and
- conduct Consultations from an appropriately private environment that protects Patient Information and confidentiality.
4.4. The Medical Practitioner acknowledges that the Company may update the Platform Operational Guidelines from time to time and that the Medical Practitioner is required to comply with any updated Platform Operational Guidelines from the date notified by the Company.
4.5. The Medical Practitioner must not:
- provide any online Consultation to a Patient introduced through the Platform outside the Platform without the prior written consent of the Company;
- solicit or accept direct payment from a Patient for any Consultation that is booked through the Platform;
- engage in any conduct that may bring the Company or the Platform into disrepute; or
- subcontract, delegate, assign or otherwise arrange for any other person to perform any part of the Services.
5. Professional Registration and Compliance
5.1. The Medical Practitioner must, at all times during the Term maintain all Professional Registration required to lawfully provide the Services, and current and adequate Professional Indemnity Insurance as required under clause 9.
5.2. The Medical Practitioner must:
- promptly provide the Company, upon request, with evidence of their Professional Registration and Professional Indemnity Insurance; and
- immediately cease providing the Services if they no longer satisfy the requirements of clause 5.1.
5.3. The Medical Practitioner must immediately notify the Company in writing if:
- their Professional Registration is suspended, cancelled, restricted, allowed to lapse, or made subject to any condition, notation, undertaking or limitation;
- they become subject to any investigation, complaint, disciplinary process or adverse finding by any regulatory, licensing or professional body;
- their Professional Indemnity Insurance is cancelled, lapses, is reduced, or becomes subject to any material exclusion or limitation;
- they become aware of any matter that may affect their ability to lawfully or safely provide the Services;
- they become aware of any fact or circumstance that may reasonably give rise to a Patient complaint, regulatory investigation or professional indemnity claim; or
- any information provided to the Company in connection with this Agreement ceases to be true or accurate.
6. Representations and Warranties
6.1. The Medical Practitioner represents and warrants to the Company on the Commencement Date and throughout the Term that:
- all information provided to the Company regarding their qualifications, Professional Registration, experience, insurance and professional standing is true, accurate, complete and not misleading;
- they hold and will maintain all Professional Registration required to lawfully provide the Services;
- their Professional Registration is current, valid, in good standing, and not subject to any conditions, restrictions, suspensions or undertakings that would adversely affect or limit their ability to provide the Services;
- they are not aware of any fact, matter, investigation, complaint or circumstance that would reasonably be expected to adversely affect their ability to provide the Services, except as disclosed in writing to the Company before the Commencement Date;
- they have not been convicted of any criminal offence that is relevant to the provision of the Services or that would render them unsuitable to provide the Services; and
- they hold and will maintain Professional Indemnity Insurance in accordance with clause 9 of this Agreement.
6.2. The Medical Practitioner acknowledges that the Company has relied on the representations and warranties in clause 6.1 when entering into this Agreement.
6.3. Any breach of the representations and warranties contained in clause 6.1 will be deemed a material breach of this Agreement.
7. Access to the Platform
7.1. Subject to compliance with the terms of this Agreement, the Company grants the Medical Practitioner a non-exclusive, non-transferable, revocable licence to access and use the Platform solely for the purpose of providing the Services during the Term.
7.2. The Medical Practitioner must:
- maintain the security and confidentiality of their login credentials for the Platform and not permit any other person to access the Platform using their login credentials;
- immediately notify the Company of any suspected or actual unauthorised access to their account on the Platform; and
- only use the Platform for the purpose of providing the Services under this Agreement.
7.3. The Company may immediately suspend or restrict the Medical Practitioner's access to the Platform and/or require the Medical Practitioner to temporarily cease providing some or all of the Services, if:
- the Company reasonably suspects a material breach of this Agreement or Applicable Laws;
- a Patient safety concern arises or the Company becomes aware of or receives a complaint from a Patient;
- the Medical Practitioner ceases to meet any of the requirements specified under clause 5.1;
- the Company reasonably considers that continued access to the Platform may expose the Company, its Patients, or the Platform to any legal, regulatory, reputational, security or operational risk; or
- suspension is required by Applicable Laws or a regulatory authority.
7.4. Any suspension or restriction under clause 7.3 does not limit the Company's rights or remedies under this Agreement, including any right to terminate this Agreement under clause 14.
8. Fees and Payment
8.1. All fees and payments referred to in this Agreement are in US dollars (USD), unless otherwise indicated.
8.2. The Medical Practitioner may determine the Consultation Fees charged to Patients for the Consultation through the Platform, subject to the functionality of the Platform and any reasonable pricing requirements or parameters notified by the Company from time to time.
8.3. In consideration for the provision of the Services, the Company will collect the Consultation Fees from Patients through the Platform and remit the Contractor Payment to the Medical Practitioner in accordance with this clause 8.
8.4. The Contractor Payment will be remitted to the Medical Practitioner by wire transfer on a monthly basis.
8.5. The Medical Practitioner is solely responsible for all taxes, duties, levies and governmental charges arising in connection with the Contractor Payment (including but not limited to income tax, value added tax, goods and services tax, withholding tax and similar in any relevant jurisdiction), except to the extent the Company is required by Applicable Laws to withhold, deduct or remit any amount.
8.6. Where the Company is required by Applicable Laws to withhold, deduct or remit any tax, levy, duty or similar amount from the Contractor Payment, the Company may do so, and payment of the balance to the Medical Practitioner satisfies the Company's payment obligations under this Agreement.
8.7. The Company may deduct or set-off from any Contractor Payment any amounts owed by the Medical Practitioner to the Company as a result of:
- any full or partial refund, credit or chargeback provided to a Patient under the Platform Terms of Use as a result of the Medical Practitioner's cancellation of or failure to attend the Consultation;
- any loss, cost or liability recoverable by the Company from the Medical Practitioner under this Agreement; or
- any amount the Company is otherwise entitled or required to deduct under this Agreement or Applicable Laws.
8.8. The Company may review and adjust the Platform Service Fee by giving the Medical Practitioner not less than 30 days' written notice of any proposed adjustment. If the Medical Practitioner does not accept the adjusted Platform Service Fee, the Medical Practitioner may terminate this Agreement by giving written notice to the Company in accordance with clause 14.1.
9. Insurance
9.1. The Medical Practitioner at its own discretion must:
- at the Medical Practitioner's own cost, obtain and maintain throughout the Term Professional Indemnity Insurance with a reputable insurer for an amount of not less than $1 million per claim and in the aggregate per year of insurance, covering the Medical Practitioner's liability arising out of or in connection with the provision of the Services; and
- ensure that the Professional Indemnity Insurance maintained under clause 9.1.a covers claims made during and after the Term in respect of Services provided during the Term.
9.2. The Medical Practitioner's obligation to maintain insurance under this clause 9 does not limit or affect the Medical Practitioner's liability under this Agreement.
10. Protection of Patient Information
10.1. The Medical Practitioner must:
- collect, use, handle, store, disclose and process Patient Information only:
- for the purpose of providing the Services and performing their obligations under this Agreement;
- in accordance with applicable Privacy Laws; and
- in compliance with the Company's Privacy Policy, and record-keeping and information security requirements, as may be notified by the Company to the Medical Practitioner from time to time;
- not collect, use, retain or disclose Patient Information for any purpose other than the provision of the Services or as required by applicable Privacy Laws;
- only access Patient Information through the Platform;
- ensure that accurate and contemporaneous Consultation Notes are stored on the Platform;
- not download, retain, store, copy or transfer Patient Information outside the Platform, except to the extent necessary for the Medical Practitioner to comply with their own obligations under Privacy Laws or professional obligations;
- implement and maintain appropriate technical and administrative measures to protect Patient Information against unauthorised access, use, disclosure, loss, or destruction;
- immediately notify the Company in writing upon becoming aware of any suspected or actual unauthorised access to, use of, or disclosure of Patient Information, data breach or security incident;
- promptly provide all reasonable assistance requested by the Company in connection with any suspected or actual data breach, security incident or privacy complaint in connection with Patient Information; and
- promptly comply with the Company's reasonable directions regarding retention, return, deletion or transfer of Patient Information, subject to the Medical Practitioner's compliance with Privacy Laws and professional obligations.
10.2. The parties acknowledge that in respect of Patient Information:
- the Company acts as a data controller in relation to Patient Information processed for the purposes of operating, administering and improving the Platform, managing Patient accounts, facilitating Consultations and performing the Company's obligations under this Agreement;
- the Medical Practitioner acts as an independent data controller in relation to Patient Information processed for the purposes of providing Consultations, exercising clinical judgment, preparing Consultation Notes and complying with applicable professional, regulatory and legal obligations; and
- each party is independently responsible for complying with its own obligations under applicable Privacy Laws.
10.3. To the extent that the processing or transfer of Patient Information under this Agreement is subject to the transfer restrictions of the GDPR:
- the parties agree to be bound by and incorporate into this Agreement by reference the Standard Contractual Clauses as set out in Schedule 2 to this Agreement (including Annex I–III); and
- these Standard Contractual Clauses prevail to the extent of any inconsistency with the obligations contained in this clause 10.
10.4. The obligations in this clause 10 survive the termination or expiry of this Agreement.
11. Confidentiality
11.1. Each party must:
- keep the other party's Confidential Information strictly confidential;
- not use the other party's Confidential Information for any purpose other than performing its obligations or exercising its rights under this Agreement; and
- not disclose the other party's Confidential Information to any third party without the prior written consent of the disclosing party, except as permitted under clause 7.2.
11.2. A party may disclose the other party's Confidential Information:
- to its employees, contractors, advisers, and agents who have a need to know such information for the purposes of this Agreement and who are bound by obligations of confidentiality no less stringent than those in this clause 7; or
- to the extent required by Applicable Laws or by order of a court or tribunal of competent jurisdiction, provided that the disclosing party gives the other party prompt written notice prior to such disclosure to the extent permitted by law and cooperates with the other party in seeking any available protective order.
11.3. Despite clause 11.2, the Company may, acting reasonably, disclose Confidential Information of the Medical Practitioner to the extent necessary to take any action required under Applicable Laws, including making any necessary notifications to regulatory, licensing or professional bodies.
11.4. The obligations in this clause 11 survive the termination or expiry of this Agreement for a period of 7 years.
12. Intellectual Property
12.1. All Intellectual Property Rights in and to the Platform, including all software, source code, object code, technology, systems, workflows, processes, databases, functionality, designs, layouts, interfaces, branding, trade marks, content, documentation, know-how, business methods, and all improvements, modifications, enhancements and derivative works relating to the Platform, are and remain the sole and exclusive property of the Company or its lawful licensors (as applicable).
12.2. The Company grants to the Medical Practitioner a non-exclusive, worldwide, royalty-free licence to use Patient Uploaded Records for the purpose of providing the Services in accordance with this Agreement.
12.3. Subject to any applicable Privacy Laws, health records legislation, Patient access rights and professional regulatory obligations, all Intellectual Property Rights in the Consultation Notes vest in the Medical Practitioner upon creation.
12.4. The Medical Practitioner grants to the Company a perpetual, irrevocable, worldwide, royalty-free licence (including the right to sub-licence) to use, reproduce, copy and communicate the Consultation Notes for the purpose of operating the Platform, providing continuity of Patient care, managing and responding to complaints and regulatory obligations, and compliance with Applicable Laws.
12.5. The Medical Practitioner must not:
- copy, modify, adapt, reverse engineer, decompile, disassemble, create derivative works from or otherwise exploit any part of the Platform;
- remove, obscure or interfere with any proprietary notices or security features of the Platform;
- sublicence, transfer, or otherwise deal with the licence granted under clause 7.1; or
- use the Platform in a manner that may damage, disrupt or impair its operation.
13. Liability and Indemnity
13.1. Each party (the Indemnifying Party) indemnifies the other party (the Indemnified Party), including its officers, employees, contractors and agents, from and against all claims, losses, liabilities, damages, costs and expenses (including legal costs on a solicitor and own client basis) arising from:
- any material breach of this Agreement by the Indemnifying Party; or
- any negligent, fraudulent, wilful or unlawful act or omission by the Indemnifying Party in connection with this Agreement or the provision of the Services,
except to the extent that the claim, loss, liability, damage, cost or expense was caused or contributed to by the act or omission of the Indemnified Party.
13.2. Without limiting clause 13.1, the Medical Practitioner indemnifies the Company and its officers, employees, contractors, and agents from and against all claims, losses, liabilities, damages, costs and expenses (including legal costs on a solicitor and own client basis) arising out of or in connection with:
- any claim by a Patient in relation to a Consultation provided by the Medical Practitioner;
- any failure by the Medical Practitioner to comply with their taxation, pension, superannuation, social security or similar obligations;
- any suspension, cancellation, or restriction of the Medical Practitioner's Professional Registration;
- any privacy breach or unauthorised use or disclosure of Patient Information caused by the Medical Practitioner; or
- any breach by the Medical Practitioner of Applicable Laws, including the laws, regulations, professional standards, codes, guidelines and ethical requirements of the relevant regulatory or licensing bodies governing the Medical Practitioner in relation to the provision of the Services,
except to the extent that the claim, loss, liability, damage, cost or expense was caused or contributed to by the act or omission of the Company.
13.3. To the maximum extent permitted by Applicable Laws, the Company's liability to the Medical Practitioner under or in connection with this Agreement is limited to the total Contractor Payment paid to the Medical Practitioner in the 1 month immediately preceding the event giving rise to the claim.
13.4. To the maximum extent permitted by Applicable Laws, neither party is liable to the other for any indirect, consequential, special, or punitive loss or damage, including loss of profits, loss of revenue, or loss of opportunity, arising out of or in connection with this Agreement, whether in contract, tort (including negligence), or otherwise.
13.5. Nothing in this Agreement limits or excludes any liability that cannot be limited or excluded under applicable laws, including any liability under the Australian Consumer Law or any equivalent mandatory consumer protection laws applicable in the jurisdiction in which the Medical Practitioner is located.
14. Termination
14.1. Either party may terminate this Agreement for convenience by giving not less than 30 days written notice to the other party.
14.2. Either party may terminate this Agreement immediately by written notice to the other party if:
- the other party commits a material breach of this Agreement and, where the breach is capable of remedy, fails to remedy the breach within 10 Business Days of receiving written notice requiring it to do so; or
- the other party becomes insolvent, is wound up, has a receiver, administrator, or liquidator appointed, or enters into any arrangement with its creditors.
14.3. Without limiting clause 14.2, the Company may terminate this Agreement immediately by written notice to the Medical Practitioner if:
- the Medical Practitioner's Professional Registration is suspended, cancelled, or made subject to any condition, notation, undertaking, or restriction that prevents or limits the Medical Practitioner from lawfully providing the Services;
- the Medical Practitioner fails to maintain Professional Indemnity Insurance in accordance with clause 9 of this Agreement;
- the Medical Practitioner engages in any conduct that, in the Company's reasonable opinion, is likely to bring the Platform or the Company into disrepute; or
- the Medical Practitioner breaches any obligation of confidentiality or privacy under clause 10 or 11 this Agreement.
14.4. Upon termination or expiry of this Agreement:
- the Medical Practitioner must immediately cease providing the Services and cease using the Platform;
- the licence granted under clause 7.1 is immediately revoked;
- each party must promptly return or destroy the other party's Confidential Information in accordance with the other party's written directions, except to the extent that retention is required by Applicable Laws;
- the Medical Practitioner must provide the Company with copies of all Consultation Notes relating to Consultations in the possession or control of the Medical Practitioner, or as otherwise directed by the Company; and
- the Company will pay the Medical Practitioner any Contractor Payment accrued and owing up to the date of termination.
14.5. Termination or expiry of this Agreement does not affect any rights or obligations that have accrued prior to the date of termination or expiry.
14.6. The following clauses survive the termination or expiry of this Agreement: clause 10 (Protection of Patient Information), clause 11 (Confidentiality), clause 12 (Intellectual Property), clause 13 (Liability and Indemnity), clause 14.4 (Consequences of Termination), clause 15 (Non-Solicitation), clause 16 (Dispute Resolution) and clause 17.1 (Governing Law).
15. Non-Solicitation
15.1. For a period of 12 months following the termination or expiry of this Agreement, the Medical Practitioner must not, without the prior written consent of the Company:
- directly or indirectly solicit, canvass, approach, entice away or accept engagement from any Patient who received Services from the Medical Practitioner through the Platform during the 3 months immediately preceding termination or expiry, other than through the Platform; or
- encourage, induce or assist any such Patient to cease using the Platform or to obtain similar services from the Medical Practitioner outside the Platform.
15.2. The Medical Practitioner acknowledges that the restrictions in clause 15.1 are reasonable and necessary to protect the legitimate business interests of the Company, having regard to the nature of the Services and the Medical Practitioner's access to Patient Information and the Company's Confidential Information.
16. Dispute Resolution
16.1. A party must not commence court proceedings in relation to a dispute arising out of or in connection with this Agreement (except for proceedings seeking urgent interlocutory or injunctive relief) unless it has first complied with this clause 16.
16.2. A party claiming that a dispute has arisen must give written notice to the other party setting out the nature of the dispute and the outcome sought.
16.3. Within 7 days after receipt of the notice, senior representatives of each party must meet (whether in person or by video conference) and use reasonable endeavours to resolve the dispute in good faith.
16.4. If the dispute is not resolved within 14 days after the notice is given under clause 16.2, either party may refer the dispute to mediation administered by an independent mediator agreed between the parties, or failing agreement, appointed by the Australian Disputes Centre. The costs of the mediator will be shared equally between the parties, unless otherwise agreed or as determined by the mediator.
16.5. Nothing in this clause 16 prevents a party from seeking urgent interlocutory, declaratory or injunctive relief from a court of competent jurisdiction.
17. General
17.1. Governing Law. This Agreement is governed by the laws of Victoria, Australia. The parties submit to the exclusive jurisdiction of the courts of Victoria, Australia.
17.2. Entire Agreement. This Agreement, together with any schedules, annexures or attachments, constitutes the entire agreement between the parties regarding the subject matter and supersedes all prior agreements, representations, and understandings.
17.3. Amendments. Amendments to this Agreement must be made in writing and signed by authorised representatives of both parties.
17.4. Severability. If any provision of this Agreement is invalid, illegal, or unenforceable, that provision is severed and the remaining provisions continue in full force.
17.5. Waiver. Failure to enforce any provision does not constitute a waiver of the right to enforce it in the future.
17.6. Assignment. The Medical Practitioner may not assign any right or obligation under this Agreement without the Company's prior written consent. The Company may assign this Agreement to a successor entity in connection with a merger, acquisition, or sale of assets.
17.7. Notices. Notices under this Agreement must be in writing and delivered by email or registered post to the addresses set out in the Details section or as notified in writing from time to time.
17.8. Counterparts. This Agreement may be executed in counterparts, each of which constitutes an original, and all of which together constitute one instrument. Electronic signatures are accepted.
17.9. Force Majeure. Neither party is liable for failure or delay in performance caused by events beyond its reasonable control, including acts of god, pandemics, governmental actions, or telecommunications failures, provided the affected party gives prompt written notice and uses reasonable efforts to mitigate the impact.
18. Definitions
18.1. In this Agreement, unless the context otherwise requires:
- Applicable Laws means all laws, statutes, regulations, rules, subordinate legislation, regulatory requirements, mandatory codes, professional standards, guidelines, directions, orders and legally binding requirements of any government authority, regulatory body, licensing authority, court or tribunal that apply to a party, the Platform, the Services, a Consultation, the collection, use, storage or disclosure of Patient Information, or the performance of obligations under this Agreement.
- Business Day means a day that is not a Saturday, Sunday, or public holiday in Victoria, Australia.
- Commencement Date means the date specified in the Details section of this Agreement.
- Confidential Information means all information, whether oral, written, electronic, or in any other form, that is disclosed by or on behalf of one party to the other party in connection with this Agreement, including but not limited to the terms of this Agreement, the Platform's technology, systems, business processes, pricing, and any information designated as confidential by the disclosing party, but excludes Patient Information and information that:
- is or becomes publicly available other than through a breach of this Agreement;
- was already known to the receiving party at the time of disclosure, as evidenced by written records predating the disclosure;
- is independently developed by the receiving party without reference to the Confidential Information; or
- is required to be disclosed by Applicable Laws or by order of a court or tribunal of competent jurisdiction, provided that the receiving party gives the disclosing party prompt written notice prior to such disclosure to the extent permitted by law.
- Consultation means a medical consultation provided by the Medical Practitioner to a Patient via the Platform for the purpose of reviewing the Patient's existing medical condition, diagnosis, treatment options, or management plan and providing a second medical opinion, whether by video, telephone, or such other means as the Platform supports from time to time.
- Consultation Fees means the fees set by the Medical Practitioner and charged to a Patient through the Platform for the Consultation.
- Consultation Notes means all clinical notes, observations, assessments, recommendations, second medical opinions, reports, referrals, follow-up recommendations, and other records created by the Medical Practitioner in connection with providing the Services through the Platform, but does not include Patient Uploaded Records.
- Contractor Payment means the amount payable to the Medical Practitioner for the provision of the Services, as specified in the Details section.
- GDPR means the General Data Protection Regulation (EU) 2016/679.
- Intellectual Property Rights means all present and future rights in and to any copyright, trade marks, patents, designs, confidential information, trade secrets, know-how, and all other intellectual property rights, whether registered or unregistered, and including all applications and rights to apply for registration of any such rights.
- Patient means an individual who books an appointment through the Platform to receive a Consultation.
- Patient Information means any information or opinion, whether true or not, and whether recorded in material form or not, related to a Patient that is collected, received, accessed, used, disclosed, stored or otherwise processed in connection with this Agreement, and includes:
- personal information, health information, sensitive information, personal data and special category data, as defined by Privacy Laws;
- Patient Uploaded Records;
- Consultation Notes; and
- any metadata, correspondence, recordings or system-generated information relating to the provision of the Services.
- Patient Uploaded Records means any medical records, reports, referrals, pathology results, imaging, scans, test results, specialist letters, treatment plans, prescriptions, identity documents, questionnaires, forms, or other information or documentation uploaded to the Platform by or on behalf of a Patient before, during or after a Consultation, and includes all Intellectual Property Rights contained therein.
- Privacy Laws means the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and where applicable, the General Data Protection Regulation (EU) 2016/679 (GDPR).
- Professional Registration means all licenses, registrations, permits, approvals, authorisations, certifications and professional standing requirements required for the Medical Practitioner to lawfully:
- practise medicine in the jurisdiction in which the Medical Practitioner is located;
- provide telehealth, remote consultation or other healthcare services in connection with the Services; and
- provide Services to Patients located in each relevant jurisdiction in which those Patients are located,
- Platform means the digital technology platform operated by the Company under the name Holyland Medical, and includes the website at https://holylandmedical.com, any mobile applications, practitioner and patient portals, dashboards, communication tools, scheduling systems, payment processing integrations, document upload and storage functionality, consultation management systems, and all associated software, systems, databases, infrastructure and technology used by the Company to facilitate Consultations with Patients, as updated or replaced by the Company from time to time.
- Platform Operational Guidelines means the policies, procedures, protocols, and guidelines issued by the Company in connection with the Platform and the provision of Services, contained at Schedule 1 of this Agreement and as may be updated by the Company from time to time and notified to the Medical Practitioner.
- Platform Service Fee means the percentage of the Consultation Fees retained by the Company, as specified in the Details section.
- Platform Terms of Use means the terms governing a Patient's use of the Platform located at https://holylandmedical.com.
- Services are as described in the Details section.
- Standard Contractual Clauses are as set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
- Term means the period specified in the Details section of this Agreement.
Schedule 1 — Platform Operational Guidelines
Platform Operational Guidelines will be published separately and notified to the Medical Practitioner.
Schedule 2 – GDPR Standard Contractual Clauses
SECTION I
Clause 1 – Purpose and scope
- The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.
- The Parties:
- the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
- the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’) have agreed to these standard contractual clauses (hereinafter ‘Clauses’).
- These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
- The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2 – Effect and invariability of the Clauses
- These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
- These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3 – Third-party beneficiaries
- Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
- Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
- Clause 8.5 (e) and Clause 8.9(b);
- NOT USED;
- Clause 12(a) and (d);
- Clause 13;
- Clause 15.1(c), (d) and (e);
- Clause 16(e);
- Clause 18(a) and (b).
- Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4 – Interpretation
- Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
- These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
- These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5 – Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6 – Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7 – Docking clause
NOT USED
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8 – Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
8.1 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I. B. It may only process the personal data for another purpose:
- where it has obtained the data subject’s prior consent;
- where necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
- where necessary in order to protect the vital interests of the data subject or of another natural person.
8.2 Transparency
- In order to enable data subjects to effectively exercise their rights pursuant to Clause 10, the data importer shall inform them, either directly or through the data exporter:
- of its identity and contact details;
- of the categories of personal data processed;
- of the right to obtain a copy of these Clauses;
- where it intends to onward transfer the personal data to any third party/ies, of the recipient or categories of recipients (as appropriate with a view to providing meaningful information), the purpose of such onward transfer and the ground therefore pursuant to Clause 8.7.
- Paragraph (a) shall not apply where the data subject already has the information, including when such information has already been provided by the data exporter, or providing the information proves impossible or would involve a disproportionate effort for the data importer. In the latter case, the data importer shall, to the extent possible, make the information publicly available.
- On request, the Parties shall make a copy of these Clauses, including the Appendix as completed by them, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the Parties may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
- Paragraphs (a) to (c) are without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.3 Accuracy and data minimisation
- Each Party shall ensure that the personal data is accurate and, where necessary, kept up to date. The data importer shall take every reasonable step to ensure that personal data that is inaccurate, having regard to the purpose(s) of processing, is erased or rectified without delay.
- If one of the Parties becomes aware that the personal data it has transferred or received is inaccurate, or has become outdated, it shall inform the other Party without undue delay.
- The data importer shall ensure that the personal data is adequate, relevant and limited to what is necessary in relation to the purpose(s) of processing.
8.4 Storage limitation
The data importer shall retain the personal data for no longer than necessary for the purpose(s) for which it is processed. It shall put in place appropriate technical or organisational measures to ensure compliance with this obligation, including erasure or anonymisation of the data and all back-ups at the end of the retention period.
8.5 Security of processing
- The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.
- The Parties have agreed on the technical and organisational measures set out in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
- The data importer shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the personal data breach, including measures to mitigate its possible adverse effects.
- In case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the data importer shall without undue delay notify both the data exporter and the competent supervisory authority pursuant to Clause 13. Such notification shall contain i) a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), ii) its likely consequences, iii) the measures taken or proposed to address the breach, and iv) the details of a contact point from whom more information can be obtained. To the extent it is not possible for the data importer to provide all the information at the same time, it may do so in phases without undue further delay.
- In case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the data importer shall also notify without undue delay the data subjects concerned of the personal data breach and its nature, if necessary in cooperation with the data exporter, together with the information referred to in paragraph (e), points ii) to iv), unless the data importer has implemented measures to significantly reduce the risk to the rights or freedoms of natural persons, or notification would involve disproportionate efforts. In the latter case, the data importer shall instead issue a public communication or take a similar measure to inform the public of the personal data breach.
- The data importer shall document all relevant facts relating to the personal data breach, including its effects and any remedial action taken, and keep a record thereof.
8.6 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences (hereinafter ‘sensitive data’), the data importer shall apply specific restrictions and/or additional safeguards adapted to the specific nature of the data and the risks involved. This may include restricting the personnel permitted to access the personal data, additional security measures (such as pseudonymisation) and/or additional restrictions with respect to further disclosure.
8.7 Onward transfers
The data importer shall not disclose the personal data to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) unless the third party is or agrees to be bound by these Clauses, under the appropriate Module. Otherwise, an onward transfer by the data importer may only take place if:
- it is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
- the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679 with respect to the processing in question;
- the third party enters into a binding instrument with the data importer ensuring the same level of data protection as under these Clauses, and the data importer provides a copy of these safeguards to the data exporter;
- it is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings;
- it is necessary in order to protect the vital interests of the data subject or of another natural person; or
- where none of the other conditions apply, the data importer has obtained the explicit consent of the data subject for an onward transfer in a specific situation, after having informed him/her of its purpose(s), the identity of the recipient and the possible risks of such transfer to him/her due to the lack of appropriate data protection safeguards. In this case, the data importer shall inform the data exporter and, at the request of the latter, shall transmit to it a copy of the information provided to the data subject.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.8 Processing under the authority of the data importer
The data importer shall ensure that any person acting under its authority, including a processor, processes the data only on its instructions.
8.9 Documentation and compliance
- Each Party shall be able to demonstrate compliance with its obligations under these Clauses. In particular, the data importer shall keep appropriate documentation of the processing activities carried out under its responsibility.
- The data importer shall make such documentation available to the competent supervisory authority on request.
Clause 9 – Use of sub-processors
NOT USED
Clause 10 – Data subject rights
- The data importer, where relevant with the assistance of the data exporter, shall deal with any enquiries and requests it receives from a data subject relating to the processing of his/her personal data and the exercise of his/her rights under these Clauses without undue delay and at the latest within one month of the receipt of the enquiry or request. The data importer shall take appropriate measures to facilitate such enquiries, requests and the exercise of data subject rights. Any information provided to the data subject shall be in an intelligible and easily accessible form, using clear and plain language.
- In particular, upon request by the data subject the data importer shall, free of charge:
- provide confirmation to the data subject as to whether personal data concerning him/her is being processed and, where this is the case, a copy of the data relating to him/her and the information in Annex I; if personal data has been or will be onward transferred, provide information on recipients or categories of recipients (as appropriate with a view to providing meaningful information) to which the personal data has been or will be onward transferred, the purpose of such onward transfers and their ground pursuant to Clause 8.7; and provide information on the right to lodge a complaint with a supervisory authority in accordance with Clause 12(c)(i);
- rectify inaccurate or incomplete data concerning the data subject;
- erase personal data concerning the data subject if such data is being or has been processed in violation of any of these Clauses ensuring third-party beneficiary rights, or if the data subject withdraws the consent on which the processing is based.
- Where the data importer processes the personal data for direct marketing purposes, it shall cease processing for such purposes if the data subject objects to it.
- The data importer shall not make a decision based solely on the automated processing of the personal data transferred (hereinafter ‘automated decision’), which would produce legal effects concerning the data subject or similarly significantly affect him/her, unless with the explicit consent of the data subject or if authorised to do so under the laws of the country of destination, provided that such laws lays down suitable measures to safeguard the data subject’s rights and legitimate interests. In this case, the data importer shall, where necessary in cooperation with the data exporter:
- inform the data subject about the envisaged automated decision, the envisaged consequences and the logic involved; and
- implement suitable safeguards, at least by enabling the data subject to contest the decision, express his/her point of view and obtain review by a human being.
- Where requests from a data subject are excessive, in particular because of their repetitive character, the data importer may either charge a reasonable fee taking into account the administrative costs of granting the request or refuse to act on the request.
- The data importer may refuse a data subject’s request if such refusal is allowed under the laws of the country of destination and is necessary and proportionate in a democratic society to protect one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679.
- If the data importer intends to refuse a data subject’s request, it shall inform the data subject of the reasons for the refusal and the possibility of lodging a complaint with the competent supervisory authority and/or seeking judicial redress.
Clause 11 – Redress
- The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
- In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
- Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
- lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
- refer the dispute to the competent courts within the meaning of Clause 18.
- The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
- The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
- The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12 Liability
- Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
- Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.
- Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
- The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
- The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.
Clause 13 Supervision
- The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority. Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679: The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competent supervisory authority.
- The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14 Local laws and practices affecting compliance with the Clauses
- The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
- The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
- the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
- the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards;
- any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
- The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
- The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
- The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
- Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15 – Obligations of the data importer in case of access by public authorities
15.1 Notification
- The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
- receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
- becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
- If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
- Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).
- The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
- Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
- The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
- The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
- The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16 – Non-compliance with the Clauses and termination
- The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
- In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
- The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
- the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
- the data importer is in substantial or persistent breach of these Clauses; or
- the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non- compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
- Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
- Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17 – Governing law
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third- party beneficiary rights. The Parties agree that this shall be the law of Member State nominated by the representative of the Member State.
Clause 18 – Choice of forum and jurisdiction
- Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
- The Parties agree that those shall be the courts of Member State nominated by the representative of the Member State.
- A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
- The Parties agree to submit themselves to the jurisdiction of such courts.
ANNEX I
| A. LIST OF PARTIES | |
| Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union] | |
| Name | [insert] |
| Address | [insert] |
| Contact person’s name, position and contact details | [insert] |
| Activities relevant to the data transferred under these Clauses | [insert] |
| Signature and date | [insert] |
| Role (controller/processor) | [insert] |
| Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection] | |
| Name | [insert] |
| Address | [insert] |
| Contact person’s name, position and contact details | [insert] |
| Activities relevant to the data transferred under these Clauses | [insert] |
| Signature and date | [insert] |
| Role (controller/processor) | [insert] |
| B. DESCRIPTION OF TRANSFER | |
| Categories of data subjects whose personal data is transferred | [insert] |
| Categories of personal data transferred | [insert] |
| Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. | [insert] |
| The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis) | [insert] |
| Nature of the processing | [insert] |
| Purpose(s) of the data transfer and further processing | [insert] |
| The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period | [insert] |
| For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing | [insert] |
| C. COMPETENT SUPERVISORY AUTHORITY | |
| Identify the competent supervisory authority/ies in accordance with Clause 13 | [insert] |
ANNEX II – TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
TO BE PROVIDED
ANNEX III – LIST OF SUB-PROCESSORS
NOT USED
Last updated: 09.09.2026