Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller: Medpaw Inc., a Delaware corporation ("Medpaw")
• Data Processor: The veterinary clinic registering on the Medpaw platform ("Clinic")

2. Purpose and Scope

This DPA governs the processing of personal data that the Clinic enters into the Medpaw platform on behalf of its clients (pet owners). The Clinic acts as a Data Processor for purposes of this personal data; Medpaw acts as the Data Controller.

3. Obligations of the Clinic (Data Processor)

• Process personal data only in accordance with Medpaw's instructions and applicable data protection law.
• Implement appropriate technical and organisational measures to protect the personal data accessed through Medpaw, including secure password management, restricted staff access, and device security.
• Not engage sub-processors (third parties who process Medpaw data on the Clinic's behalf) without Medpaw's prior written consent.
• Notify Medpaw within 24 hours of becoming aware of any data breach involving personal data accessed through the Medpaw platform.
• Assist Medpaw in responding to data subject rights requests (access, rectification, erasure, portability) received from pet owners.
• Delete or return all personal data to Medpaw upon termination of the clinic's Medpaw account, unless retention is required by applicable law.

4. Data Types Processed

The Clinic processes the following categories of personal data through Medpaw:

• Pet owner identity data: name, email, phone number, preferred language
• Animal health data: species, breed, date of birth, weight, vaccination records, medical history, appointment records
• Financial data: payment records, invoice history
• Communication records: appointment reminders and notifications sent via WhatsApp and email

5. Anonymised Data

Medpaw may use anonymised, aggregated, de-identified data derived from the Clinic's records for analytics, research, and third-party data partnerships, as described in the Privacy Policy. This anonymised data does not identify individual animals, owners, or the Clinic.

6. Governing Law

This DPA is governed by the laws of the State of Delaware, United States, and applicable data protection laws in the jurisdictions where the Clinic operates (Thailand PDPA, Singapore PDPA, Vietnam PDPD, Indonesia PDPA).

7. Contact

Data protection enquiries: privacy@medpaw.co