DATA SHARING CHARTER

ARTICLE 1: DEFINITIONS

For the purposes of this Data Sharing Charter, the following definitions shall apply:

1.1 “Confidential information” means any information disclosed in writing or in any material form to the other Party under this Data Sharing Charter which is or may be considered confidential by reason of the nature of the data or the nature of the circumstances on the basis of which it is intended to be disclosed such as, but not limited to, product information, customer lists, price lists and financial information;

1.2 “Controller” shall mean the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data carried out under his authority;

1.3 “Data Sharing Charter” means this Salvus Health Data Sharing Charter for the sharing and processing of personal data between Salvus Health and the Pharmacy in accordance with the provisions of the GDPR;

1.4 “Data Subjects” means an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

1.5 “Employee”: a person who is hired by an Employer and who has entered into or is employed under a contract of employment for the provision of employment services for remuneration or fixed compensation. An employee does not provide professional services as part of a self-employed activity. Agents, distributors, consultants, freelancers, (independent) (sub)contractors or other third parties are not regarded as Employees for the purposes of this Data Sharing Charter;

1.6 “Joint Controllers”: where two or more controllers jointly determine the purposes and means of the processing;

1.7 “Personal Data” means any information relating to a Data Subject;

1.8 “Personal Data Infringement”: breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Personal Data transmitted, stored or otherwise processed;

1.9 “Sub-processor” means any processor engaged by either Party as a subcontractor and who agrees to process Personal Data for and on behalf of either Party in accordance with this Data Sharing Charter;

1.10 “Security Measures”: those measures designed to protect Personal Data against accidental or unlawful destruction or loss, as well as unauthorised access, alteration or transmission;

1.11 “Third Party”: any party that is not a Data Subject, Salvus Health or the Pharmacy under this Data Sharing Charter, nor any person authorized to process Personal Data under the direct authority of Salvus Health or the Pharmacy;

1.12 “Services”: the services performed by Salvus Health in accordance with the Service Agreement;

1.13 “Supervisory authority” means an independent public body established by a Member State under Article 51 of the Regulation;

1.14 “Pharmacy” means the Client under the Service Agreement, acting as Controller of the Personal Data processed through the Services;

1.15 “Regulation” or “GDPR” means Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;

1.16 “Service Agreement” means the agreement between Salvus Health and the Pharmacy consisting of the Commercial Order and its annexes, including the Terms of License, of which this Data Sharing Charter forms an integral part. This Data Sharing Charter constitutes the data processing agreement within the meaning of Article 28(3) of the Regulation.

The meaning of all other terms used but not defined shall be the same as they have in the Service Agreement.

ARTICLE 2: SUBJECT MATTER OF THE DATA SHARING CHARTER

2.1 Parties wish to share and exchange certain Personal Data as described below, within the framework of the performance of the Services by Salvus Health.

2.2 Salvus Health performs the Services in accordance with the provisions of this Data Sharing Charter. Parties shall process and share the Personal Data in accordance with the provisions of this Data Sharing Charter.

2.3 Both Parties explicitly undertake to comply with the provisions of the relevant applicable data protection legislation, including but not limited to the Regulation, and not do or refrain from doing anything that may cause the other Party to violate the relevant and applicable privacy and data protection legislation.

2.4 Roles of the Parties. Salvus Health acts as processor on behalf of the Pharmacy for all processing of Personal Data in the course of the provision of the Services. Salvus Health shall process such Personal Data only on the documented instructions of the Pharmacy, unless required to do so by Union or Member State law, in which case Salvus Health shall inform the Pharmacy of that legal requirement before processing, unless that law prohibits such information. The Service Agreement and this Data Sharing Charter constitute the Pharmacy’s documented instructions. Salvus Health shall immediately inform the Pharmacy if, in its opinion, an instruction infringes the Regulation or other applicable data protection provisions.

Salvus Health acts as controller exclusively for (i) the creation and management of a personal account by a Data Subject with Salvus Health, and (ii) compliance with legal obligations to which Salvus Health is subject.

2.5 Categories of Personal Data. The Personal Data that are processed and exchanged are:

Identification data: personal identification data including inter alia: surname, first name, gender, and e-mail address, ...
Data on the (physical and even – where appropriate – mental) condition of the person: state of sensation (such as illness, fatigue, anger, stress), alcohol intake, smoked or non-smoked, ...
Medical records: data evidenced by measurements (such as blood pressure, heart rate, heart rhythm, blood oxygen saturation level, height, weight, BMI, pregnancy, blood group, belly circumference, …)
All relevant data concerning its own corporate structure as well as accurate and up-to-date identification data on all Customer entities involved in the processing of Personal Data, including the location of their principal place of business;
The aspects of the processing for which the Services of a Sub-processor are used or intended to be used, as well as the identification data of a Sub-processor including the location of its principal place of business. Pharmacy shall disclose to Salvus Health the agreement entered into with the Sub-processor(s) that relates to or is relevant to the processing of Personal Data, unless such agreement with the Sub-processor(s) contains Confidential Information, in which case it may remove such Confidential Information;
Geographical data about the locations of the processing, including back-up facilities and options for destroying the data;
The physical, organizational, technical, and logical Security measures that Pharmacy and its Sub-processor(s) have put in place, as set forth in Article 7 of this Data Sharing Charter.
One Party shall promptly inform the other Party of any request by a Data Subject relating to Personal Data exchanged between the Parties;
The Pharmacy will promptly comply with, and will require its Sub-processor(s) to comply with, any request made by Salvus Health so that Salvus Health can comply with any request made by the Data Subject wishing to exercise any of its rights;
The Pharmacy will ensure that both it and its Sub-processor(s) have the required technical and organizational skills to block access to Personal Data and physically destroy the data without any possibility of retrieval if and when Salvus Health makes such a request;
one Party shall, upon simple request of the other Party, provide all necessary support and information required by the other Party in order to defend its interests in any legal proceedings - judicial proceedings, arbitration or otherwise - brought against the other Party or its Employee for violation of the fundamental rights to privacy and protection of the Personal Data of Data Subjects.
To submit the dispute to an independent person for mediation;
To submit the dispute to the courts in Belgium.

2.6 Persons concerned. The Persons concerned are the visitors to and clients of the Pharmacy who choose to make use of the Services.

2.7 Purposes. Both Parties guarantee that they will only use the Personal Data for the proper performance of the Services, as part of the Service Agreement in accordance with the provisions of this Data Sharing Charter and the internal functioning of the Parties.

2.8 The Parties may and will only process the Personal Data resulting from a transfer or exchange that are mentioned in Article 2.5. In addition, Personal Data shall only be processed in the light of the purposes specified by the Parties in this Clause.

2.9 Both Parties undertake to take appropriate measures to ensure that the Personal Data are not used improperly or obtained by an unauthorized Third Party.

ARTICLE 3: DURATION OF PROCESSING

3.1 If the Service Agreement ends in accordance with Clause 10 (Term, Termination and Suspension), of the Terms of License, this Data Sharing Charter shall also end.

3.2 In the event of a breach of this Data Sharing Charter or the applicable provisions of the Regulation, either Party may instruct the other Party to stop processing the Personal Data immediately.

3.3 If this Data Sharing Charter is terminated or if the Personal Data are no longer relevant for the performance of the Services, Salvus Health shall, at the choice of the Pharmacy, delete or return all Personal Data processed as processor on behalf of the Pharmacy, delete all existing copies and confirm in writing that it has done so, unless storage of the Personal Data is required by Union or Member State law. This Article does not apply to Personal Data processed by Salvus Health as controller in accordance with Article 2.4.

ARTICLE 4: SUPPORT

4.1 Compliance with legislation. One Party shall assist the other Party in fulfilling its obligations under the Regulation, taking into account the nature of the processing and the information available to it. In particular, for the processing activities for which it acts as processor, Salvus Health shall assist the Pharmacy in ensuring compliance with Articles 32 to 36 of the Regulation, including by providing the information reasonably required for any data protection impact assessment (DPIA) and any prior consultation of the Supervisory authority. The reasonable costs of such assistance, including time spent by Salvus Health’s personnel, shall be borne by the Pharmacy.

4.2 Infringement relating to Personal Data. In the event of a Personal Data Infringement that relates to the subject matter of the processing of this Data Sharing Charter, the Parties undertake to notify and inform each other immediately and without any delay about the Personal Data Infringement as soon as the Party facing the Personal Data Infringement becomes aware of this Personal Data Infringement.

4.3 This notification shall contain at least the following information:

a) The nature of the Infringement relating to Personal Data;

b) The categories of Personal Data concerned by the Infringement;

c) The categories of Persons concerned and, approximately, the number of Persons concerned;

d) The categories of data concerned and, approximately, the number of data;

e) The likely consequences of the Infringement in relation to Personal Data;

f) Measures proposed or taken to deal with the Personal Data Infringement, including, where appropriate, measures to mitigate any adverse consequences thereof.

4.4 If the affected Party facing a Personal Data Infringement uses a Sub-processor, that Party will require the Sub-processor to provide it with the same information as if a Personal Data Infringement occurs at the Sub-processor. Such Party shall promptly communicate the information it receives from the Sub-processor to the other Party.

4.5 The relevant Party and its Sub-processor(s) shall designate a single point of contact among their Employees who shall be responsible for all communications between the Parties and the Sub-processor in the event of an incident that results or may result in the accidental or unauthorized destruction or loss or unauthorized access, alteration or transmission of Personal Data processed under this Data Sharing Charter, regardless of whether such accidental or unauthorized destruction or loss results or may result in an Infringement of Personal Data.

4.6 The Parties, and if applicable the Sub-processor(s), ensure that they cooperate in good faith to limit the possible adverse consequences of an Infringement in connection with Personal Data.

ARTICLE 5: INFORMATION OBLIGATIONS

5.1 Salvus Health shall provide the Pharmacy immediately upon simple request, all information required by Salvus Health and at least the information determined by the provisions of this clause:

All relevant data concerning its own corporate structure as well as accurate and up-to-date identification data on all Salvus Health entities involved in the processing of Personal Data, including the location of their principal place of business;
The aspects of the processing for which the Services of a Sub-processor are used or intended to be used, as well as the identification data of a Sub-processor including the location of its principal place of business. Salvus Health shall disclose to the Pharmacy the agreement entered into with the Sub-processor(s) that relates to or is relevant to the processing of Personal Data, unless such agreement with the Sub-processor(s) contains Confidential Information, in which case it may remove such Confidential Information;
Geographical data about the locations of the processing, including back-up facilities and options for destroying the data;
The physical, organizational, technical, and logical Security measures that Salvus Health and its Sub-processor(s) have put in place, as set forth in Article 7 of this Data Sharing Charter.

ARTICLE 6: RIGHTS OF DATA SUBJECTS

6.1 Taking into account the nature of the processing, both Parties guarantee to take appropriate technical and organizational measures in fulfilling their obligations under this Data Sharing Charter.

6.2 The following terms and conditions will apply to any request by Data Subjects concerning their rights regarding the processing by one of the Parties or its Sub-processors of Personal Data relating to them:

Salvus Health shall promptly inform to the Pharmacy any request by a Data Subject relating to Personal Data processed on behalf of the Pharmacy, and shall not respond to such request itself unless instructed by the Pharmacy;
Salvus Health will promptly comply with, and will require its Sub-processor(s) to comply with, any request made by the Pharmacy so that the Pharmacy can comply with any request made by the Data Subject wishing to exercise any of its rights under Articles 15 to 22 of the Regulation;
Salvus Health will ensure that both it and its Sub-processor(s) have the required technical and organizational skills to block access to Personal Data and physically destroy the data without any possibility of retrieval if and when the Pharmacy makes such a request;
one Party shall, upon simple request of the other Party, provide all necessary support and information required by the other Party in order to defend its interests in any legal proceedings - judicial proceedings, arbitration or otherwise - brought against the other Party or its Employee for violation of the fundamental rights to privacy and protection of the Personal Data of Data Subjects.

ARTICLE 7: SECURITY MEASURES

7.1 During the term of this Data Sharing Charter, the Parties will implement and maintain appropriate technical and organisational measures in such a way that the processing complies with the requirements of the Regulation and that the protection of the rights of the Data Subject is ensured.

7.2 The Parties will, inter alia, take technical and organisational measures against unauthorised or unlawful processing and regularly assess the suitability of the Security Measures and adjust them if necessary.

7.3 In particular, the Parties will take appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the Regulation.

7.4 The assessment of an appropriate level of security shall in particular take into account the risks presented by the processing, in particular, by the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or unauthorised access to, the transmitted, stored or otherwise processed Personal Data.

7.5 Each Party may reserve the right to suspend and/or terminate the Service Agreement for an indefinite period of time if the other Party can no longer provide for technical and organisational measures appropriate to the processing risk.

ARTICLE 8: INTERNATIONAL TRANSFER

8.1 The Parties agree that Personal Data may only be transferred to and/or stored with the recipient outside the European Economic Area (EEA) in a country covered by an adequacy decision taken on an exceptional basis by the European Commission, and only to the extent necessary to comply with the obligations of this Data Sharing Charter in order to fulfil to this Data Sharing Charter substantial services. In the absence of an adequacy decision as referred to above, such transfer shall be governed by the terms of an agreement on the transfer of Personal Data containing standard contractual clauses as published in the European Commission Decision of 4 June 2021 (Decision 2021/914/EC on standard contractual clauses for the transfer of personal data to third countries) or by other mechanisms provided for by applicable data protection law.

8.2 The Parties shall inform each other prior to the international transfer of the Security measures and appropriate safeguards taken to ensure the protection of the Personal Data of the Data Subject in accordance with the Regulation.

ARTICLE 9: BEHAVIOUR IN RELATION TO NATIONAL PUBLIC BODIES AND JUDICIAL AUTHORITIES

9.1 The Parties shall immediately inform each other of any request, order, investigation, or subpoena made to a Party or its Sub-processor by any competent national governmental or judicial authority which entails the communication of Personal Data processed by the Party or a Sub-processor or any data and/or information relating to such processing by the Party concerned.

9.2 Without prejudice to Article 9.1 of this Data Sharing Charter, both Parties shall ensure that there are no obligations under applicable law that would make it impossible for either Party to comply with its obligations under this Data Sharing Charter.

ARTICLE 10: CONFIDENTIALITY

10.1 Each Party undertakes to treat the Personal Data and its processing with the utmost confidentiality. The Parties shall assure each other of the confidentiality by measures no less restrictive than those they use to protect their own confidential material, including Personal Data.

10.2 Each Party warrants that the Employees or Sub-processors authorized to process the Personal Data have undertaken to maintain confidentiality or are bound by an appropriate legal obligation of confidentiality.

ARTICLE 11: LIABILITY

11.1 Without prejudice to the Service Agreement, a Party will only be liable for the damage caused by processing if it has not complied with the obligations of the Regulation or has acted contrary to this Data Sharing Charter.

11.2 A Party shall be liable in contract or wrongful act (including default) or in any way related to this Data Sharing Charter, including liability for gross negligence, for proven defects attributable to it. The Parties’ liability for any breach of this Data Sharing Charter shall be limited to foreseeable, direct, immediate and personal damages, to the exclusion of consequential damages (even if advised of the possibility of such consequential damages or if the possibility of such consequential damages was reasonably foreseeable), meaning “consequential damages”: damage or loss not arising directly and immediately from a contractual and/or extra-contractual breach of contract, but instead indirectly and/or over time, including, but not limited to, loss of income, interruption or stagnation of business operations, increase in personnel costs and/or redundancy costs, damage consisting of or resulting from claims by third parties, lack of expected savings or benefits and loss of data, profit, time or revenue, loss of orders, loss of customers, increase in overhead costs, consequences of a strike, regardless of its causes.

11.3 If it appears that both Parties are responsible for the damage caused by the processing of Personal Data, both Parties shall be liable and shall both pay compensation in proportion to their individual share of the responsibility for the damage caused by the processing.

11.4 In any case, Salvus Health’s total liability under this Data Sharing Charter shall be limited to the fees paid by Pharmacy to Salvus Health in accordance with the Service Agreement in the twelve months immediately preceding the earliest event that led to the liability and this per cause of damage.

ARTICLE 12: MEDIATION AND JURISDICTION

12.1 This Data Sharing Charter shall be interpreted in accordance with the Regulation and any applicable Belgian implementing legislation.

12.2 Each Party agrees that if the Data Subject brings a claim for damages against him under this Data Sharing Charter, the Pharmacy will accept the Data Subject’s decision:

12.3 The Parties agree that the choice of the Data Subject is without prejudice to his/her material or procedural rights of redress in accordance with other provisions of applicable national or international law.

12.4 Any dispute between the Parties concerning the terms and conditions of this Data Sharing Charter shall be brought before the competent courts as provided for in the Service Agreement.

ARTICLE 13: TERMINATION OF THE CHARTER

13.1 This Data Sharing Charter shall apply for as long as the Parties process or exchange Personal Data under the Service Agreement. If the Service Agreement is terminated, this Data Sharing Charter shall end as well, without prejudice to Article 3.3.

13.2 In the event of a breach of this Data Sharing Charter or the Regulation, either Party may order that the processing or sharing of the Personal Data be stopped immediately.

13.3 Each Party will not store the Personal Data longer than necessary to perform the Services for which the Personal Data is provided.

ARTICLE 14: AUDITS

14.1 With respect to the processing activities for which it acts as processor, Salvus Health shall make available to the Pharmacy, upon written request, the information necessary to demonstrate compliance with Article 28 of the Regulation, in the form of documentation such as policies, procedures, certifications or written responses to reasonable questionnaires. The Pharmacy shall not exercise this right more than once per calendar year, unless it has reasonable grounds to suspect non-compliance with this Data Sharing Charter.

14.2 The Pharmacy may only conduct an audit, including an inspection, where (i) the information provided under Article 14.1 does not reasonably demonstrate compliance, (ii) a supervisory authority requires it, or (iii) following a Personal Data Infringement affecting the Pharmacy’s Personal Data.

14.3 Any audit shall: (a) be requested in writing at least thirty (30) days in advance, specifying its scope; (b) be conducted remotely where possible, and otherwise during normal business hours for a maximum of one (1) business day; (c) not take place more than once per calendar year, except where required by a supervisory authority; (d) be conducted by the Pharmacy or by an independent auditor approved by Salvus Health, such approval not to be unreasonably withheld, bound by confidentiality and not a competitor of Salvus Health; and (e) be limited to the processing of the Pharmacy’s Personal Data, excluding any data of other clients and Salvus Health’s Confidential Information.

14.4 The Pharmacy shall bear all costs of the audit, including Salvus Health’s reasonable internal costs at its then-current rates, unless the audit reveals a material breach of this Data Sharing Charter by Salvus Health.

ARTICLE 15: SUB-PROCESSORS OF SALVUS HEALTH

15.1 The Pharmacy grants Salvus Health a general written authorisation to engage Sub-processors for the processing activities for which Salvus Health acts as processor. Salvus Health shall provide the list of Sub-processors in use to the Pharmacy upon request.

15.2 Salvus Health shall inform the Pharmacy by e-mail at least fourteen (14) days in advance of any intended addition or replacement of a Sub-processor. The Pharmacy may object in writing within ten (10) days of such notification, solely on reasonable grounds relating to data protection. Absent an objection within that period, the change shall be deemed accepted.

15.3 In the event of a timely and reasonable objection, the Parties shall discuss it in good faith. If no solution is found within thirty (30) days, the Pharmacy’s sole remedy shall be to terminate the Service Agreement by written notice.

15.4 Salvus Health shall impose on each Sub-processor, by contract, data protection obligations no less protective than those set out in this Data Sharing Charter, and shall remain liable towards the Pharmacy for the performance of the Sub-processor’s obligations.