Data Transmission
PLATFORM USE AND DATA TRANSMISSION ADHESION CONTRACT
(Data Processor Agreement and Terms of Service)
This Personal Data Transmission Agreement (hereinafter, the "Agreement") is entered into between NEBULA MEDICAL S.A.S., identified with NIT 901962749-3 (hereinafter, the "PROCESSOR" or "Nebula") and THE HEALTHCARE PROFESSIONAL OR MEDICAL INSTITUTION that accepts these terms at the time of registration and use of the platform (hereinafter, the "CONTROLLER").
The Parties enter into this Agreement in accordance with the provisions of Law 1581 of 2012 and article 2.2.2.25.5.2 of Decree 1074 of 2015 (Regulatory of the transmission of personal data).
CLAUSES
FIRST. PURPOSE. The purpose of this Agreement is to regulate the transmission of personal data, including sensitive data (clinical and health information of patients), that the CONTROLLER performs towards the PROCESSOR. This transmission is for the exclusive purpose of the PROCESSOR processing said data through its artificial intelligence platform, operating strictly under the instructions of the CONTROLLER, to provide the assisted clinical documentation service (generation of drafts and structuring of medical notes).
SECOND. SCOPE OF PROCESSING. The PROCESSOR will perform the following operations on the personal data of the CONTROLLER's patients: collection (through the platform), temporary storage, processing using AI algorithms for clinical text structuring, and deletion (in accordance with the configured retention policies). The PROCESSOR will not process the data for purposes other than those instructed by the CONTROLLER, nor will it use them for its own purposes, marketing, or advertising profiling.
THIRD. OBLIGATIONS OF THE CONTROLLER (PHYSICIAN/IPS). The CONTROLLER represents and warrants that:
They have the prior, express, informed, and documented authorization of each of the patients (Data Subjects) for the processing of their sensitive data, including express authorization to transmit said information to third-party technology providers (such as Nebula) for the purposes of assistance in clinical documentation.
The collection of data has been carried out lawfully and in compliance with Law 1581 of 2012 and Resolution 1995 of 1999 (on medical records).
They will directly and timely address any petition, complaint, or claim (PQR) presented by patients regarding their Habeas Data rights.
Assumes exclusive clinical responsibility: The CONTROLLER acknowledges that the PROCESSOR provides a technological assistance tool for documentation. The CONTROLLER agrees to verify, edit, and validate any text generated by the platform before incorporating it into the patient's official medical record, maintaining full medical autonomy (Judgment T-323 of 2024 of the Constitutional Court).
FOURTH. OBLIGATIONS OF THE PROCESSOR (NEBULA). The PROCESSOR agrees to:
Process personal data on behalf of the CONTROLLER in accordance with the principles that protect them.
Safeguard the security of the databases containing personal data, implementing technical, human, and administrative measures, including encryption in transit and at rest.
Maintain confidentiality regarding the processing of personal data.
Notify the CONTROLLER of any security incident, breach, or unauthorized access to the transmitted data, within a reasonable period after its discovery, so that the CONTROLLER can comply with their reporting obligation before the Superintendency of Industry and Commerce.
Allow access to the information only to authorized persons necessary for the provision of the service.
Refrain from making clinical, diagnostic, or therapeutic decisions based on the transmitted data.
FIFTH. SUB-PROCESSING. The CONTROLLER generally authorizes the PROCESSOR to subcontract technological infrastructure services (e.g., cloud servers, natural language processing APIs) that require access to the transmitted data, provided that such sub-processors are subject to confidentiality and security obligations equal to or greater than those established in this Agreement.
SIXTH. RETURN OR DESTRUCTION OF DATA. Upon termination of the commercial relationship or the CONTROLLER's subscription to the Nebula platform, the PROCESSOR agrees to destroy or irreversibly anonymize the transmitted personal data, except for those that, due to legal or technical obligations or by express request of the CONTROLLER, must be returned or retained for an additional period.
SEVENTH. INDEMNITY. The CONTROLLER shall hold the PROCESSOR harmless from any claim, sanction, fine or lawsuit initiated by patients (Data Subjects), the Superintendency of Industry and Commerce, or the Ministry of Health, resulting from the CONTROLLER's failure to obtain the patient's informed consent or from failures in their duty of care and clinical validation of the generated documentation.
EIGHTH. SERVICE AVAILABILITY (AS-IS). The PROCESSOR provides the software platform in the state in which it is found ("AS-IS" and "AS-AVAILABLE"). The PROCESSOR will make commercially reasonable efforts to maintain the availability of the service; however, it does not guarantee that access will be uninterrupted, error-free, or exempt from maintenance downtimes or failures in third-party infrastructures.
NINTH. LIMITATION OF LIABILITY (EXCLUSION OF LOSS OF PROFITS). To the maximum extent permitted by Colombian law, and except in demonstrated cases of willful misconduct or gross negligence, the PROCESSOR shall not be liable for indirect, incidental damages, loss of profits, loss of income, loss of business opportunities, or loss, alteration, or corruption of data resulting from system outages, bugs, or the inability to use the software. The total cumulative liability of the PROCESSOR to the CONTROLLER shall be limited to the total amount paid by the CONTROLLER to the PROCESSOR during the six (6) months immediately preceding the event that generated the claim.
TENTH. ACCEPTANCE. This Agreement is electronic and standard form. Clicking the acceptance button or checking the corresponding checkbox during registration on the Nebula platform constitutes the CONTROLLER's full, unconditional, and irrevocable signature and acceptance of all clauses contained herein, both regarding data processing and the limitation of technical and medical liability.