Data Processing Addendum
Version 1.0 — Effective 3 October 2026 for accounts created on or after that date, and 2 November 2026 for existing accounts.
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer, as controller, and Delara Vision, Inc. ("Delara"), as processor. It applies to personal data contained in Customer Content that Delara processes on the Customer's behalf ("Customer Personal Data"), as described in Annex I.
- Instructions. Delara processes Customer Personal Data only on the Customer's documented instructions (the Terms, this DPA and the use of the Service), including for international transfers, unless the law requires otherwise; Delara then informs the Customer beforehand, unless the law prohibits it. Delara informs the Customer if an instruction infringes data protection law.
- De-identification. Unless the Customer has opted out under clause 5.2 of the Terms, the Customer instructs Delara to de-identify Customer Personal Data for model improvement. Guest uploads are excluded.
- Confidentiality. Persons authorised to process Customer Personal Data are bound by confidentiality.
- Security. Delara implements the measures in Annex II (GDPR art. 32).
- Sub-processors. The Customer authorises the sub-processors listed at www.delaravision.com/legal/subprocessors. Delara gives 30 days' notice of any new sub-processor; the Customer may object and, if no solution is found, terminate with a pro-rata refund of prepaid Fees. Delara imposes equivalent obligations on its sub-processors and remains liable for them.
- Assistance. Taking into account the nature of the processing, Delara assists the Customer with data subject requests and with its obligations under GDPR art. 32 to 36.
- Breaches. Delara notifies the Customer of a personal data breach without undue delay after becoming aware of it.
- End of processing. At the end of the Terms, Delara deletes Customer Personal Data after a 30-day export window and within 60 days, unless the law requires it to be kept.
- Audits. Delara makes available the information needed to demonstrate compliance and allows audits by the Customer or an auditor it mandates, with reasonable notice and at the Customer's cost.
- International transfers. For transfers from the EEA, the parties agree to Module 2 of the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, incorporated by reference, with clause 9(a) Option 2 (30 days' notice), Belgian law and courts under clauses 17 and 18, and Annexes I and II of this DPA as their annexes. For the United Kingdom and Switzerland, these clauses apply with the required adaptations.
- Precedence. The standard contractual clauses prevail over this DPA, and this DPA prevails over the Terms as regards personal data.
Annex I — Description of the processing
| Item | Description |
|---|---|
| Data exporter (controller) | The Customer, as identified in its Account; contact: the Account e-mail address |
| Data importer (processor) | Delara Vision, Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, United States; contact: admin@delaravision.com |
| Data subjects | The Customer's clients (animal owners and their representatives); other people named in case data (referring veterinarians, farriers, trainers, buyers and sellers in pre-purchase examinations); the Customer's staff named in case data |
| Categories of personal data | Names and contact details of clients; animal identification linked to an owner (name, passport or microchip number); case history and examination findings; image metadata, including DICOM header fields such as owner, practice and veterinarian names and dates; report contents; free-text notes; e-mail addresses of share-link recipients |
| Special categories | None intended. Animal health data is not health data within the meaning of GDPR art. 9. The Customer must not upload special categories of data about individuals |
| Frequency | Continuous, for the duration of the Terms |
| Nature of the processing | Hosting and storage; analysis by AI models; automated measurements; report generation; comparison over time; sharing at the Customer's request; de-identification (unless the Customer opted out); support; deletion |
| Purpose | Providing the Service under the Terms |
| Retention | For the duration of the Terms, then deletion as set out in clause 8; Guest Use content deleted after 7 days |
| Sub-processors | As listed at www.delaravision.com/legal/subprocessors, for the purposes and locations stated there |
| Competent supervisory authority | The authority of the Member State where the Customer is established; for Belgium, the Autorité de protection des données / Gegevensbeschermingsautoriteit |
Annex II — Technical and organisational measures
- Encryption of data in transit and at rest.
- Access limited to authorised persons, with multi-factor authentication for administrative access.
- Passwords stored as hashes.
- Removal of identifying DICOM header fields and file names at upload.
- Logical separation of each Customer's data.
- Backups provided by the hosting provider.
- Confidentiality obligations for personnel and a procedure for handling personal data breaches.