Data processing agreement

Scope and parties

This agreement is between Boolbyte Technologies ("Boolbyte", the processor) and the organization that uses our products (the "Customer", the controller). It forms part of our terms of service and of any agreement the Customer signs with us, and applies whenever we process personal data on the Customer's behalf.

It is written to meet the Nigeria Data Protection Act 2023 (NDPA), including section 29 on processors. Terms not defined here have their meaning in the NDPA.

Roles

• The Customer is the controller of the personal data of its patients, members, staff, and contacts that it puts into or collects through our products. It is responsible for having a lawful basis, and any consent needed, for that data.
• Boolbyte is the processor of that data, and processes it only to provide the products to the Customer.
• Where a person sends their own data to the Customer through ByteCare, Boolbyte is the controller of the ByteCare copy, and the Customer becomes a controller of what it receives.

Processing on instructions

We process Customer personal data only on the Customer's documented instructions. Those instructions are this agreement, the Customer's use and configuration of the products (including its approval rules and the features it turns on), and any other written instruction we agree. We will tell the Customer if we believe an instruction breaks the NDPA. We do not sell Customer personal data or use it for our own purposes.

Confidentiality

Everyone at Boolbyte who can access Customer personal data is bound by a duty of confidentiality, and has access only as far as their work requires.

Security

We keep technical and organizational measures appropriate to the risk of processing health data, as described on our security page. These include encryption in transit, role-based access control, separation of each Customer's data, hashing of passwords and keys, and a record of actions taken by staff and agents. We may improve these measures over time, but will not reduce the overall level of protection.

Subprocessors

• The Customer authorizes the subprocessors listed on our subprocessors page.
• We bind each subprocessor to data protection terms no less protective than this agreement, and remain responsible to the Customer for its performance.
• We update the list before a new subprocessor processes Customer personal data, and tell Customers that ask to be told. A Customer may object on reasonable data protection grounds within 30 days; if we cannot resolve the objection, the Customer may stop using the affected feature or end the agreement for that product.

AI processing

Some features process Customer personal data with AI models: the assistants that answer patients, the agents that handle bookings, coverage, and claims, the setup interview, voice input, and ByteEngine inference. For these features:

• Turning them on is the Customer's decision. An owner or admin turns AI features on, and doing so is an instruction to process data with them.
• Which providers. Every model call goes through ByteEngine, which records the provider that served it. Some models run on infrastructure we run or contract; others are third-party providers, which are used only where the Customer's project or organization allows third-party providers. Both are listed on the subprocessors page.
• No training. We do not use Customer personal data to train or fine-tune AI models.
• Human oversight. The Customer's approval rules decide which actions run on their own, wait for the patient, or wait for staff. Anything the rules don't cover goes to staff. Clinical decisions remain the Customer's.
• Disclosure. Patients are told they are talking to an automated assistant.
• Voice. Recordings are sent to a speech-to-text model and are not stored or logged by us.

How we use AI more broadly is set out on our responsible AI page.

International transfers

Where a subprocessor processes Customer personal data outside Nigeria, we transfer it only as Part VIII of the NDPA allows: to a country with an adequate level of protection, or with appropriate safeguards such as binding contractual terms. The subprocessors page says where each one processes data.

Data subject requests

If we receive a request from a person about Customer personal data, we pass it to the Customer without undue delay and do not answer it ourselves unless the Customer asks us to. We help the Customer respond to requests to access, correct, delete, restrict, or move personal data, as far as the nature of the processing allows.

Personal data breaches

We notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer personal data, so the Customer can meet its own duty to notify the NDPC within 72 hours. We tell the Customer what happened, the data and people likely to be affected, the likely consequences, and what we have done and will do, and we keep the Customer updated as we learn more.

Assessments and consultation

We give the Customer the information it reasonably needs to carry out a data protection impact assessment of its use of our products, and to consult the NDPC where that is required.

Return and deletion

• When the Customer stops using a product, it may ask within 30 days for its records to be returned. We return FHIR records as standard FHIR R4.
• We then delete Customer personal data from our live systems within 90 days, unless the law requires us to keep it, in which case we keep it protected and only for as long as required.
• We confirm deletion in writing on request.

Information and audits

We make available the information needed to show that we meet this agreement, including answers to the Customer's security questionnaire. Where that is not enough, the Customer may audit our compliance once a year, on 30 days' notice, during business hours, at its own cost, through an auditor bound by confidentiality, in a way that does not expose other customers' data.

General

• If identifiable personal data is put into a ByteEngine server, this agreement applies to it.
• If this agreement conflicts with the terms of service on data protection, this agreement wins. Liability is as set in the terms of service or the Customer's agreement with us.
• This agreement lasts as long as we process Customer personal data. It is governed by the laws of the Federal Republic of Nigeria.
• Contact for data protection: [email protected]. Security incidents: [email protected].

Annex: details of processing