Data Processing Agreement

between

Controller: The practice as entered during the online onboarding (the "Controller" within the meaning of Art. 4(7) GDPR)

and

Processor: Mosaic Medical UG (haftungsbeschränkt), Stubbenhof 16, 21147 Hamburg, Germany, represented by Viktor Kessler, operating under the brand "Dermalia" (the "Processor" within the meaning of Art. 4(8) GDPR)

§ 1 Subject and Term

(1) The subject of this agreement is the processing of personal data by the Processor on behalf of the Controller in the context of the service "Dermalia 3D skin report".

(2) The processing comprises retrieving scan raw data from the Controller's Isemeco 3D skin scanner, storing it, transforming it into a visual skin report, and sending the report link to patients by email. Where the Controller uses the treatment plan, it also comprises creating the plan from the practice's treatment catalogue and storing the cost estimate signed by the patient.

(3) This agreement enters into force upon electronic acceptance during the practice onboarding and applies for the duration of the Controller's use of the service.

§ 2 Nature, Purpose and Scope of Processing

(1) Type of data: - Facial scan images and 3D geometry from the Isemeco device - Algorithmic measurements of skin characteristics (wrinkles, pores, pigmentation, redness) - First and last name, date of birth, gender, phone number and email address of patients, as far as entered at the device or with the consent - Capture date, measurement algorithm version, device serial number - where the treatment plan is used: the selected treatments with prices and the signed cost estimate

(2) Purpose: Creation and delivery of a visual 3D skin report to the patient and provision of the report in the practice dashboard. Where the Controller uses these functions, this includes the progress comparison across several scans of the same patient and the treatment plan with cost estimate.

(3) Data subjects: Patients who undergo a 3D skin scan at the Controller's practice.

(4) Scope: Limited to the dataset required for these purposes. No medical records, no insurance data and no invoices are processed.

§ 3 Obligations of the Processor

The Processor undertakes to

(1) process personal data only on the documented instructions of the Controller and to ensure that persons acting under its authority who have access to the data process it only on the Controller's instructions (Art. 28(3)(a), Art. 29 GDPR);

(2) ensure that persons authorised to process the personal data have committed themselves to confidentiality (Art. 28(3)(b) GDPR) and to comply with the confidentiality undertaking in Annex 2;

(3) implement appropriate technical and organisational measures (TOM) pursuant to Art. 32 GDPR, as described in Annex 1;

(4) assist the Controller in fulfilling its obligations under Art. 32 to 36 GDPR (Art. 28(3)(f) GDPR);

(5) support the Controller in responding to data subject requests for access, rectification, erasure, restriction, portability and objection through appropriate technical and organisational measures (Art. 28(3)(e) GDPR);

(6) notify the Controller of any personal data breach without undue delay, at the latest within 24 hours of becoming aware (Art. 33 GDPR);

(7) maintain a written record of all categories of processing activities (Art. 30(2) GDPR);

(8) at the choice of the Controller, delete or return all personal data after the end of the provision of services (Art. 28(3)(g) GDPR);

(9) inform the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions (Art. 28(3) sentence 3 GDPR). It may suspend carrying out that instruction until the Controller confirms or changes it.

§ 4 Obligations of the Controller

The Controller remains responsible under the GDPR for the lawfulness of the processing, in particular for

(1) obtaining valid consent from patients or otherwise securing a lawful basis under Art. 6 and 9 GDPR before transmitting the scan to Dermalia;

(2) informing patients pursuant to Art. 13 GDPR about the use of Dermalia as a processor;

(3) issuing written instructions to the Processor for any processing beyond what is contractually agreed.

§ 5 Sub-processors

(1) The Processor may use the following sub-processors:

Only scan measurements, skin age and chronological age and, for patient questions, the question text entered by the patient are passed to the language model. No names, no date of birth, no email address and no images are passed. The Controller can switch off both modules in the practice dashboard at any time.

(2) The scan raw data originates in the device manufacturer's system (Meicet/Isemeco), which the Controller uses directly via the Isemeco skin scanner. This source system is not a sub-processor of the Processor; the Processor merely retrieves the data already held there into EU infrastructure.

(3) The Processor informs the Controller in text form at least 30 days before any intended addition or replacement of a sub-processor. The Controller may object to the change within that period (Art. 28(2) GDPR). If the Controller objects, the Processor does not use the new sub-processor for this Controller's data. Where that is not possible, the Controller may terminate the agreement without notice.

(4) The Processor imposes by contract on every sub-processor the same data protection obligations it has assumed in this agreement (Art. 28(4) GDPR). Where a sub-processor fails to fulfil its obligations, the Processor is liable to the Controller for it.

§ 6 Data Location and Transfer

(1) Patient data and scan raw data are stored and processed by the Processor in data centres within the EU (Frankfurt am Main). Email delivery runs through the EU region Ireland.

(2) Vercel Inc., Neon Inc. and Resend Inc. have their seat or parent company in the USA. Access from there is governed by the EU Standard Contractual Clauses (Implementing Decision 2021/914) in the contracts with these providers. For Google Ireland Ltd. the place of processing is not fixed to the EU. On request, the Processor provides the Controller with each sub-processor's contract terms including the respective transfer mechanism.

(3) Access to personal data from a place outside the EU/EEA counts as a transfer, even if the data is not relocated. Persons acting for the Processor access data from there only if the Controller has agreed beforehand in text form and the requirements of Art. 44 et seq. GDPR are met.

(4) If an authority of a third country demands that the Processor disclose the Controller's data, the Processor informs the Controller without undue delay, unless legally prohibited from doing so, and discloses data only as far as it is legally obliged to.

(5) The third-country reference to China arises from the Controller's use of the Isemeco device and the manufacturer's system and is the Controller's responsibility. The Processor retrieves the data already stored in the manufacturer's system into the EU (data import), processes it there and writes nothing back to the manufacturer's system.

§ 7 Erasure and Retention

(1) Patient reports are retained for 24 months from creation and then automatically deleted, unless the Controller instructs a longer or shorter period in writing. This period does not replace the retention of treatment records under § 630f BGB. For that purpose the Controller takes the report into its own records; the report is available to it as a PDF in the practice dashboard.

(2) The Controller may at any time request immediate erasure of individual reports or the entire dataset.

(3) Upon termination of the contract, all data of the Controller will, at its choice, be erased or returned to it within 30 days of the end of the contract. The Processor asks the Controller to make this choice when the contract ends. Data is returned in a machine-readable format. The erasure is logged and confirmed to the Controller on request.

§ 8 Audit Rights of the Controller

(1) The Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement and with Art. 28 GDPR. It allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller (Art. 28(3)(h) GDPR). Audits are announced with reasonable notice.

(2) Upon request, the Processor will provide the Controller with the current TOM documentation and any existing certifications.

§ 9 Liability

(1) For damages caused by the processing of personal data, the parties are liable pursuant to Art. 82 GDPR.

(2) The civil liability of the Processor for contractual and non-contractual claims remains unaffected.

§ 10 Final Provisions

(1) Amendments and supplements to this agreement require text form (including electronic). A new version takes effect through electronic acceptance in the practice dashboard.

(2) If any provision of this agreement is or becomes invalid, this shall not affect the validity of the remaining provisions.

(3) German law applies. Place of jurisdiction is Hamburg.

Annex 1 — Technical and Organisational Measures (TOM)

The applicable TOM are available in their current version at https://dermalia.de/sicherheit/tom and form part of this agreement.

Annex 2: Confidentiality undertaking (§ 203 German Criminal Code, StGB)

(1) Patient data is subject to medical confidentiality. The Processor is a person assisting in the Controller's professional activity (§ 203(3) sentence 2 StGB).

(2) The Processor undertakes to keep confidential all secrets of others that become known to it in this activity and to obtain knowledge of them only as far as necessary to perform this agreement. This undertaking continues after the end of the agreement.

(3) The Processor is aware that an assisting person who discloses without authorisation a secret that became known in this activity commits a criminal offence (§ 203(4) sentence 1 StGB).

(4) The Processor obliges all persons who have access to the data on its side, and all further persons and companies it engages, in text form to confidentiality and informs them of the criminal liability under § 203(4) StGB. It demonstrates these undertakings to the Controller on request.

Version 1.3.0 · Published on 2026-10-01