Data Processing Agreement

Smart Fixator® web application · Version 1.0 · 23 September 2026

1. Parties and roles

1. Customer: the healthcare provider, institution or independent clinician that uses the Smart Fixator software and enters patient data into it. The Customer is the controller of that patient data.
2. Response Ortho: Response Ortho Teknolojik Üretim A.Ş., ITOSB, 10. Cadde, No:1, Tuzla, 34959 Istanbul, Türkiye (MERSİS no. 0462038264300019). Response Ortho processes patient data on the Customer's behalf as a processor.
3. For the account data of the Customer's users (name, e-mail address, sign-in records and similar), Response Ortho acts as an independent controller, as described in its Privacy Notice. This DPA does not apply to that data.

2. Definitions

1. Applicable Data Protection Law: the laws on the protection of personal data that apply to the processing, including Regulation (EU) 2016/679 (GDPR), the UK GDPR and Turkish Law No. 6698 (KVKK).
2. Patient Data: personal data about the Customer's patients that the Customer or its users enter into, upload to or create with the software — described in Annex 1.
3. Sub-processor: a third party engaged by Response Ortho that processes Patient Data. Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Patient Data.
4. "Controller", "processor", "data subject", "processing" and "special categories of personal data" have the meanings given in Applicable Data Protection Law.

3. Processing on instructions

1. Response Ortho processes Patient Data only to provide, secure and support the software, and only on the Customer's documented instructions. The Agreement, this DPA and the Customer's use and configuration of the software are the Customer's instructions. Further instructions must be given in writing.
2. If a law to which Response Ortho is subject requires other processing, Response Ortho will inform the Customer before processing, unless that law prohibits it.
3. Response Ortho will tell the Customer immediately if, in its opinion, an instruction infringes Applicable Data Protection Law.
4. Response Ortho does not sell Patient Data and does not use it for its own purposes, with one exception: the Customer authorises Response Ortho to anonymise Patient Data and to use the anonymised data — and only the anonymised data — to develop, improve and validate its products, including AI-assisted measurement. Anonymisation removes names, dates, contact details, identifiers in image headers and text burned into images, so that no patient can be identified by any means reasonably likely to be used. Anonymised data is no longer personal data, and Response Ortho will not attempt to re-identify it.

4. The Customer's obligations

1. The Customer is responsible for having a lawful basis for the processing, including the conditions for processing health data, and for informing its patients as Applicable Data Protection Law requires.
2. The Customer enters only the Patient Data that is necessary for treatment and, wherever possible, uses a case code instead of patient names.
3. The Customer ensures that the person who accepts this DPA is authorised to do so on its behalf, and that its users keep their credentials confidential and remove access for people who leave.

5. Confidentiality

Response Ortho ensures that the people it authorises to process Patient Data are bound by confidentiality, and gives access only to those who need it — for example to operate the service or, at the Customer's request, to provide support.

6. Security

Response Ortho implements the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk, and keeps them under review. Under Article 12 of KVKK the parties are jointly responsible for taking the security measures required by that law.

7. Sub-processors

1. The Customer gives general authorisation for Response Ortho to engage the Sub-processors listed in Annex 3.
2. Response Ortho will inform the Customer of any intended addition or replacement at least 30 days in advance, by e-mail to account holders or in the software. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may stop using the affected service.
3. Response Ortho imposes data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains responsible to the Customer for its Sub-processors.

8. Location and international transfers

1. Patient Data is hosted in the Netherlands (European Union).
2. Response Ortho transfers Patient Data to a country outside the European Economic Area only with the safeguards required by Applicable Data Protection Law, such as the European Commission's standard contractual clauses.
3. For Customers in Türkiye, the transfer of Patient Data to the hosting location abroad is made in accordance with Article 9 of KVKK.
4. For Customers in the United States that are covered entities under HIPAA, Response Ortho acts as their business associate. The parties sign a business associate agreement (BAA) before protected health information is entered, and Response Ortho ensures that its sub-processors that handle protected health information also sign one.

9. Requests from patients

Response Ortho will forward to the Customer, without undue delay, any request it receives from a patient about Patient Data and will not answer it except on the Customer's instructions. The software lets the Customer find, correct, export and delete Patient Data; where this is not enough, Response Ortho gives reasonable assistance so that the Customer can meet its obligations.

10. Personal data breaches

1. Response Ortho will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Patient Data.
2. The notification describes, as far as then known, the nature of the breach, the categories and approximate number of patients and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Further information is provided as it becomes available.
3. Response Ortho cooperates with the Customer, which remains responsible for notifying the supervisory authority and the patients where the law requires — under GDPR within 72 hours where feasible, and under KVKK within 72 hours.

11. Impact assessments

Response Ortho gives the Customer reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities relating to the software.

12. Information and audits

Response Ortho makes available the information necessary to demonstrate compliance with this DPA, such as descriptions of its measures and its providers' certifications. The Customer, or an independent auditor bound by confidentiality, may audit compliance once a year — or after a Personal Data Breach or at the request of a supervisory authority — with at least 30 days' notice, during business hours and at the Customer's cost. Remote reviews are preferred where they are sufficient.

13. Deletion or return at the end of the service

When the Customer stops using the software, it may export its Patient Data during 30 days. Response Ortho then deletes the Patient Data within 60 days, and from backups when they expire under the regular backup cycle, unless a law requires it to keep the data. Response Ortho confirms the deletion in writing on request.

14. Liability, term and changes

1. Liability is governed by the Agreement.
2. This DPA applies for as long as Response Ortho processes Patient Data for the Customer; clauses that by their nature should survive remain in force after that.
3. Response Ortho may update this DPA to reflect changes in the law, the service or its Sub-processors, and will announce a new version by e-mail to account holders at least 30 days before it takes effect. The new version applies from that date unless the Customer objects before then; if an objection cannot be resolved, the Customer may stop using the service.

15. Precedence, law and language

1. On matters of data protection this DPA prevails over the Agreement. Where standard contractual clauses apply, they prevail over this DPA.
2. This DPA is governed by Turkish law, and the courts and enforcement offices of Istanbul have jurisdiction, subject to the mandatory rules of Applicable Data Protection Law — for example the rights of patients and the powers of supervisory authorities.
3. This DPA is available in English and Turkish. In case of conflict, the Turkish version prevails for Customers established in Türkiye and the English version for all other Customers.

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

• Hosting: servers operated by DigitalOcean in Amsterdam, the Netherlands, in data centres with physical access control.
• Transmission: all connections to the software are encrypted with HTTPS (TLS).
• Access to the software: individual user accounts; passwords stored only as salted bcrypt hashes; accounts blocked after repeated failed sign-ins and unblocked through an e-mailed link; role-based permissions.
• Access to systems: administrative access restricted to authorised staff.
• Logging: sign-ins and account events are logged with date, time, IP address and browser details; errors are logged for troubleshooting.
• Organisation: confidentiality obligations for staff and providers; access on a need-to-know basis; changes to the software reviewed before release.

Annex 3 — Sub-processors

The services used only on the public website (Google Analytics, Google reCAPTCHA, IP-location services) do not receive Patient Data and are not Sub-processors.