This Data Processing Agreement ("DPA") establishes the binding terms for processing personal data between Summit AI Limited ("Summit AI", "Processor", "we", "us", or "our"), a New Zealand-registered company (NZBN: 9429053256614), and the subscribing healthcare clinic ("Client", "Controller", or "you").

This DPA forms an integral, legally binding attachment to the Summit AI Terms of Service. By accessing or using our services, you agree to the terms of this DPA on behalf of yourself and your authorized End Users.

1. Definitions & Legal Roles

Capitalized terms used in this DPA shall have the meanings set forth below or as defined in the main Agreement:

• "Client Personal Data" means personal data or health information processed by Summit AI on behalf of the Client to deliver the Services.

• "Data Protection Laws" means all applicable privacy and data protection legislation, including the New Zealand Privacy Act 2020 and Health Information Privacy Code 2020 (HIPC); the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs); and the UK/EU General Data Protection Regulation (GDPR).

• "Operational Emergency" means an unforeseen threat to system security, vendor insolvency, or critical service outage requiring immediate sub-processor replacement to maintain service continuity and data protection.

1.1 Legal Role Alignment

• Controller / Principal Agency: The Client acts as the Data Controller (or Principal Agency under New Zealand law) and retains primary regulatory responsibility for establishing the legal basis for collecting and processing patient data.

• Processor / Secondary Agency: Summit AI acts strictly as a Data Processor (or Secondary Agency under Sections 11 and 12 of the New Zealand Privacy Act 2020). Client Personal Data held by Summit AI is legally treated as being held by the primary clinic agency.
  
  

1.2 Statutory Legal Grounds
The Client warrants that it has established a valid statutory legal basis for Summit AI to process data under applicable laws:

• New Zealand: Rules 10, 11, and 12 of the Health Information Privacy Code 2020 (HIPC).

• Australia: Section 16B and APP 6.1 of the Privacy Act 1988 (Cth) (collection and use of information necessary to provide a health service).

• UK / EU / EEA: Article 6(1)(b)/(f) and Article 9(2)(h) of the UK/EU GDPR (provision and management of healthcare systems under professional secrecy obligations).
  
  

2. Scope & Processing Details

Core Purpose: Providing automated inbound and outbound AI phone reception, managing appointment bookings into connected Practice Management Systems (PMS), taking caller messages, and routing call summaries to clinic staff.

Categories of Data Subjects: Patients, callers, and clinic administrative staff.

Personal Data Processed:

• Caller Identifiers: Full names, contact telephone numbers, dates of birth, and email addresses.

• Interaction Data: Call audio streams, speech-to-text transcripts, call duration, timestamps, and caller intent classifications.

• Health Context: Appointment booking reasons, practitioner preferences, clinical front-desk triage notes, and health details voluntarily disclosed by callers during interactions.

• Technical Data: Staff credentials, encrypted PMS API access keys, IP addresses, system logs, and integration telemetry.

3. Technical & Organizational Security Measures

Summit AI shall maintain the following security safeguards to protect Client Personal Data:

• Encryption Standards: All network data in transit is encrypted using TLS 1.3 / HTTPS. All persistent data at rest is encrypted using AES-256 bit encryption. PMS API integration tokens are encrypted via AES-256 prior to storage.

• Access Controls: Staff access to production environments is strictly limited under least-privilege principles and protected by Multi-Factor Authentication (MFA) and Single Sign-On (SSO).

• System Testing: Summit AI maintains periodic vulnerability scanning and third-party security assessments across application infrastructure.

• Personnel Confidentiality: All employees and contractors authorized to process Client data are bound by strict confidentiality agreements and annual privacy training.
  
  

4. Sub-processors & Data Handling

4.1 General Sub-Processor Authorization
Client grants general written authorization for Summit AI to engage vetted sub-processors to support service delivery. Sub-processors are categorized into two tiers:

• Category A (Patient Data): Infrastructure handling live voice execution, audio streams, transcripts, or patient PII (e.g., Retell AI, Twilio).

• Category B (Administrative Account Data): Tools strictly housing clinic business contact details, billing, and staff logins, never patient health records (e.g., Airwallex, HubSpot, Google Workspace, Slack).
  
  

4.2 Zero Model Training & API Boundaries
Summit AI configures all core AI integrations using commercial enterprise API endpoints operating under Zero Data Retention (ZDR) agreements. Patient data is never used to train, fine-tune, or retrain public or proprietary third-party AI models.

4.3 Notice for Sub-Processor Changes & Objections

• Category A Changes: Summit AI will provide at least twenty (20) days' advance written notice via the Trust Centre or admin portal before adding or replacing a Category A sub-processor. Client may object on reasonable data protection grounds in writing within twenty (20) days. If parties cannot resolve the objection in good faith, Client may terminate the affected Service.

• Category B Changes: Updates to administrative sub-processors will be notified via admin portal alerts.

4.4 Operational Emergency Protocol
In an Operational Emergency, Summit AI may temporarily engage or replace a sub-processor without advance notice to preserve service continuity and data security, provided the vendor meets equivalent security standards. Summit AI will notify the Client within twenty-four (24) hours of engagement.

Note on Practice Management Systems (PMS): Integrations with practice management software (e.g., Cliniko, Nookal, Gensolve) utilize API credentials or integration tokens provided directly by the Client. These platforms represent the Client's own primary systems and are not sub-processors of Summit AI.

5. Data Subject Rights & Incident Management

5.1 Patient Privacy Requests & Forwarding
Because Summit AI is a Data Processor / Secondary Agency, direct patient requests regarding access, correction, or erasure must be managed by the Client:

• Forwarding Protocol: Summit AI will log and forward any direct patient privacy requests to the Client within two (2) business days.

• Technical Execution: Summit AI will technically execute extractions or hard purges across production systems within five (5) business days of receiving verified written instructions from the Client.

5.2 Security Incident Notification
In the event of a confirmed Security Incident compromising Client Personal Data, Summit AI shall:

• Notify the Client within twenty-four (24) hours of confirmation.

• Provide details regarding the nature of the incident, affected data types, and remedial actions taken.

• Assist the Client in fulfilling mandatory notification duties under the Australian Notifiable Data Breaches (NDB) scheme, New Zealand Privacy Act 2020, or UK/EU GDPR.

5.3 DPIA Assistance & Third-Party Requests

• DPIA Support: Summit AI shall provide reasonable assistance and documentation to support the Client in conducting Data Protection Impact Assessments (DPIAs) or regulatory consultations required under Data Protection Laws.

• Third-Party Requests: In the event Summit AI receives a court order, law enforcement subpoena, or regulatory request concerning Client Personal Data, Summit AI will promptly inform the Client in writing unless explicitly prohibited by law.

6. Data Retention, Return, and Deletion

• Rolling Audio & Transcript Purge: During an active subscription, all call audio recordings and speech-to-text transcripts are automatically deleted on a rolling 30-day schedule post-call.

• Post-Cancellation Purge: Upon subscription cancellation, active call audio recordings and transcripts are deleted from production environments.

• 30-Day Export & Hard Deletion Window: Client may request a structured export of remaining administrative account records within thirty (30) days of subscription termination. All remaining Client Personal Data across production databases and historical backups will be permanently erased no later than sixty (60) days following termination.

7. Audit Rights

Upon thirty (30) days' prior written notice, Summit AI shall make available to the Client reasonable documentation demonstrating compliance with its obligations under this DPA. If such documentation is insufficient to verify compliance, the Client (or its independent accredited auditor) may conduct a reasonable remote or on-site security assessment during regular business hours, at Client's sole expense, without disrupting operational continuity, and subject to standard confidentiality protocols.

8. Governing Law and Jurisdiction

This DPA is governed by the laws of New Zealand, regardless of conflict of laws principles. The parties submit to the exclusive jurisdiction of the courts of New Zealand. To the extent Data Protection Laws in the Client's local jurisdiction (e.g., Australia or UK/EU) mandate local statutory protections, those imperative provisions shall take precedence.

9. Contact Information

For data protection inquiries or to submit DPA execution requests, please contact our Privacy Officer:

• Name: Rubin Saini (CEO / Privacy Officer)

• Email: contact@usesummitai.com

• Website: www.usesummitai.com

By using the Service, you acknowledge that you have read, understood, and agree to be bound by this Data Processing Agreement.