Patient Universe: Data Processing Agreement (Art. 28 GDPR)

Effective date / last updated: 15 October 2026

This data processing agreement ("DPA") follows the structure of the European Commission's standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915).

Between

The Controller: [Organisation name], [legal form], registered office [address], enterprise/registration number [number], represented by [name, function] ("the Controller" or "the Organisation"), an organisation that creates and runs one or more groups on Patient Universe;

and

The Processor: Esperity BV, a Belgian private limited company (besloten vennootschap), registered office Boulevard Brand Whitlock 108, 1200 Brussels, Belgium, enterprise/VAT number BE 0848.466.027, represented jointly by Mitchell Silva, CEO, and Dr. Erard le Beau de Hemricourt, CMO ("Esperity" or "the Processor").

This DPA forms part of the agreement between the parties for the use of Patient Universe (the "Main Agreement"). It is signed separately by each Organisation and by Esperity.

Section I: General

Clause 1. Purpose and scope

1.1 This DPA ensures compliance with Art. 28(3) and (4) of Regulation (EU) 2016/679 (GDPR), and, where applicable, with the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1.2 It applies to the processing of personal data described in Annex I. Esperity processes that data on behalf of the Controller to provide the group or groups the Controller has created on Patient Universe.

1.3 Annexes I to III form an integral part of this DPA.

1.4 This DPA does not cover processing for which Esperity is itself controller, as set out in the Patient Universe Privacy Policy, namely:
(a) the platform account: e-mail address, sign-in, language and the list of groups a member belongs to. One account (one e-mail address) is used across all groups;
(b) groups initiated by Esperity;
(c) Esperity's website, including website statistics, and its contact, demo and pricing-sheet requests;
(d) Esperity's business relationship with the Controller, including contracts and invoicing.
Esperity makes available to the Controller only the account data needed for membership of the Controller's group. It does not show the Controller which other groups a member has joined.

1.5 This DPA does not cover partner projects (such as advisory boards, surveys or co-creation run by researchers or by pharma and life-science companies). Those projects run under separate written agreements. The party running a project is controller for its own processing.

Clause 2. Invariability

2.1 The parties will not modify these clauses, except to complete the Annexes or update the information in them.

2.2 This does not prevent the parties from including these clauses in a broader contract, or adding clauses or safeguards, as long as these do not contradict these clauses or reduce the rights of data subjects.

Clause 3. Interpretation

Terms defined in the GDPR have the same meaning in this DPA. These clauses are read in the light of the GDPR and do not reduce the parties' obligations under it.

Clause 4. Hierarchy

If these clauses conflict with the Main Agreement or any other agreement between the parties, these clauses prevail on data protection matters.

Section II: Obligations of the parties

Clause 5. Description of the processing

The details of the processing are set out in Annex I.

Clause 6. Obligations of the Controller

6.1 The Controller decides the purposes and means of processing of the data in the groups it has created. It is responsible for having a valid legal basis, including under Art. 9 GDPR for health data (Annex I, section E).

6.2 The Controller decides, in its organisational admin portal, which accounts are admitted to or excluded from its groups, which roles they have (admin, editor, moderator, group admin), what content is visible to whom, how its groups are moderated, and which modules are switched on. It grants admin access only to authorised persons bound by confidentiality.

6.3 The Controller provides members with the information required by Art. 13 and 14 GDPR. It may publish its own privacy notice for its group, which then applies alongside the Patient Universe Privacy Policy. Where the Controller adds its own forms or data fields, its group-specific terms and privacy notice apply to those fields.

6.4 Where the Controller processes health data, it keeps a list of the categories of people with access and their roles, and ensures they are bound by confidentiality, as required by Art. 9 of the Belgian law of 30 July 2018 or equivalent national rules. The platform's role management and audit log support this.

6.5 The Controller does not give sponsors, pharma or life-science companies or other partners access to member data through Patient Universe. It may share anonymous, aggregated insights, but never members' identities or member lists.

Clause 7. Obligations of the Processor

7.1 Instructions. Esperity processes personal data only on documented instructions from the Controller, unless EU or Member State law requires otherwise. In that case, Esperity informs the Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Documented instructions are:
(a) this DPA and the Main Agreement;
(b) the settings and actions the Controller performs in its organisational admin portal, including access settings (admitted and excluded accounts, roles, visibility of content), moderation settings and the modules switched on;
(c) further written instructions from the Controller.
Esperity immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.

7.2 Purpose limitation. Esperity processes the data only for the purposes in Annex I. In particular, Esperity does not:
(a) use the Controller's group data for its own purposes or for advertising;
(b) sell personal data;
(c) give sponsors, pharma or life-science companies or other third parties access to member data;
(d) share member data with any partner, except where an individual member has explicitly consented to a specific partner project and the Controller has instructed Esperity accordingly.

7.3 Duration. Esperity processes the data only for the duration set out in Annex I.

7.4 Security.
(a) Esperity implements at least the technical and organisational measures in Annex II to ensure the security of the data, including protection against a personal data breach. It takes into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks for data subjects.
(b) Esperity grants access to the data only to staff and contractors who need it to perform, manage and monitor the Main Agreement and who are bound by confidentiality.

7.5 Sensitive data. Because most groups focus on a specific condition or health area, the processing will often include data concerning health (Art. 9 GDPR). Esperity applies the additional safeguards in Annex II, section B. Patient Universe is only for people aged 18 or older; accounts for people under 18 are not permitted.

7.6 Documentation and compliance.
(a) Each party is able to demonstrate compliance with these clauses.
(b) Esperity deals promptly and adequately with the Controller's inquiries about the processing.
(c) Esperity makes available all information needed to demonstrate compliance with Art. 28 GDPR, and allows and contributes to audits as follows.
(d) Audits are carried out primarily through documentation: Esperity's records of processing, security documentation, sub-processor information and relevant certifications or audit reports of Esperity and its sub-processors.
(e) Where documentation is not sufficient, the Controller may carry out an audit, or mandate an independent auditor bound by confidentiality, once per year. It must give at least 30 days' written notice. An audit may also take place at any time after a personal data breach or at the request of a supervisory authority. Audits take place during business hours and without disproportionate disruption to Esperity's operations or to other customers' data.
(f) The Controller bears the costs of an audit. Esperity bears its own costs if the audit reveals a material breach of this DPA by Esperity.
(g) Both parties make this information, including audit results, available to the competent supervisory authority on request.

7.7 Use of sub-processors.
(a) Esperity has the Controller's general written authorisation to engage the sub-processors listed in Annex III.
(b) Esperity informs the Controller in writing at least 30 days in advance of any intended addition or replacement of a sub-processor. During that period the Controller may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Controller may terminate the affected service without penalty before the change takes effect.
(c) Esperity engages each sub-processor under a written contract that imposes, in substance, the same data protection obligations as this DPA.
(d) On request, Esperity provides a copy of the relevant sub-processor terms; commercial information may be redacted.
(e) Esperity remains fully responsible to the Controller for its sub-processors' performance. It notifies the Controller if a sub-processor fails to fulfil its contractual obligations.

7.8 International transfers.
(a) Esperity stores the Controller's data in the European Union: the database, back end and authentication on Supabase servers in Germany, and the website and application on Lovable's EU servers.
(b) Several sub-processors are US companies or group companies that may access data from outside the EU, for example for support or maintenance. Any such transfer is covered by an adequacy decision (the EU–US Data Privacy Framework, for certified companies) or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), with supplementary measures where needed, as listed in Annex III.
(c) Any other transfer to a third country requires the Controller's documented instruction or authorisation (including by listing it in Annex III) and must comply with Chapter V GDPR.

Clause 8. Assistance to the Controller

8.1 Esperity promptly notifies the Controller of any request it receives directly from a data subject about the Controller's group data. It does not respond itself unless the Controller authorises it, but it may confirm receipt and refer the person to the Controller.

8.2 Esperity assists the Controller in responding to data subjects' requests, through:
(a) self-service functions for members: download of their own data and account deletion;
(b) admin functions for the Controller to find, export, correct and delete a member's data in its groups;
(c) support from Esperity on request, in time for the Controller to meet the deadlines of the GDPR.

8.3 Taking into account the nature of the processing and the information available to it, Esperity also assists the Controller with:
(a) data protection impact assessments (Art. 35 GDPR), including by providing a description of the platform, its data flows and security measures that the Controller can use in its own assessment;
(b) prior consultation of the supervisory authority (Art. 36 GDPR);
(c) keeping the data accurate and up to date, by informing the Controller without delay if Esperity becomes aware that data is inaccurate or outdated;
(d) the obligations in Art. 32 GDPR.

Clause 9. Personal data breaches

9.1 Breach at Esperity or its sub-processors. Esperity notifies the Controller without undue delay and at the latest within 48 hours of becoming aware of a personal data breach affecting the Controller's data. It notifies the Controller's contact in Annex I. The notification contains at least:
(a) the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;
(b) the contact details of a contact point where more information can be obtained;
(c) the likely consequences, and the measures taken or proposed to address the breach and mitigate its possible adverse effects.
Where not all information is available at once, Esperity provides it in phases without undue further delay.

9.2 Esperity assists the Controller in notifying the competent supervisory authority within 72 hours of the Controller becoming aware of the breach (Art. 33 GDPR), and in informing data subjects where required (Art. 34 GDPR).

9.3 Breach at the Controller. Esperity cooperates with and assists the Controller in meeting its obligations under Art. 33 and 34 GDPR.

9.4 Esperity keeps a record of all personal data breaches affecting the Controller's data.

Section III: Final provisions

Clause 10. Non-compliance and termination

10.1 If Esperity breaches this DPA, the Controller may instruct Esperity to suspend the processing until it complies or the DPA is terminated. Esperity promptly informs the Controller if it is unable to comply.

10.2 The Controller may terminate this DPA and the affected processing under the Main Agreement if:
(a) processing has been suspended under 10.1 and compliance is not restored within a reasonable time, and in any event within one month;
(b) Esperity is in substantial or persistent breach of this DPA or of its obligations under the GDPR;
(c) Esperity fails to comply with a binding decision of a competent court or supervisory authority about its obligations under this DPA or the GDPR.

10.3 Esperity may terminate the affected processing if, after informing the Controller that an instruction infringes the law, the Controller insists on it.

10.4 Account deletion during the term. When a member deletes their account, Esperity deletes or anonymises that member's personal data in the Controller's groups within 30 days, including in backups. Content that others have already quoted in replies, or that must be kept by law, may remain.

10.5 Group closure. If the Controller closes a group, or the Main Agreement ends:
(a) members are informed in advance and can download their data first;
(b) at the Controller's choice, Esperity returns all personal data in the group(s) to the Controller in a structured, commonly used, machine-readable format and/or deletes it;
(c) return and deletion are completed within 30 days after the closure or the end of the Main Agreement, including in backups, unless EU or Member State law requires storage;
(d) Esperity confirms the deletion in writing on request.
Until the data is deleted or returned, Esperity continues to ensure compliance with this DPA.

Clause 11. Liability

11.1 Each party is liable towards data subjects as provided in Art. 82 GDPR.

11.2 Between the parties, Esperity is liable under this DPA only for damage that the Controller proves was caused by Esperity's breach of this DPA or of the GDPR.

11.3 Where the Controller pays Esperity for the use of the platform, Esperity's total liability towards the Controller under this DPA and the Main Agreement is limited to the amounts paid by the Controller under the Main Agreement in the 12 months before the event that caused the damage.

11.4 Where the Controller uses the platform free of charge, Esperity is not liable towards the Controller under this DPA, to the extent permitted by law.

11.5 The limitations in Clauses 11.3 and 11.4 do not apply to fraud, intentional misconduct or gross negligence, or to any liability that cannot be limited or excluded under applicable law. They do not affect the rights of data subjects under Art. 82 GDPR.

11.6 Each party bears any administrative fine imposed on it for its own infringement.

Clause 12. Duration, governing law and language

12.1 This DPA takes effect together with the Main Agreement. It remains in force for as long as Esperity processes personal data on behalf of the Controller, including during the return and deletion period in Clause 10.5.

12.2 This DPA is governed by Belgian law. The courts of Brussels have exclusive jurisdiction over any dispute arising from it.

12.3 Organisations established outside Belgium may sign this DPA. Where the Controller is established outside the EU/EEA, Esperity decides case by case whether it can sign this DPA, and the parties agree in writing on any additional safeguards needed for that situation (for example the European Commission's Standard Contractual Clauses, Module 4: processor to controller) before processing starts.

12.4 This DPA is available in English, Dutch, French and Spanish. If the language versions differ, the English version prevails.

Signatures

For the Controller: name, function, date, signature

For Esperity BV, signed jointly by:

• Mitchell Silva, CEO: date, signature
• Dr. Erard le Beau de Hemricourt, CMO: date, signature

Annex I: Description of the processing

A. Parties and contacts

• Controller: see above. Contact for data protection and breach notifications: [name, e-mail]. DPO (if any): [details].
• Processor: Esperity BV, see above. Contact and breach contact: info@esperity.com. Data protection officer: Chino.io (external DPO), contact via info@esperity.com.

B. Categories of data subjects

• Members of the Controller's groups, admitted by the Controller through its admin portal, all aged 18 or older: patients, carers, family members, volunteers and other adults the Controller admits.
• Staff, board members and volunteers of the Controller with admin, editor, moderator or group-admin roles, including team-page profiles.
• People who register for the Controller's events or fill in its forms or surveys within its groups.

People under 18 are not included: accounts for people under 18 are not permitted.

C. Categories of personal data

• Group profile: display name or random ID (anonymous mode), optional profile photo, topics of interest, badges (e.g. patient, carer, volunteer), membership status, approval or check against the Controller's membership list.
• Account data made available for group membership: e-mail address (never shown to other members), language.
• Content: posts, comments, reactions, poll answers, private messages, uploaded files and images.
• Event data: registrations, attendance, answers to extra questions (e.g. accessibility needs).
• Survey and form responses, linked or anonymous, including data in forms and fields the Controller adds itself.
• Moderation data: flags and reasons, moderation actions, warnings, suspensions, statements of reasons.
• Technical data: audit-log entries, consent records (date and version), timestamps.
• Newsletter opt-in records.

Anonymous mode. Members may take part under a random ID instead of their name. Other members never see their e-mail address. The Controller and Esperity can still link an account to its e-mail address for sign-in, safety and moderation.

D. Special categories of data

Data concerning health. Because most groups focus on a specific condition or health area, membership and content will often reveal health information. Members may also share other special categories of data. Safeguards: Annex II, section B.

E. Legal basis for health data

The Controller sets the legal basis in its group privacy notice. By default, the platform asks for the member's explicit consent (Art. 9(2)(a) GDPR), separately, and records it with date and version. The Controller may rely on another basis allowed by Art. 9(2), such as Art. 9(2)(d) for not-for-profit bodies, if it qualifies and states so in its notice. Any sharing of a member's data with a partner always requires that member's separate, explicit consent.

F. Nature of the processing

Hosting, storage, structuring, access control according to the Controller's admin-portal settings, display, retrieval, transmission (notifications and e-mail), encryption, pseudonymisation (anonymous mode), aggregation and anonymisation (group statistics and survey results), moderation support with flagging, a moderation queue, an automatic word filter and optional pre-approval of posts by new members, export, backup, restoration and deletion.

G. Purposes of the processing

Providing the Controller's groups on Patient Universe, with access as set by the Controller in its admin portal and the modules it switches on: discussions, private groups, educational content, events, surveys and forms, clinical trial finder, announcements, notifications, group statistics, member management and moderation. Also support, maintenance, security and incident handling, and any optional services the Controller orders from Esperity, such as moderation support.

Group statistics for the Controller are always aggregated and anonymous, never below a minimum group size of 20.

H. Duration

For the term of the Main Agreement, plus the return and deletion period in Clause 10.5. During the term, a member's data is deleted or anonymised within 30 days after the member deletes their account, including in backups (Clause 10.4).

I. Frequency

Continuous.

Annex II: Technical and organisational measures

A. General measures

1. Hosting in the EU: database, back end and authentication on Supabase servers in Germany; website and application on Lovable's EU servers.
2. Encryption of data in transit and at rest.
3. Extra encryption of sensitive fields.
4. Sign-in by secure e-mail link, without passwords.
5. Two-factor authentication for administrators.
6. Role-based access, set by each Controller in its admin portal (admin, editor, moderator, group admin).
7. Audit log of admin actions.
8. Separation of data per organisation.
9. Private-group content visible only to members of that group and not indexed by search engines.
10. Backups included in the 30-day deletion after account deletion and at the end of the agreement.
11. Confidentiality undertakings for all Esperity staff and contractors with access to data; access removed when they leave.
12. A personal data breach procedure meeting the timeline in Clause 9.
13. Data protection by design and by default: modules are switched on only when the Controller chooses; members choose their notification settings; anonymous mode is available.

B. Additional safeguards for health data

1. Explicit, separate consent for health data by default, recorded with date and version.
2. Group statistics always aggregated and anonymous, never below a minimum group size of 20.
3. No access to member data for sponsors, pharma or life-science companies or other partners.
4. Members can download and delete their own data at any time.
5. E-mail addresses never shown to other members.
6. Esperity staff access group data only for support, security or maintenance, or at the Controller's request.
7. Support for the Controller's list of people with access to health data (role management and audit log).
8. Patient Universe is only for people aged 18 or older; accounts of people under 18 are closed when Esperity becomes aware of them.

C. Assistance with data subjects' rights

Member self-service download and deletion; admin tools to find, export, correct and delete a member's data; support from Esperity on request (Clause 8).

Annex III: Authorised sub-processors

Google Analytics is used only on Esperity's public website, after consent, and never inside groups. It does not process the Controller's group data and is not a sub-processor under this DPA.