(1) The customer that is a party to the Terms (the "Customer"); and
(2) Huniverse Global Co., Ltd., incorporated and registered in the Republic of Korea with registration number 752-86-01410, whose registered office is at 9th Floor, 25 Wangsan-ro, Dongdaemun-gu, Seoul, Republic of Korea (the "Processor").
Each a party, and together the parties.
1.1 This Data Processing Agreement (the "DPA") forms part of the MEDIPENCIL Terms of Service agreed between the parties (the "Terms") and governs the Processor’s Processing of Personal Data on the Customer’s behalf in connection with the service provided under the Terms (the "Service"). It is entered into when the Terms take effect, and no separate signature is required, although the parties may countersign it on request.
1.2 This DPA is intended to satisfy the requirements of Article 28(3) of Regulation (EU) 2016/679 (the "GDPR").
1.3 Where any provision of this DPA conflicts with the Terms, this DPA prevails in respect of the Processing of Personal Data. Capitalised terms not defined in this DPA have the meanings given in the Terms.
1.4 Where the parties have entered into a separate signed data processing agreement in respect of the Service, that agreement prevails over this DPA to the extent of any conflict.
"Data Protection Law" means the GDPR and the national laws implementing or supplementing it that apply to the Processing.
"Patient Data" means Personal Data relating to a patient of the Customer, or to any other individual whose voice is captured during a consultation, that is Processed through the Service.
"Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR.
"Sub-processor" means any third party engaged by the Processor to Process Personal Data under this DPA.
3.1 In respect of Patient Data, the Customer is the Controller and the Processor acts as Processor on the Customer’s documented instructions. In respect of account, billing and support data, the Processor acts as Controller, as described in its Privacy Policy, and this DPA does not apply to that Processing.
3.2 The Processor shall Process Personal Data only on the Customer’s documented instructions, including with regard to transfers of Personal Data to a third country, unless required to do otherwise by law to which the Processor is subject. In that event the Processor shall inform the Customer of the legal requirement before Processing, unless the law prohibits it on important grounds of public interest.
3.3 The Terms, this DPA, and the Customer’s configuration and use of the Service within the scope permitted by the Terms together constitute the Customer’s complete documented instructions. Any further or amended instruction requires the written agreement of both parties and may be subject to an adjustment of the fees.
3.4 The Processor shall inform the Customer without delay if, in the Processor’s opinion, an instruction infringes Data Protection Law. The Processor may suspend the affected Processing until the matter is resolved and shall not be liable for any resulting delay.
| Subject matter | The Processor’s provision of MEDIPENCIL under the Terms: conversion of audio recorded during clinical consultations into draft text to support the preparation of clinical documentation. |
|---|---|
| Duration | For as long as the Terms remain in force, together with the retention and deletion periods set out in clause 14. |
| Nature and purpose | Recording initiated by the Customer; transmission to the Processor and its Sub-processors; conversion of speech to text; checking of recognised medical terminology against a diagnosis and medication dictionary; generation of draft text; transient holding for the duration of Processing; and deletion. In each case solely to provide the Service on the Customer’s documented instructions. |
| Types of Personal Data | Audio of clinical consultations and the text generated from it, which may include data concerning health and other special categories of Personal Data within the meaning of Article 9 GDPR; the identifier of the User account that initiated the Processing; and the technical data necessary to carry out the request. |
| Categories of Data Subject | Patients of the Customer and any other individual whose voice is captured during a consultation; Users authorised by the Customer. |
| Frequency | Continuous, as initiated by the Customer and its Users. |
5.1 The Customer is responsible for establishing and maintaining a lawful basis under Article 6 GDPR and a condition under Article 9 GDPR for the Processing of Patient Data, for obtaining any consent required under applicable law from patients and other recorded individuals, for providing the information required by Articles 13 and 14 GDPR, and for responding to requests those individuals make about their data.
5.2 The Customer is responsible for the accuracy, quality and lawfulness of the Personal Data it submits and for ensuring that its instructions comply with Data Protection Law.
5.3 The Customer shall maintain its own record of processing activities and shall notify the Processor in writing of any change to the Processing that affects the Processor’s obligations under this DPA.
6.1 The Processor shall Process Personal Data only to provide, operate, secure and support the Service in accordance with the Terms, to diagnose and prevent technical or security problems, and to comply with law, in each case consistent with the Customer’s documented instructions.
6.2 The Processor shall not sell Personal Data, use it for advertising, or disclose it to any third party for that third party’s own purposes.
6.3 Neither the Processor nor any Sub-processor shall use Personal Data to train, fine-tune or otherwise improve any artificial intelligence model, including any general-purpose model or large language model.
6.4 The Processor does not create or use de-identified, pseudonymised or aggregated data derived from Patient Data.
7.1 The Processor shall ensure that every person it authorises to Process Personal Data is bound by a legally enforceable obligation of confidentiality that survives the end of their engagement, and accesses Personal Data only as necessary to provide the Service, on a least-privilege basis.
7.2 The Processor shall notify the Customer without undue delay of any contact from a Supervisory Authority relating to Processing under this DPA, and shall not represent the Customer before a Supervisory Authority without the Customer’s written authorisation.
7.3 Where the Processor receives a legally binding request from a public authority for Personal Data, it shall, unless legally prohibited, notify the Customer before responding, challenge any request it reasonably considers unlawful, and disclose only the minimum Personal Data necessary.
8.1 The Processor shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing as well as the risks to individuals.
8.2 Those measures are described in the Processor’s Technical and Organisational Measures document, which is available on request. The Processor shall not materially reduce the overall level of security of the Service while the Terms are in force.
8.3 The Processor shall maintain the ability to restore the availability of and access to Personal Data in a timely manner following a physical or technical incident, in accordance with Article 32(1)(c) GDPR.
9.1 The Customer provides a general written authorisation for the Processor to engage Sub-processors, and authorises those listed in clause 9.2.
9.2 The Processor engages the following Sub-processors:
| Sub-processor | Processing carried out | Location |
|---|---|---|
| KaiLab Co., Ltd. | Speech recognition and generation of draft text | Republic of Korea |
| Cafe24 Co., Ltd. | Hosting and infrastructure | Republic of Korea |
9.3 The Processor shall notify the Customer in writing at least thirty (30) days before a new Sub-processor begins Processing Personal Data. The Customer may object on reasonable grounds relating to data protection within that period. The parties shall seek to resolve the objection in good faith; if it cannot be resolved, the Customer may terminate the affected part of the Service by written notice without penalty, and the Processor shall refund the fees paid for the unused remainder of the then-current Subscription Period.
9.4 The Processor shall impose on each Sub-processor, by written contract, data protection obligations no less protective than those set out in this DPA, and remains fully liable to the Customer for the performance of each Sub-processor’s obligations.
10.1 The Processor Processes Personal Data in the Republic of Korea. By Commission Implementing Decision (EU) 2022/254 of 17 December 2021, reviewed and confirmed by the European Commission on 23 July 2026, the Republic of Korea ensures an adequate level of protection for personal data transferred from the European Union. Transfers of Personal Data from the EEA to the Processor and to the Sub-processors listed in clause 9.2 are made on the basis of that adequacy decision and require no further transfer mechanism under Chapter V GDPR.
10.2 The Processor shall not transfer Personal Data to, or permit access to Personal Data from, any country outside the EEA other than the Republic of Korea without first implementing a valid transfer mechanism under Chapter V GDPR and giving notice under clause 9.3.
10.3 If the adequacy decision referred to in clause 10.1 is suspended, repealed or declared invalid, the parties shall without undue delay implement the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two, controller to processor), which shall be deemed incorporated into this DPA upon that event, with Annex I completed by the Parties clause and clause 4 of this DPA, Annex II by the document referred to in clause 8.2, and Annex III by clause 9.2.
11.1 Taking into account the nature of the Processing, the Processor shall assist the Customer by appropriate technical and organisational measures, insofar as reasonably possible, in fulfilling the Customer’s obligation to respond to requests from Data Subjects under Chapter III GDPR.
11.2 If the Processor receives a request from a Data Subject relating to Personal Data Processed under this DPA, it shall promptly refer the request to the Customer and shall not respond except on the Customer’s documented instructions or as required by law. Where the Data Subject is a patient of the Customer, the parties acknowledge that the request is for the Customer, as the party responsible for the clinical record, to answer.
11.3 Taking into account the nature of the Processing and the information available to it, the Processor shall provide reasonable assistance to the Customer with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a Supervisory Authority.
11.4 Assistance under this clause is limited to information and measures reasonably available to the Processor. It does not require the Processor to disclose source code, security-sensitive architecture, trade secrets, or information relating to its other customers. The Customer shall reimburse the Processor’s reasonable costs for assistance that goes beyond the ordinary scope of the Service.
12.1 The Processor shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Personal Data Processed under this DPA.
12.2 The notification shall describe, to the extent known, the nature of the breach including the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and a contact point. Where that information is not all available at the time of notification, the Processor shall provide it in phases as it becomes available.
12.3 The Processor shall investigate the breach, take reasonable steps to contain and remediate it, and cooperate reasonably with the Customer’s obligations to notify a Supervisory Authority and affected Data Subjects. The Processor shall not make such a notification on the Customer’s behalf unless required by law or instructed by the Customer.
12.4 This clause does not apply to unsuccessful attempts or activities that do not compromise Personal Data, and notification is not an acknowledgement of fault or liability.
13.1 The Processor shall make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including its then-current Technical and Organisational Measures document and any completed security questionnaires or independent assessment reports it holds.
13.2 Where the information provided under clause 13.1 does not reasonably satisfy an audit right the Customer has under Data Protection Law, or following a Personal Data Breach, or where required by a Supervisory Authority, the Customer or an independent auditor it mandates may audit the Processor’s compliance with this DPA, subject to: at least thirty (30) days’ written notice; no more than one audit in any twelve-month period, except where required by a Supervisory Authority or following a Personal Data Breach; the scope, timing and confidentiality controls being agreed in advance; the audit taking place during business hours and without unreasonable interference with the Processor’s operations; the auditor not being a competitor of the Processor and being bound by confidentiality; and no access being given to the data or systems of other customers. The Customer shall bear its own costs and reimburse the Processor’s reasonable time and expenses, except where the audit is required by Data Protection Law or follows a Personal Data Breach caused by the Processor.
13.3 The Processor shall permit access by a Supervisory Authority to the extent required by applicable law.
14.1 While the Terms are in force, the Processor deletes Personal Data in the course of providing the Service as follows: audio is deleted on completion of conversion and is in no event retained for longer than four (4) hours; the draft text is deleted from the Service once the Customer has transferred it to its own systems.
14.2 At the end of the provision of the Service, the Processor shall, at the Customer’s choice, delete or return all Personal Data Processed under this DPA and delete existing copies, unless Union or Member State law requires continued storage. Where no choice is communicated within thirty (30) days of termination, the Processor shall delete the Personal Data.
14.3 Deletion shall be completed within thirty (30) days of the Customer’s request or of the expiry of the period in clause 14.2, except that Personal Data held in backup systems is deleted in the ordinary course of the Processor’s backup rotation. Until that deletion is complete, such Personal Data remains subject to this DPA, is protected by the measures referred to in clause 8, is isolated from active Processing, and is not Processed for any other purpose. The Processor shall confirm the applicable backup retention period on request.
14.4 The Processor shall confirm deletion in writing on request.
15.1 Each party’s total aggregate liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to and included within the limitations and exclusions of liability set out in the Terms.
15.2 Nothing in this clause limits a Data Subject’s rights against either party under Data Protection Law, or any liability that cannot lawfully be limited.
16.1 This DPA takes effect when the Terms take effect and remains in force until the Processor has ceased all Processing of Personal Data on the Customer’s behalf and completed its obligations under clause 14, notwithstanding the expiry or termination of the Terms.
16.2 The Processor may amend this DPA on at least thirty (30) days’ written notice where the amendment is required for the parties to remain compliant with Data Protection Law, or to reflect operational or security-related changes to the Service, provided that no amendment materially reduces the protection afforded to Personal Data. Any other amendment requires the written agreement of both parties.
16.3 The Processor’s representative in the European Union under Article 27 GDPR is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. Notices under this DPA may be sent to contact@medipencil.com.
16.4 This DPA is governed by the law governing the Terms, and any dispute shall be resolved in accordance with the dispute resolution provisions of the Terms.
16.5 This DPA may be made available in languages other than English. In the event of any inconsistency, the most current English version prevails.
Last updated: October 30, 2026