End User License Agreement
Last Updated: October 23, 20252
This End User License Agreement (“EULA”) for Quibim Software that is accessible through any platform offered by Quibim from time to time or that is provided as a standalone solution, is by and between QUIBIM, S.L. (“Quibim”) and the end user customer (“Customer” or “You”) identified on the agreement, order form, and/or license quotation (the “Quotation”) between You and Quibim and/or between You and any Quibim Associates. This EULA is a binding contract that governs Your use of and access to the Software. Capitalized terms used in this EULA that are not defined shall have the meanings ascribed to such terms in the Quotation. When used herein the term “Agreement” includes the body of this EULA, all Quotations between the parties, all attachments thereto or referenced herein, and Quibim’s privacy policy available here.
IMPORTANT – READ CAREFULLY: PLEASE READ THIS EULA CAREFULLY BEFORE PURCHASING OR ACQUIRING A LICENSE AND/OR ACCESSING OR USING THE SOFTWARE BECAUSE IT CONSTITUTES A BINDING LEGAL AGREEMENT BETWEEN YOU, THE END USER, AND QUIBIM. IF YOU DO NOT AGREE TO THE TERMS OF THIS EULA, QUIBIM IS NOT WILLING TO GRANT ANY RIGHT TO USE OR ACCESS THE SOFTWARE TO YOU.
BY INSTALLING THE SOFTWARE, CLICKING ON THE “ACCEPT” BUTTON DURING THE SETUP PROCESS OF THE SOFTWARE, ENTERING AN ELECTRONIC LICENSE KEY, AGREEING TO AN QUOTATION THAT REFERENCES THIS EULA, OR OTHERWISE USING AND/OR ACCESSING THE SOFTWARE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THE EULA, AGREE TO COMPLY WITH IT, AND AGREE TO BE BOUND BY ITS TERMS AND THE TERMS OF THE QUOTATION. IF YOU ARE ENTERING INTO THIS EULA ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT AND WARRANT THAT YOU HAVE FULL AUTHORITY TO BIND SUCH ENTITY AND ITS AFFILIATES TO AGREE TO THIS EULA, IN WHICH CASE THE TERM “CUSTOMER” OR “YOU” OR “YOURS” SHALL HEREAFTER REFER TO SUCH ENTITY.
IF YOU DO NOT HAVE THE AUTHORITY TO BIND YOURSELF OR YOUR ORGANIZATION AND ITS AFFILIATES TO THIS EULA, OR IF YOU DO NOT AGREE WITH THESE TERMS AND CONDITIONS, YOU ARE HEREBY NOT PERMITTED AND MAY NOT USE THE SOFTWARE (OR ANY OTHER TECHNOLOGY, SERVICES, CONTENT, OR PRODUCTS OFFERED BY QUIBIM) IN ANY MANNER. IF YOU ARE NOT WILLING TO BE BOUND BY ALL THE TERMS OF THIS EULA, OR ARE NOT AUTHORIZED TO ACCEPT THIS EULA IN ITS ENTIRETY, DO NOT COMPLETE THE INSTALLATION OF THE SOFTWARE, DO NOT ACCESS OR USE THE SOFTWARE, AND PROMPTLY CONTACT QUIBIM OR THE QUIBIM ASSOCIATE WHO GRANTED THE ACCESS TO THE SOFTWARE TO YOU.
QUIBIM RESERVES THE RIGHT TO ADD, MODIFY OR OTHERWISE AMEND AT ANY TIME THE TERMS AND CONDITIONS OF THIS EULA. IF YOU DO NOT AGREE TO ANY OF THE CHANGES YOU CAN END YOUR LICENSE BY NOT RENEWING OR AS OTHERWISE OUTLINED IN THE QUOTATION OR THIS EULA, STOPPING USE OF THE SOFTWARE AND UNINSTALLING THE SOFTWARE. IF YOU RENEW YOUR LICENSE, YOU ACCEPT THE MOST RECENT VERSION OF THIS EULA. IF YOU HAVE ACCEPTED MORE THAN ONE VERSION, THE MOST RECENT VERSION WILL REPLACE ALL OLDER VERSIONS.
1. Definitions
Defined terms shall have the same meaning as given to them in the Agreement, unless specifically defined otherwise in this EULA, such as:
- “Data Protection Legislation”: means to the extent applicable, (i) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC; (ii) Spanish Act 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights; (iii) the Data Protection Act 2018 and EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018; (iv) US state consumer data privacy laws, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100 to 1798.199.100), together with the CCPA Regulations (Cal. Code Regs. tit. 11, §§ 7000 to 7102) which may be amended from time to time; (v) HIPAA, as defined below; and (vi) any other data protection legislation applicable under this Agreement.
- “Data”: means the medical image, information, annotation, health indicator, measurement, comment or other data.
- “De-Identified Data”: means Data that has been de-identified and/or anonymized as required to no longer be regulated by applicable Data Protection Legislation.
- “Fees”: means the consideration to be paid by you to Quibim or to the respective Quibim Associate for use of the Software as set forth in the Agreement.
- “HIPAA”: means the Health Insurance Portability and Accountability Act and its implementing regulations.
- “License”: means the license granted by virtue of this EULA according to the provisions in Section 2.1.
- “Quibim”: is a Spanish company, with registered office in Valencia (Spain), Edificio Europa, located in Avenida Aragón, 30 (13th floor), office I-J, 46021, and registered at the Valencia Commercial Registry in volume 9,539, book 6,821, sheet 185, page V-150.890 and with taxpayer identification number B-98.481.658, and/or any of its subsidiaries, including Quibim, Inc. and Quibim, Ltd.
- “Quibim Associate”: means any affiliate, distributor, retailer or any third party authorized by Quibim to distribute, install, or sell licenses of or subscriptions to the Software.
- “Software”: means the Quibim software products and services including the artificial intelligence (“AI”) modules developed by Quibim or its licensors and/or any proprietary platform developed by Quibim, and all portions, modules, functions, Updates, Upgrades, modifications, and derivatives thereof or thereto.
- “Term” or “License Term”: means the period of time stipulated in the Agreement when the License will be effective.
- “Updates”: means patches, workarounds, corrections, or other updates to the Software that Quibim may make available. Updates do not alter the overall Version of the Software and are considered part of the Software licensed under this Agreement at no additional charge. Updates shall not include any Upgrade that Quibim may license (or not) separately. For the purposes of this Agreement, “Version” shall refer to a specific state or release of the Software, identified in accordance with Quibim’s semantic versioning system (Major.Minor.Patch). Any breaking changes, as indicated by an increment in the major/minor version number, or any substantial functional change in a key feature of the Software, shall be considered an Upgrade.
- “Upgrades”: refers to major changes to the Software that Quibim may, at its sole discretion, implement, or introduce significant improvements, additions, or modifications to one or more of its relevant features or components.
2. License
2.1 Grant of License: Subject at all times to the terms set forth in this EULA and the Agreement, including Your payment of all Fees, during the applicable License Term, Quibim hereby grants to You a limited, non-exclusive, revocable (in accordance with this EULA and the Agreement), non-transferable, non-sublicensable subscription license for You and Your End Users to access to and use the Software identified in the Quotation only for Your internal business purposes of processing Data (the “License”). For purposes of the Agreement, “End Users” means Customer’s employees, contractors, representatives, clinicians, practitioners, and health care professionals, as applicable, providing clinical care and medical services who are authorized to access and use the Software on Customer’s behalf. Customer may, as agreed to in writing by Quibim, offer access to the Software to any affiliates, subsidiaries, parent corporations, or affiliate entities and Customer shall be responsible and liable for all access and use by such entities.
2.2 Restrictions: Customer and its End Users may only use the Software as described in the Agreement and in the then-current user manuals, documentation, specifications, and instructions regarding the Software made generally available by Quibim to its customers and modified from time to time (the “Documentation”). Customer is responsible for ensuring its End Users comply with all relevant terms of the Agreement, and any failure to comply with the Agreement by an End User will constitute a breach by Customer. As a condition of the License, except as expressly authorized by the Agreement, You shall not and shall not allow any End User or other third party to: (i) permit access to the Software or any portion thereof, except to an End User as expressly authorized by this EULA; (ii) modify the Software, create derivative works based upon Software, or adapt, copy, translate, alter, or embed into any other service or product with or into the Software; (iii) reverse engineer or decompile, decrypt, disassemble or otherwise reduce the Software to human-readable form or otherwise attempt to derive the source code or trade secrets for or embodied in the Software, except to the extent expressly permitted by applicable law; (iv) access to and use the Software in a manner that violates any applicable laws, including using the Software, or allowing the transfer, transmission, export, or re-export of the Software, in violation of any export control laws or regulations administered by the U.S. Commerce Department or any other government agency; (v) distribute, sell, license, rent, lease, share or otherwise provide access to the Software to any third parties or in benefit of any third parties; (vi) access the Software perform services for third parties; (vii) access or use the Software for purposes of monitoring its availability or performing any performance, functional or security evaluation, or for any other benchmarking or competitive purpose without the prior written approval of Quibim, or release, publish, and/or otherwise make available to any third party the results of any such approved evaluation of the Software; (viii) use the Software or any Quibim Confidential Information to develop a competing product or service or build a product using similar ideas, features, functions, or graphics of the Software; (ix) alter, remove, minimize, block, or modify any copyright, trademark, proprietary rights, disclaimer, digital watermark, or warning notices or legends contained on or in the Software or Documentation; or (x) engage in any activity that disrupts or otherwise interferes with the integrity, performance, or other proper function of the Software or Data or any servers, technology, equipment, and/or network infrastructure, provided and/or made accessible by Quibim or through the Software or otherwise use connection with same. Customer may use the Software only for its internal business purposes and shall not: (a) run any auto-responder or send spam or otherwise duplicative or unsolicited messages; (b) send or store infringing, obscene, threatening, libelous, or otherwise unlawful or tortious material, including material harmful to children or that violates a third-party’s privacy rights; (c) send or store material containing software viruses, worms, Trojan horses, or other harmful computer code, files, scripts, agents, or programs; or (d) attempt to gain unauthorized access to Software or its related systems or networks. Under no circumstances will Quibim be liable or responsible for any use, or any results obtained by the use, of the Software in conjunction with any data, content, services, software, or hardware that are not provided by Quibim, including any services or advice provided by Customer and its applicable End Users, including health care services, insurance claims processing, or medical advice, where applicable. All such use will be at Customer’s sole risk and liability and Customer, and not Quibim, shall be solely responsible for its provision of health care services, insurance claims processing, and medical advice. Quibim reserves the right to modify the Software for any reason, without notice and without liability to Customer or any End User, to comply with applicable law.
Any attempt to engage in any of the activity prohibited under this Section 2.2 shall be deemed as a material breach of the Agreement.
2.3 Customer Responsibilities: Customer and its End Users shall be responsible for obtaining and maintaining any equipment and ancillary services needed to connect to, access, or otherwise use the Software, including hardware, devices, software, operating systems, networking, web servers, telecommunication and Internet connections, and the like. Customer shall also be responsible for maintaining the security of the foregoing equipment and services and Customer login information, passwords, and files. Customer is responsible for all uses of Customer and End User accounts with or without Customer’s knowledge or consent.
2.4 Customer Data: Customer is responsible for all Data that Customers or its End Users place on, process through, or generate through use of the Software. Quibim does not endorse, approve, monitor, or vet any Data placed on or generated through the Software or otherwise made available through or to Quibim or the Software in any way. All Data is the responsibility of Customer, and Quibim shall not be liable for any reason for the contents, legality, appropriateness, accuracy, integrity, or use of any Data.
3. Intellectual Property Rights
3.1 Ownership: The Software is proprietary to Quibim and is protected under applicable intellectual property laws, including copyright, patents, trademarks, know-how, and trade secret laws. You further acknowledge and agree that, as between You and Quibim, Quibim owns and shall continue to own all right, title, and interest in and to (i) the Software, all improvements, enhancements, customizations, configurations, or modifications thereto, (ii) any software, applications, inventions, algorithms, or other technology developed in connection with the provision or use of the Software or support and maintenance, (iii) any and all ideas, processes, techniques, designs, architecture, and “know-how” embodying the Software, (iv) the Documentation, and (e) and any and all associated intellectual property rights related to any of the foregoing.
Under no circumstances will You be deemed to receive title to any portion of the Software, title to which at all times will vest exclusively in Quibim. This is not a “work made for hire” agreement, as that term is defined in Section 101 of Title 17 of the United States Code. The Agreement does not grant You any ownership or interest in or to the Software and/or any associated intellectual property rights except for the limited License set forth herein. You will preserve the Software from any liens, encumbrances, and claims of any individual or entity. You will not use any Quibim intellectual property, data, or Confidential Information to contest the validity of any intellectual property rights of Quibim or its licensors, and any such use of the foregoing will constitute a material, non-curable breach of the Agreement.
You acknowledge and agree that any feedback, suggestions, comments, improvements, modifications and any other information that You may provide to Quibim relating to the Software or its performance or Your use of or output from the Software (“Feedback”) may be used, disclosed, disseminated, protected under intellectual property rights, and/or published by Quibim for any purpose, including incorporating such information in improvements to the Software, without obligation of any kind to you, and that you waive any rights whatsoever in or to such information. Feedback is voluntary and does not constitute Your Confidential Information. Similarly, Quibim may use any technical information it derives from providing its products and services relating to problem resolution, troubleshooting, product functionality, enhancements, and fixes, for its knowledge base. To the extent a license is required under Your intellectual property rights to make use of the Feedback, Customer grants Quibim an irrevocable, non-exclusive, perpetual, fully-paid-up, royalty-free license to use the Feedback in connection with Quibim’s business, including the enhancement of Quibim’s products and services.
3.2 Consent to Use of Data: As between You and Quibim, You are the full owner of any Data uploaded, submitted, stored, dropped, shared, or generated as output by you into or through the Software. You hereby grant Quibim a non-exclusive, royalty-free, transferable, sub-licensable, worldwide license (i) to use the Data during the License Term for the purposes of performing the Agreement and providing the Software and the services provided by Quibim, and (ii) to use, host, reproduce, copy, distribute, communicate and modify the De-Identified Data (in accordance with Section 5 “Privacy”) for the purpose of operating and improving the services provided by Quibim (including for marketing purposes) and the Software and for developing new or existing technologies and methodologies owned or controlled by Quibim during the Term and thereafter in perpetuity. You acknowledge and agree that the provision and operation of the Software under the Agreement includes and requires the use of the De-Identified Data for the purposes of continuously improving the Software itself and its underlying technology. Quibim’s provision of Software includes the use of De-Identified Data for the purpose of artificial intelligence, machine learning, augmented human intelligence development, algorithm development and improvement, and similar data aggregation activities. This involves creating algorithms that help Quibim systems to learn from the De-Identified Data and improve the Software and related services, and to improve the efficiency of Quibim operations. You shall retain a copy of the Data outside the Software.
3.3 Usage Data: Quibim shall have the right to collect, copy, and analyze data and other information relating to the provision, use, and performance of various aspects of the Software and related systems and technologies (including de-identified or anonymized information concerning Data and data derived therefrom), and Quibim may (i) use such de-identified or anonymized information and data to improve and enhance the Software and for other development, diagnostic, and corrective purposes in connection with the Software and other Quibim offerings, and (ii) disclose such data solely in aggregated or other de-identified form in connection with its business. No rights or licenses are granted except as expressly set forth herein.
3.4 Third Party Material: The Software may contain, provide access to, or be provided with information, data, software, including open-source libraries, components, utilities and other open-source software, provided or developed by third parties (“Third Party Material”). Quibim does not control Third Party Material and is not responsible for its content. Quibim’s inclusion of Third-Party Material in the Software does not imply any endorsement of the information and Quibim makes no representations or warranties with respect to any Third-Party Material. Third Party Material may have separate applicable license terms. Use of Third-Party Material shall be subject to the applicable license terms and conditions to the extent required by the applicable licensor (which terms may contain additional rights and/or obligations) and You agree to comply with such additional licensing terms and conditions. Quibim shall not be liable for any breach and/or non-compliance on Your part in this regard.
4. Support and Maintenance Services
4.1 Quibim and/or Quibim Associates are the only parties authorized to provide support services in relation the Software and will use commercially reasonable efforts to provide support to You in the event incidents occur regarding the availability, functioning, performance, and/or access to and use of the Software, according to the conditions set forth in the Documentation and Service Level Agreement available here.
4.2 If an error occurs (meaning any defect which materially affects the availability, functioning, and/or performance of the Software), You agree to promptly notify Quibim and/or the relevant Quibim Associate in writing, in accordance with the then-current support Documentation made available to You. Quibim and/or Quibim Associates will use commercially reasonable efforts to correct reproducible failures of the Software to perform in substantial accordance with its then current Documentation. While resolving the error, Quibim and/or Quibim Associates, at their sole discretion, may implement temporary workaround solutions in order to circumvent the error for the time being. Any such workarounds are part of and included in the definition of Software under the Agreement.
4.3 Where access to Your systems is required for the purpose of performing the maintenance services, You shall ensure that such access will be granted to Quibim and/or Quibim Associates promptly. You will similarly provide Quibim with all access and information reasonably requested by Quibim in connection with the support and maintenance activities contemplated by the Agreement. You acknowledge that lack of access to your systems or lack of cooperation by You or Your End Users in connection with Quibim’s the support and maintenance services could prevent or delay Quibim from correcting the error or otherwise providing access to the Software. In those cases, Quibim shall not be considered liable to You for Your inability to use the Software or for any issues giving rise to the need for the required maintenance.
4.4 Quibim and/or Quibim Associates may implement any Updates and/or Upgrades in the Software that, in its sole discretion, are necessary or appropriate to enable proper functioning of the Software, improve the Software, or to avoid or mitigate any risk associated with the Software, Quibim’s operations, or the operations of Quibim’s customers, suppliers, or licensors. For the avoidance of doubt, Quibim and/or Quibim Associates shall have no obligation to provide Updates and/or Upgrades to You. In particular, all Upgrades shall be subject to separate terms and conditions to be mutually agreed upon by You and Quibim, which may include an adjustment to the applicable Fees.
5. Privacy
5.1 You are responsible for obtaining all licenses, consents, and authorizations, and providing any notices, that may be required with regards to Data to be uploaded to, or processed by, the Software or as otherwise provided by the Agreement, as well as for the compliance with all applicable laws and regulations, including the Data Protection Legislation.
5.2 Notwithstanding the above, in the event that Quibim, in the context of your use of the Software, has access to protected health information or personal data controlled by you, Quibim shall be considered the processor of said personal data and/or a HIPAA business associate with regard to said protected health information, as applicable, and such data processing activity shall be governed, in accordance with all applicable Data Protection Legislation, by the Data Processing Agreement attached hereto as Schedule 5.2(A) and/or Business Associate Agreement attached hereto as Schedule 5.2(B), respectively. You shall indemnify and hold Quibim harmless from any liability arising from the infringement or a breach of this Section 5.
5.3 Quibim shall be entitled to use, disclose, and otherwise process the De-Identified Data for its own purposes and in particular to improve the Software and develop new or existing technologies (e.g., to train algorithms in order to keep its database permanently updated), and for any other purpose permitted by law, on the basis that You have complied with all legal requisites to disclose the Data to Quibim. As recognized by you, this further processing of De-Identified Data by Quibim results in the constant improvement of the services provided by Quibim and the Software and for developing new or existing technologies and methodologies owned by Quibim.
6. Term and Termination
6.1 Term: This EULA and the License shall remain effective for the License Term as provided in the Quotation unless earlier terminated in accordance with the Agreement. This EULA is entered into as of the earlier of the date that you accept the Quotation (which incorporates by reference the EULA herein) or this EULA, or first accessing or using the Software (whichever happens first). Except as otherwise set forth in a Quotation, each Quotation will renew automatically for the same initial License Term set forth in the Quotation, unless either party provides thirty (30) days’ notice of non-renewal.
6.2 Default: Each party shall have the right to terminate the Agreement upon thirty (30) days written notice (or with ten (10) days’ notice in the case of non-payment) in the event the other party materially breaches any provision hereof and fails to cure such breach in the foregoing notice period. The Agreement may be terminated upon written notice by either party, immediately, if (i) a receiver is appointed for the other party or its property, (ii) the other party becomes insolvent or unable to pay its debts as they mature in the ordinary course of business, makes a general assignment for the benefit of its creditors, or suspends the transaction of its usual business for a period in excess of thirty (30) days, (iii) any proceedings (whether voluntary or involuntary) are commenced against the other party under any bankruptcy or similar law and such proceedings are not vacated or set aside within sixty (60) calendar days from the date of commencement thereof, or (iv) either party is listed by a federal agency as being disbarred, excluded, terminated, or otherwise ineligible for federal program participation.
6.3 Suspension: Quibim may, in its sole discretion, immediately suspend or terminate Your access to the Software for any of the following reasons: (i) to prevent damages or risk to, or degradation of, the Software; (ii) to comply with any law, regulation, court order, or other governmental request; (iii) to otherwise protect Quibim from potential legal liability; (iv) if You fail to comply with any of the provisions of Section 2.2 the Agreement; or (v) in the event an invoice remains unpaid for more than forty-five (45) days from the invoice date. Quibim can make such determination in its own discretion, without Your prior consultation, without liability to You and at any time. Quibim will promptly notify You of any suspension (by email) and will restore access to the Software upon resolution of the event giving rise to suspension. This Section will not be construed as imposing any obligation or duty on Quibim to monitor use of the Software.
6.4 Effect of Termination: Upon termination or expiration of the Agreement for any reason, (i) the rights and licenses granted herein to You shall terminate, (ii) You shall immediately cease accessing and using the Software; (iii) Quibim will cease to provide the Software; (iv) all Fees will be accelerated and You will pay to Quibim all Fees due through the scheduled expiration of the then-current Quotation; (v) at Customer’s request, made no more than thirty (30) days following termination or expiration, Quibim will provide or make available to You for download, a copy of the Data or will otherwise delete the Data, as per Section 5 above, and will thereafter have no further obligations to maintain or provide the Data.
6.5 Sections 3, 5, 6.4, 7.4, and 8 through 11 and all liabilities that accrue prior to termination or expiration of the Agreement shall survive any termination or expiration of this EULA and/or the Agreement.
7. Representations, Warranties and Disclaimers
7.1 Customer Warranties: Customer represents and warrants that: (i) it has full power, capacity, and authority to enter into the Agreement and to make the grant of rights set forth therein; (ii) the Data does not and will not infringe the intellectual property, publicity, or privacy rights of any person and is not defamatory, obscene, or in violation of applicable international, foreign, federal, state, or local laws, rules, or regulations (including applicable policies and laws related to spamming, privacy, or consumer protection) (collectively, “Applicable Law”); (iii) its use of the Software will be in compliance with all Applicable Law; (iv) neither Customer nor any End Users shall make any representations with respect to Quibim, the Software, or the Agreement (including that Quibim is a warrantor or co-seller or provider of any Customer services); (v) all information provided by Customer or its End Users to Quibim during implementation and registration is complete and accurate information and that Customer shall keep such information up-to-date at all times during the License Term; and (vi) neither Customer nor any of its respective officers, directors, employees, or contractors is or has ever been: (a) convicted of a criminal offense related to health care or the provision of items and services payable by a federal or state health care program (for example, Medicare and Medicaid); (b) assessed civil money penalties for an offense related to health care or to the provision of items or services payable by a federal or state health care program; (c) excluded from participation in any federal or state health care program; or (d) excluded by any federal agency from receiving federal contracts. Customer shall notify Quibim immediately of any breach of any representation or warranty in this Section or any other Section under the Agreement or of any information or situation which could reasonably lead to a breach of this Section.
7.2 Quibim Warranties: Quibim represents and warrants that (i) it has the full power, capacity, and authority to enter into and perform the Agreement and to make the grant of rights contained in this EULA, (ii) the Software will materially conform to the specifications described in the relevant Documentation; (iii) it shall use commercially reasonable efforts to screen the Software for viruses, Trojan horses, worms, and other similar intentionally harmful or destructive code; and (iv) it shall comply with Applicable Law in performing the Agreement. In case the Software does not materially conform to the specifications described in the relevant Documentation, Your sole and exclusive remedy and the entire liability of Quibim and Quibim Associates under this limited warranty will be, at Quibim’s option, repair the Software or, in the event Quibim is unable through reasonable efforts to repair the Software within ninety (90) calendar days from receipt of notice from You of the failure of the Software to comply with the warranty, You may elect to terminate the Agreement and receive a pro-rated refund of any pre-paid, unused recurring fees for the non-conforming aspect of the Software.
7.3 Warranty Exclusions: The express limited Quibim warranty specified above does not apply if the Software or any portion of the foregoing: (i) has been altered, except by Quibim; (ii) has not been used, installed, operated, repaired, or maintained in accordance with this EULA, the Quotation and/or Documentation; or (iii) is used on equipment, products, or systems not meeting specifications identified by Quibim. Additionally, the limited warranty set forth herein only applies when notice of a warranty claim is provided to Quibim promptly and in any case within thirty (30) days after Customer becomes aware of the applicable defect and does not apply to any bug, defect, or error caused by or attributable to Third Party Materials or any software or hardware not supplied by Quibim.
7.4 DISCLAIMERS: EXCEPT FOR THE WARRANTIES EXPRESSLY SET FORTH IN SECTION 7.2, THE SOFTWARE IS PROVIDED “AS IS”, “WHERE IS” AND “AS AVAILABLE” WITH ALL FAULTS, AND WITHOUT WARRANTIES OF ANY KIND. EXCEPT FOR THE WARRANTIES EXPRESSLY SET FORTH IN SECTION 7.2, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, QUIBIM AND QUIBIM ASSOCIATES AND THEIR RESPECTIVELY LICENSORS AND VENDORS MAKE NO REPRESENTATIONS, WARRANTIES OR GUARANTEES OF ANY KIND OR NATURE, WHETHER EXPRESS OR IMPLIED, REGARDING THE SOFTWARE, AND SPECIFICALLY DISCLAIM ALL SUCH WARRANTIES, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, QUALITY OF INFORMATION, OR NON-INFRINGEMENT. WITHOUT LIMITING THE PREVIOUS DISCLAIMER, QUIBIM AND ITS LICENSORS DO NOT REPRESENT, WARRANT OR GUARANTEE THAT THE SOFTWARE: (I) WILL OPERATE IN AN UNINTERRUPTED, TIMELY, SECURE OR ERROR-FREE MANNER OR MEET CUSTOMER REQUIREMENTS; (II) WILL ALWAYS BE AVAILABLE OR FREE FROM ALL HARMFUL COMPONENTS OR ERRORS OR THAT ALL ERRORS WILL BE CORRECTED; (III) WILL BE SECURE OR IMMUNE (INCLUDING THE DATA, THE CONTENT DELIVERED TO YOU OR THE INFORMATION YOU PROVIDED) FROM UNAUTHORIZED ACCESS OR MALICIOUS ATTACKS (IV) WILL BE COMPATIBLE WITH ANY PARTICULAR HARDWARE OR SOFTWARE. FURTHERMORE, QUIBIM DOES NOT WARRANT OR MAKE ANY REPRESENTATION REGARDING THE USE OR THE RESULTS OF THE USE OF THE SOFTWARE IN TERMS OF THEIR CORRECTNESS, ACCURACY, QUALITY, RELIABILITY, SECURITY, APPROPRIATENESS FOR A PARTICULAR TASK OR APPLICATION, CURRENTNESS, OR OTHERWISE. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY QUIBIM OR QUIBIM’S AUTHORIZED REPRESENTATIVES SHALL CREATE A WARRANTY OR IN ANY WAY INCREASE THE SCOPE OF THIS WARRANTY. THE SOFTWARE MAY BE USED TO ACCESS AND TRANSFER INFORMATION OVER THE INTERNET. CUSTOMER ACKNOWLEDGES AND AGREES THAT QUIBIM AND ITS VENDORS AND LICENSORS DO NOT OPERATE OR CONTROL THE INTERNET AND THAT: (A) VIRUSES, WORMS, TROJAN HORSES, AND OTHER UNDESIRABLE DATA OR SOFTWARE MAY BE TRANSFERRED OVER THE INTERNET; AND (B) UNAUTHORIZED USERS SUCH AS HACKERS MAY ATTEMPT TO OBTAIN ACCESS TO AND DAMAGE CUSTOMER’S DATA, WEBSITES, PROPERTIES, COMPUTERS, OR NETWORKS. QUIBIM WILL NOT BE RESPONSIBLE FOR SUCH ACTIVITIES. THE SOFTWARE INCLUDES AND RELIES UPON THE USE OF ARTIFICIAL INTELLIGENCE AND MACHINE LEARNING AND QUIBIM DOES NOT WARRANT ANY DATA GENERATED THROUGH THE SERVICE WILL BE ACCURATE OR COMPLETE. CUSTOMER IS RESPONSIBLE FOR ENSURING HUMAN REVIEW OF ALL GENERATED DATA AND FOR ALL MEDICAL ADVICE, HEALTH CARE SERVICES, AND INSURANCE CLAIMS PROCESSING MADE BY ITS END USERS. CUSTOMER IS RESPONSIBLE FOR PRESERVING AND MAKING ADEQUATE BACKUPS OF ITS DATA. QUIBIM DOES NOT PROVIDE MEDICAL ADVICE. THEREFORE, QUIBIM DOES NOT ASSUME ANY RESPONSIBILITY FOR ANY INJURY AND/OR DAMAGE TO PERSONS, ANIMALS, OR PROPERTY AS A MATTER OF PRODUCT LIABILITY, MALPRACTICE, FAILURE TO WARN, NEGLIGENCE OR OTHERWISE. PRACTITIONERS AND RESEARCHERS MUST RELY ON THEIR OWN EXPERIENCE, KNOWLEDGE AND JUDGMENT IN EVALUATING OR APPLYING ANY RESULTS OR INFORMATION, WHICH REMAINS THEIR PROFESSIONAL RESPONSIBILITY.
8. Payment
8.1 Fees are subject to change within sixty (60) calendar days prior notice to You. The amount charged in each renewal of the License Term will be the price of the Software (or other services quoted) at the time of renewal, which might differ from the amount You originally paid.
8.2 Except as specifically provided in the Agreement, all fees are non-refundable and all Quotations are non-cancelable. In the event of late payment, Quibim may impose a surcharge equal to 1.5% per month (or such maximum amount permitted by law) of the outstanding amount. If any amount of the invoice is disputed by you, you shall inform Quibim of the grounds for such dispute within seven (7) calendar days from receipt of the relevant invoice and shall pay to Quibim the value of the invoice less the disputed amount in accordance with these payment terms. With regard to the disputed amount, Quibim and You will start negotiations based on good faith to try to resolve the discrepancy.
In case Quibim and You do not reach an amicable agreement within a period of ten (10) calendar days after the beginning of the negotiations, the discrepancy will be resolved according to the dispute resolution procedure set forth in this EULA.
8.3 Fees are not a portion of the professional or other service fees charged by Customer to patients or customers for Customer’s products and services. Fees are due regardless of whether or not Customer has collected fees from its customers, patients, or third-party payors, and shall not be subject to any offset or deduction of any kind for any reason related Customer’s collected fees.
8.4 Customer shall be responsible for those sales, use, and similar taxes associated with its use of the Service, excluding taxes based on Quibim’s real property, personal property, income, or personnel.
8.5 In addition to the early termination provisions provided for in Section 6.2 and 6.3, Quibim may, at any time, terminate the Agreement entered into and cancel the License (given its revocable nature) provided it notifies this intention to You at least thirty (30) calendar days in advance of the termination date. In the event of termination by Quibim under this Section 8.3, Quibim shall return the proportionate part of the annual Fees.
9. Limitation of Liability
9.1 TO THE EXTENT PERMITTED BY LAW, IN NO EVENT SHALL QUIBIM OR QUIBIM ASSOCIATES OR THEIR RESPECTIVE LICENSORS OR VENDORS BE LIABLE TO CUSTOMER, ITS END USERS, OR ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR EXEMPLARY DAMAGES OF ANY KIND OF NATURE OR FOR LOST PROFITS, LOSS OF SALES, TRADING LOSSES, LOSS OF BUSINESS, BUSINESS INTERRUPTION, LOSS OF DATA, OR LOSS OF BUSINESS INFORMATION, ARISING OUT OF OR CONNECTED IN ANY WAY WITH QUIBIM’S PERFORMANCE UNDER THE AGREEMENT, OR USE OF OR INABILITY TO USE THE SOFTWARE, OR FOR ANY CLAIM BY ANY OTHER PARTY WHETHER IN CONTRACT OR TORT (INCLUDING NEGLIGENCE), EVEN IF QUIBIM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
9.2 IN NO EVENT SHALL THE AGGREGATE LIABILITY OF QUIBIM OR QUIBIM ASSOCIATES OR THEIR RESPECTIVE LICENSORS OR VENDORS TO CUSTOMER OR ANY THIRD PARTY ARISING OUT OF OR RELATED TO THE AGREEMENT, INCLUDING WITHOUT LIMITATION, THE USE OF OR INABILITY TO USE THE SOFTWARE, ASSOCIATED SERVICES OR OTHERWISE, IN CONNECTION WITH ANY CLAIM OR TYPE OF DAMAGES, LOSSES, AND CAUSES OF ACTION (WHETHER IN CONTRACT, TORT, OR OTHERWISE) EXCEED THE FEES ACTUALLY PAID BY YOU TO QUIBIM AND/OR QUIBIM ASSOCIATES FOR THE ACCESS TO AND USE OF THE SOFTWARE DURING THE SIX (6) MONTH PERIOD BEFORE THE EVENT GIVING RISE TO THE LIABILITY. THIS LIMITATION WILL APPLY REGARDLESS OF THE THEORY OF LIABILITY, WHETHER BREACH OF CONTRACT, NEGLIGENCE, INFRINGEMENT, OR ANY OTHER THEORY REGARDLESS OF WHETHER OR NOT QUIBIM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF THE EXPRESS WARRANTIES SET FORTH ABOVE FAIL THEIR ESSENTIAL PURPOSE.
9.3 This limitation and waiver also apply to any claims you may bring against any other party to the extent that Quibim would be required to indemnify that party for such claim. Multiple claims shall not expand the limitations set forth in this Section. The foregoing limitations, exclusions, and disclaimers shall apply to the maximum extent permitted by applicable law, in addition to the above warranty disclaimers. Quibim disclaims all liability of any kind of Quibim Associates.
10. Indemnification
10.1 Quibim Indemnity. Quibim agrees to defend, indemnify, and hold harmless Customer and its directors, officers, agents, employees, members, subsidiaries, and successors in interest from and against any third party claim, action, investigation, proceeding, liability, loss, damage, fine, cost, or expense, including attorneys’ fees, experts’ fees, and court costs, arising out of any claim by a third party that Customer’s authorized use of the Software infringes that third party’s patent, copyright, or trade secret. Customer shall: (a) give Quibim prompt written notice of any claim; and (b) allow Quibim to control, and fully cooperate with Quibim (at Quibim’s sole expense) in, the defense and all related negotiations. Quibim shall not enter into any stipulated judgment or settlement that purports to bind Customer without Customer’s express written authorization, which shall not be unreasonably withheld or delayed. Quibim shall have no obligation to indemnify Customer to the extent the claimed infringement arises from or is based on (i) the Data, (ii) use of the Software in combination with any hardware, software, products, data, or other materials not provided by Quibim, or (iii) violation of law or the Agreement by Customer or any End Users. Customer agrees that if its use of the Software becomes, or in Quibim’s opinion is likely to become, the subject of an infringement claim, Customer shall permit Quibim either to procure the right for Customer to continue to use the Software or to replace or modify the Software with technology of comparable quality and performance capabilities to become non-infringing. If in Quibim’s sole discretion, neither alternative is reasonably possible, Quibim may elect to immediately terminate this Agreement and return a prorated portion of any pre-paid, unused fees for the Software . The provisions of this Section 10.1 (Quibim Indemnity) state the sole and exclusive obligations and liability of Quibim and its licensors and suppliers, and Customer’s sole and exclusive remedy for any claim of intellectual property infringement arising out of or relating to the Agreement, and are in lieu of any implied warranties of non-infringement and title, all of which are expressly disclaimed.
10.2 Customer Indemnity. Customer agrees to defend, indemnify, and hold harmless Quibim, Quibim Associates and each of their respective shareholders, officers, directors, employees, agents, members, affiliates, partners, licensors, parents, subsidiaries, distributors and predecessors and successors in interest from and against any third party demand, claim, action, investigation, proceeding, liability, loss, damage, fine, cost, or expense, including reasonable attorneys’ fees, experts’ fees, and court costs incurred by or finally awarded against Quibim indemnitees , arising out of:
-
- Your access to and use of the Software;
- Any use of the Software and resulting reports or output in connection with the treatment and care of patients;
- Any violation by You of the Agreement or applicable law;
- Any Data you upload, submit, post, transmit, storage or otherwise make available through the Software; and/or
- Any violation by You of any rights of any third party, including intellectual property, privacy, or publicity rights.
Quibim shall: (i) give Customer prompt written notice of any claim; and (ii) allow Customer to control, and fully cooperate with Customer (at Customer’s sole expense) in, the defense and all related negotiations. Customer shall not enter into any stipulated judgment or settlement that purports to bind Quibim without Quibim’s express written authorization, which shall not be unreasonably withheld or delayed.
11. General Terms
11.1 Applicable Law: The Agreement governed by, and interpreted or construed in accordance with the laws of Spain and the rules on conflict of laws shall not apply, unless otherwise specified in the Quotation executed by You and Quibim. The parties agree that the United Nations Convention on Contracts for the International Sale of Goods (1980) is specifically excluded from application to the Agreement.
11.2 Jurisdiction: The Parties expressly waive any other jurisdiction to which they may be legally entitled, and expressly submit the resolution of any issues, discrepancies, disputes or claims arising over the execution, interpretation, or performance of the Agreement, including those relating to any non-contractual obligations arising from or related to it, to the jurisdiction of the courts and tribunals of the city of Valencia (Spain), unless otherwise specified in the Quotation executed by You and Quibim.
11.3 Compliance: Each party agrees to comply with all Applicable Laws in performing its obligations hereunder, and Customer agrees that Customer is solely responsible for ensuring its own compliance with all Applicable Laws related to Customer’s business practices, which include the applicable federal and state anti-kickback and self-referral laws and regulations. The parties acknowledge that although Quibim is obligated to provide the Software as specified in the Agreement, there is no obligation of Quibim to refer patients to Customer or any affiliate of Customer, and there is no obligation of Customer to refer patients to any person or business entity. Notwithstanding the unanticipated effect of any of the provisions herein, the Parties intend to comply with 42 U.S.C. § 1320a-7b(b) (commonly known as the Anti-Kickback Statute), 42 U.S.C. § 1395nn (commonly known as the Stark Law) and any other federal or state law provision governing fraud and abuse or self-referrals, as such provisions may be amended from time to time. The Agreement will be construed in a manner consistent with compliance with such statutes and regulations, and the parties hereto agree to take such actions necessary to construe and administer the Agreement accordingly. The parties hereto represent, covenant, and agree that the Fees due to Quibim under the Agreement have been determined through good faith and arm’s length bargaining to be commercially reasonable. The sole purpose of the payments to Quibim hereunder is to pay fair market value for services actually rendered by Quibim to Customer through the Software under the Agreement. No amount paid hereunder is intended to be, nor shall be construed as, an inducement or payment for referral of, or recommending referral of, patients by Quibim (or its employees and agents) to Customer (or its employees or agents) or by Customer (or its employees and agents) to Quibim (or its employees and agents). In addition, Fees charged hereunder do not include any discount, rebate, kickback, or other reduction in charge. The Agreement shall be interpreted and construed at all times in a manner consistent with applicable laws and regulations governing the financial relationships among individuals and entities that provide or arrange for the provision of items or services that are reimbursable by governmental health care programs or other third-party payors.
11.4 Access to Books and Records: To the extent that the provisions of Section 1861(v)(1)(I) of the Social Security Act are applicable to the Agreement, the parties agree to make available, upon the written request of the Secretary of the Department of Health and Human Services or upon the request of the Comptroller General, or any of their duly authorized representatives, the Agreement, and other books, records, and documents that are necessary to certify the nature and extent of costs incurred by them for services furnished under the Agreement. If any services are performed by way of subcontract with another organization and the value or cost of such subcontracted service is Ten Thousand Dollars ($10,000) or more over a twelve (12) month period, such subcontract shall contain and the respective party shall enforce a clause to the same effect as this Section. The availability of the parties’ books, documents, and records shall be subject at all times to all applicable legal requirements, including such criteria and procedures for seeking and obtaining access that may be promulgated by the Secretary. The obligations hereunder shall extend for four (4) years after the furnishing of such services. The parties shall notify each other of any such request for records.
11.5 Independent contractors: The Parties are independent contractors, and the Agreement and/or this EULA shall not establish any relationship of partnership, joint venture, employment, franchise or agency between the parties. You will not be entitled to any benefits applicable to employees of Quibim or Quibim Associates. No party is authorized or empowered to act as agent for any other party for any purpose and will not, on behalf of another party, enter into any contract, warranty or representation as to any matter. No party will be bound by the acts or conduct of any other party.
11.6 Equitable relief: The parties agree that a material breach of the Agreement would cause irreparable injury to Quibim for which there may be no adequate remedy at law. Accordingly, Quibim shall have the right to apply to any court of competent jurisdiction for injunctive relief and specific performance, without prejudice to any remedies available to it at law or in equity.
11.7 Entire Agreement: This EULA and any Quotations hereunder constitute the entire agreement between the parties with respect to the License for the access and the use of the Software. The Agreement supersedes and cancels all previous written and previous or contemporaneous oral communications, proposals, representations, and agreements relating to the subject matter contained herein. The pre-printed, conflicting, or additional terms of any purchase order, ordering document, acknowledgement or confirmation, supplier handbooks, or other documents issued by You, even accepted by Quibim in administering the Software, shall be void and of no force or effect and shall not serve to supplement or modify the Agreement in any manner. The Quotation shall prevail over this EULA to the extent of any irreconcilable conflict or inconsistency between the provisions of the Quotation and this EULA
11.8 EULA modifications: Quibim reserves the right, in its sole discretion, to amend, modify and otherwise change the terms of this EULA at any time. In the event there are material changes to this EULA, Quibim will provide notice to You either by sending You notice, in its sole discretion, either via email or by posting a notice of such changes in a prominent position within the services accessed by You. By continuing to use the Software following changes to the terms of this EULA, You are deemed to have agreed to and accepted such changes hereto.
11.9 Export: The Software, including any technical data provided by Quibim hereunder, may be subject to export, re-export or import control laws under the country of origin, destination or use, including regulations under such laws. You shall comply fully with all international and national laws and regulations that apply to the Software and Your use thereof. Without limiting the generality of the foregoing, You expressly agree that You shall not, and shall cause Your employees to agree not to, export, directly or indirectly, re-export, divert, or transfer the Software or any technical data thereof to any destination, company or person restricted or prohibited by United States laws or regulations, Spanish laws or regulations. or laws or regulations of any other applicable jurisdiction.
11.10 Assignment: Quibim reserves the right, in its sole and absolute discretion, to transfer, assign, sublicense or pledge in any manner whatsoever, any of its rights and obligations under the Agreement to any third party whatsoever, without Your consent and without notice to You. You shall not transfer, assign, delegate, sublicense nor pledge in any manner whatsoever, any of Your rights or obligations under the Agreement except with Quibim’s prior written consent, which may be granted or withheld at Qubim’s option. Any purported assignment, sale, transfer, delegation or other disposition by You, except as permitted herein, will be null and void. All the terms and provisions of the Agreement will be binding upon and inure to the benefit of the parties, their successors, assigns, and legal representatives.
Some or all aspects of the Software may be provided by Quibim’s affiliates, agents, subcontractors, and information system vendors or by Quibim Associates. The rights and obligations of Quibim may be, in whole or in part, exercised or fulfilled by the foregoing entities.
11.11 Force Majeure: Quibim will not be deemed in default of the Agreement to the extent that performance of its obligations or attempts to cure any breach are delayed or prevented by reason of any natural disaster, accident, riots, acts of government, acts of war or terrorism, shortage of materials or supplies, failure of transportation or communications or of suppliers of goods or services, or any other cause beyond the reasonable control of Quibim.
11.12 Severability: If any term or provision of the Agreement is held to be void or unenforceable by any judicial or administrative authority, such determination shall not affect the validity of enforceability of the remaining terms and provisions of the Agreement. The remaining provisions of the Agreement shall remain in effect and shall be construed in accordance with its terms.
11.13 Headings: The headings contained in the Agreement, including this EULA are for reference purposes only and shall not affect the meaning or interpretation of the Agreement. Unless otherwise expressly stated, the words “herein,” “hereof,” and “hereunder” and other words of similar import refer to the Agreement as a whole and not to any particular Section, Subsection, or other subpart. The words “include,” “includes,” “included,” “including,” “without limitation,” or the phrase “e.g.” shall not be construed as terms of limitation and shall, in all instances, be interpreted as meaning “including, but not limited to.”
11.14 No waiver: All waivers hereunder must be made in writing by a duly authorized representative of the Party against whom the waiver is to operate. The failure of Quibim to enforce at any time any of the provisions of the Agreement, or the failure by Quibim to require at any time performance by You of any of the provisions of the Agreement, shall in no way be construed to be a present or future waiver of such provisions, nor in any way affect the right of Quibim to enforce such provision thereafter. The express waiver by Quibim of any provision, condition or requirement of the Agreement shall not constitute a waiver of any future obligation to comply with such provision, condition or requirement.
11.15 Confidentiality:
i. Both parties shall treat all non-public, proprietary data, information and documents provided by the other party (the “Confidential Information”) as strictly confidential. Each party shall also ensure that its affiliates, managers, employees, agents, and advisers comply with the provisions of this clause. Confidential Information of Quibim includes non-public information regarding features, functionality, and performance of the Software.
ii. Each party authorizes the other party to disclose the existence of the contractual relationship formalized under the Agreement, and to introduce in the market each other as partners and/or clients, if applicable. Said authorization in no way extends to the disclosure of the content of the Agreement itself, which information is subject to the duty of confidentiality provided in this clause.
iii. The receiving party agrees: (i) to take reasonable precautions to protect Confidential Information, and (ii) not to use (except in provision of the Service, or as otherwise permitted herein) or divulge to any third person any Confidential Information. The receiving party may only use or disclose Confidential Information in the following cases:
-
-
- where disclosure of the Confidential Information is required by a judicial or administrative body to which the receiving party is subject;
- where it is necessary for the employees, professional advisers, shareholders, auditors or lenders of the receiving party to use or have knowledge of a certain item of the Confidential Information in connecting with performing the Agreement -provided that its knowledge shall be subject to the appropriate confidentiality agreement or duty-;
- where the disclosing party has given its prior consent in writing to use or disclosure of the Confidential Information; or
- where disclosure of the Confidential Information is necessary to enable the receiving party to enforce the rights to which it is entitled under the Agreement.
-
iv. The disclosing party agrees that the foregoing shall not apply with respect to any information that the receiving party can document (i) is or becomes generally available to the public, (ii) was in its possession or known by it prior to receipt from the disclosing party, (iii) was rightfully disclosed to it without restriction by a third party, (iv) was independently developed without use of any Confidential Information of the disclosing party, or (v) is required to be disclosed by law, provided such disclosure is made in accordance with Section 11.15(iii) above. Each party’s Confidential Information shall remain the sole and exclusive property of that Party.
v. Subject to any perpetual rights provided hereunder, upon termination or expiration of the Agreement, at the disclosing party’s option, the receiving party shall return to the disclosing party or certify as destroyed all Confidential Information of the disclosing party. Notwithstanding the foregoing, the receiving party will not be required to remove copies of the disclosing party’s Confidential Information from its backup media and servers, where doing so would be commercially impracticable. In addition, the foregoing destruction and return obligation will be subject to any retention obligations imposed on receiving party by law or regulation.The duty of confidentiality provided for in this clause shall apply for a term of ten (10) years after the date of signature of the initial Quotation between the parties.
11.16 Notice:Any notice required or permitted to be given in accordance with the Agreement and/or this EULA shall be in writing. Notices to Customer shall be sent by the then-current address on file with Quibim. Notices to Quibim shall be sent by personal delivery, registered or certified mail (return receipt requested, postage prepaid) or commercial express courier (with written verification of receipt) to:
Quibim, S.L.
Headquarters Address: Avenida Aragón, number 30, 13th Floor, 46021 – Valencia (Spain).
Telephone No.: +34 961 243 225
E-mail: quibimlegal@quibim.com
Either party may change its address or designee for notification purposes by giving notice to the other of the new address or designee and the date upon which the change will become effective.
11.17 Legal Fees: If any dispute arises between the parties with respect to the matters covered by the Agreement that leads to a proceeding to resolve such dispute, the prevailing party in such proceeding will be entitled to receive its reasonable attorneys’ fees, expert witness fees, and out-of-pocket costs incurred in connection with such proceeding, in addition to any other relief it may be awarded.
11.18 Agreement Drafted By All Parties: The Agreement is the result of arm’s length negotiations between the parties and shall be construed to have been drafted by all parties such that any ambiguities in the Agreement shall not be construed against either party.
11.19 Counterparts: The Agreement, including any Quotations between the parties, may be executed in one or more counterparts, each of which shall be deemed an original, and will become effective and binding upon the parties as of commencement of the License Term.
11.20 Electronic Signatures: This EULA and any Quotations hereunder may be accepted in electronic form (e.g., by an electronic or digital signature or other means of demonstrating assent) and electronic acceptance will be deemed binding between the parties. Customer acknowledges and agrees it will not contest the validity or enforceability of the Agreement, including under any applicable statute of frauds, because they were accepted and/or signed in electronic form. Customer further acknowledges and agrees that it will not contest the validity or enforceability of an electronically transmitted or signed copy of the Agreement and related documents on the basis that it lacks an original handwritten signature. Electronically transmitted signatures shall be considered valid signatures as of the date hereof. Computer maintained records of a party when produced in hard copy form shall constitute business records and shall have the same validity as any other generally recognized business records.
Schedule 5.2 (A)
Data Processing Agreement
Of the one part, you or your organization, as the “Data Controller”.
And of the other part, Quibim, as above identified, the “Data Processor”.
The Data Controller and Quibim shall hereinafter be jointly referred to as the “Parties” and individually as a “Party”.
The Parties acknowledge each other’s sufficient legal capacity to execute this personal data processing agreement (the “Data Processing Agreement” or “DPA”) and, accordingly,
WHEREAS
- The Parties have subscribed a legal agreement and/or license quotation (the “Quotation”), which incorporates this EULA, to which this Data Processing Agreement is a Schedule, for the granting of the License to access to and use the Software and/or provision of the services described in the Agreement (the “Services”), whereby Quibim must access personal data controlled by the Data Controller to correctly perform such Services.
- Pursuant to the applicable Data Protection Legislation, it is necessary to regulate the data protection obligations assumed by the Parties under the Agreement. Accordingly, to the extent Data Controllers is functioning as a “data controller” as defined in the Data Protection Legislation, Quibim agrees to comply with this DPA.
- Now therefore, in light of the above, the Parties agree to enter into this DPA, which shall be governed by the provisions of article 28 of the GDPR and other applicable Data Protection Legislation and, in particular, the following:
CLAUSES
One.- Object of the Agreement
The object of this Data Processing Agreement is to regulate the Parties’ obligations with regard to the access by Quibim to personal data for which the Data Controller is responsible in order for Quibim to perform its obligations under the Agreement. Quibim may have access to the following categories of personal data:
- Identifying data of patients, employees or collaborators of the Data Controller.
- Special categories of data of the patients of the Data Controller (i.e., Data, as above identified, meaning, medical images, information, annotations, health indicators, measurements, comments or other health-related data).
Data regarding personal characteristics of patients of the Data Controller.
Quibim shall carry out the following types of processing operations on behalf of the Data Controller and following its instructions: collection, recording, organization, structuring, storage, adaption or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, interconnection, restriction, erasure, comparison, limitation, use, anonymization and destruction.
Two.- Duration
This DPA shall enter into force on the date of the acceptance of the EULA by the Data Controller and shall remain in force until the Services have been fully performed.
Three.- Quibim’s obligations
Quibim, in its capacity as data processor, represents and warrants the following to the Data Controller:
a) It has sufficient technical capacity to comply with the obligations deriving from the Agreement in full observance of personal Data Protection Legislation and it can give an undertaking, to the extent required by the provision of the Services, to comply with the requirements of the Data Protection Legislation.
b) It shall maintain the secrecy and confidentiality of any personal data controlled by the Data Controller to which it will have access.
c) It shall process the personal data to which it has access solely on behalf of the Data Controller and, in all case, in accordance with the documented instructions given to it by the Data Controller. Equally, it undertakes to use said data during the term of this DPA solely for the provision of the Services and, consequently, not to use them or apply them in any way that exceeds such purpose. Quibim shall not “Sell” or “Share,” as such terms are defined under the applicable Data Protection Legislation, the personal data, or otherwise retain, use, or disclose such personal data outside its direct business relationship with the Data Controller or for any purpose other than the contracted business purpose(s), unless otherwise permitted under Data Protection Legislation. Quibim shall not combine such personal data with other personal data that it receives from, or on behalf of, another source or that it collects from its own interaction with an individual who is the subject of the personal data unless permitted by Data Protection Legislation. Quibim is not responsible for compliance with any Data Protection Legislation applicable to the Data Controller or Data Controller’s industry that are not generally applicable to Quibim.
d) It shall not disclose to third parties, not even for their storage, any data to which it has access by virtue of the provision of the Services, or any preparations, evaluations or similar processes it may carry out with said data, nor shall it duplicate or reproduce some or all of the information, results or relationships regarding such data, save where legally required to do so.
e) It shall make available to the Data Controller all information necessary to evidence the fulfilment of its obligations, and for the performance of any audits or inspections carried out by the Data Controller, or any other auditor on its behalf.
Audits may be performed periodically, on a planned or “ad hoc” basis, prior notification to Quibim at least THIRTY (30) days in advance, during normal business hours and in a way that does not unreasonably interfere with the provision of services by Quibim or otherwise. that it does not unreasonably interfere with Quibim’s business (except for those interferences that can be reasonably expected, in a general and necessary way, in any audit process).
The above requirements shall not apply in the event the audit is commenced by a competent authority.
f) It shall ensure that the persons authorized to process personal data expressly undertake in writing to respect the confidentiality thereof and to comply with the corresponding security measures, of which they shall be duly informed.
g) It shall ensure the necessary personal data protection training is given to the persons authorized to process personal data under its charge.
h) It shall assist the Data Controller in performing impact assessments relating to the personal data to which it has access, where applicable under Data Protection Legislation and so requested by the Data Controller.
i) It shall assist the Data Controller in submitting prior consultations to the supervisory authority, where applicable.
j) If Quibim considers that compliance with a specific instruction of the Data Controller could entail a breach of Data Protection Legislation, Quibim must immediately notify the Data Controller (unless prohibited from doing so under Data Protection Legislation) and ask it to withdraw, amend or confirm the instruction in question. Quibim may suspend application of the instruction in question while awaiting the Data Controller’s decision regarding the withdrawal, amendment or confirmation of the relevant instruction.
k) On completion of the Services, Quibim will honor Customer’s retrieval instructions (as per Section 6.4 of the EULA). After the retrieval window, Quibim shall proceed to the absolute anonymization of (i) the personal data to which it has had access, as well as (ii) the documents or media in which any of these data are recorded, in terms equivalent to its destruction in accordance with the provisions of the GDPR or other Data Protection Legislation. Quibim shall then be entitled to use that anonymized data for its own purposes and in particular to train its algorithms in order to keep its database permanently updated, on the basis that the Data Controller has complied with all legal requisites to disclose that anonymized data to Quibim. As recognized by the Data Controller, this further processing of anonymized data by Quibim results in the constant improvement of the services provided by Quibim.
The Data Controller represents and warrants that (i) it has provided, and will continue to provide, all notice and obtained, and will continue to obtain, all consents, permissions and rights necessary under Data Protection Legislation for Quibim lawfully process personal data controlled by the Data Controller to correctly perform the Services, and that (ii) it has complied with all applicable Data Protection Legislation in the collection and provisions to Quibim of such personal data.
Quibim shall not destroy the data where there is a legal obligation to store the data, in which case Quibim shall return the data to the Data Controller, in the manner indicated by it, and the Data Controller must ensure the data are stored.
l) That Quibim, as data processor, shall notify, via email, the Data Controller without undue delay and in any event shall, were feasible, occur no later than 48 hours from Quibim becoming aware of any suspected or confirmed incident relating to protection of the data, any data processing that may be considered unlawful or unauthorized, any loss, destruction or damage to personal data within the area of responsibility of Quibim (caused by Quibim, its personnel, agents or subcontractors) and of any incident that may be considered a personal data breach, together with all relevant information in order to document and communicate the incident to the authorities or affected data subjects. In this connection, it shall, where it has it, provide the following information at minimum:
-
- a description of the nature of the data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- the name and contact details of the data protection officer or other contact point where more information can be obtained;
- a description of the likely consequences of the personal data breach; and
- a description of the measures taken or proposed to address the data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Quibim shall also immediately open a full investigation into the circumstances relating to the incident and shall present its report or observations thereon to the Data Controller, collaborating fully with any investigation carried out by the Data Controller and providing the Data Controller with any assistance required for the investigation of the incident. Quibim’s notification of or response to an incident under this Section l) will not be construed as an acknowledgment by Quibim of any fault or liability with respect to the incident.
It shall also assist the Data Controller in the event of a personal data breach in order to ensure compliance with the obligations to notify a personal data breach in accordance with the Data Protection Legislation (in particular, articles 33 and 34 GDPR) and with any other applicable rules that may amend or supplement it or which may be enacted in the future.
m) It shall assist the Data Controller providing any kind of information and/or documentation required by the Data Controller to adequately respond to any request for exercise of the rights of access, rectification, erasure, objection, restriction of processing and/or portability it may receive from data subjects and, in all cases, sufficiently in advance to enable the Data Controller to meet the legally applicable deadlines for responding to such requests.
n) If Quibim directly receives a request for exercise of the rights of access, rectification, erasure, objection, restriction of processing and/or portability from the data subject, it undertakes to immediately convey such request to the Data Controller and, in any case in less than SEVEN (7) business days.
o) It shall not outsource the Services to any third party unless it obtains the prior written consent of the Data Controller or they are auxiliary services needed by Quibim in order to correctly provide its services, such as those needed to securely store the data.
Where Quibim needs to outsource any data processing, it must notify the Data Controller of the services and processing it intends to outsource, the identity of the subcontractor and its contact details. This notice must be served by Quibim at least ONE (1) week in advance of the signature of the outsourcing agreement, during which period the Data Controller may object to the outsourcing, provided that such objection is based on reasonable grounds relating to data protection. In such event, the Parties will discuss such concerns in good faith with a view to achieving a resolution. If Quibim cannot provide an alternative sub-processor, or the Parties are not able to achieve resolution as provided herein, the Data Controller as its sole and exclusive remedy, may terminate the relevant part of the Agreement, regarding those Services which cannot be provided by Quibim without the use of the sub-processor concerned, without liability to either Party (but without prejudice to any fees incurred by the Data Controller prior to suspension or termination).
Quibim shall inform the Data Controller of any intended changes concerning the addition or replacement of other subcontractors, thereby giving the Data Controller the opportunity to object to such changes.
The sub-processor shall also be subject to the obligations imposed on Quibim under this Agreement and to the instructions issued from time to time by the Data Controller. In this connection, Quibim must set out the relationship with the sub-processor and the obligations of the sub-processor in a contract to be signed by Quibim and the sub-processor, which meets the formal requirements contained in this Agreement and provides the same level of protection as herein. In the event of breach by the sub-processor of its data protection obligations, Quibim shall bear all liability to the Data Controller for such breach, as if the breach had been committed by Quibim.
p) It shall keep a written record of all categories of processing activities carried out by virtue of the Agreement, containing:
-
- the name and contact details of Quibim and, where applicable, the representative of the Data Controller or of Quibim, and the data protection officer;
- the categories of processing carried out by virtue of the Agreement; and
- in the case of international data transfers (which must be regulated or authorized by the Data Controller in all cases), the identity of the third country of final destination of the data controlled by the Data Controller and documentation of the suitable safeguards.
q) It shall not carry out international transfers of the personal data to which it has access that are controlled by the Data Controller unless agreed with the Data Controller and prior implementation of additional safeguards regarding international data transfers in accordance with the GDPR are duly adopted.
In this regard, if the Data Controller is based outside the European Economic Area (EEA) it authorizes Quibim, by virtue of this DPA, to internationally transfer the personal data that Quibim processes in name and on behalf of the Data Controller back to the Data Controller. Quibim undertakes to take all measures as necessary to ensure that the transfer is in compliance with this DPA and applicable Data Protection Legislation.
Regarding the safeguards implemented by Quibim to carry out such international transfers:
(i) If the Data Controller is located in a third country outside the EEA which has been declared by the European Commission, via an adequacy decision, as having an adequate level of protection of personal data (see full list here), Quibim shall internationally transfer the data on the basis of such adequacy decision; and
(ii) If the Data Controller is located in any third country outside the EEA other than the ones described in point (i) above, the international transfer shall be carried out by virtue of the processor-to-controller Standard Contractual Clauses adopted by the European Commission and subscribed herein between Quibim and the Data Controller which are attached to this DPA as Appendix I and publicly available on Quibim’s Trust Hub, accessible through its website. It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses and, accordingly, if and to the extent the Standard Contractual Clauses conflict with any provision of the EULA (including this DPA) the Standard Contractual Clauses shall prevail to the extent of such conflict.
r) Quibim shall have a general description of the technical and organizational security measures implemented relating to: (i) the pseudonymization and encryption of personal data, as applicable; (ii) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (iii) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and (iv) the process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
Quibim also undertakes to implement all technical and organizational security measures applicable in accordance with the provisions of the Data Protection Legislation (in particular, Article 32 of the GDPR) and any other applicable rules that may amend, supplement or replace them. In the specific context of this relationship, Quibim shall implement the security measures which are publicly available on Quibim’s Trust Hub (the “Security Measures”).
These Security Measures, and any others that must be implemented, may be amended at the request of the Data Controller for the purposes of bringing them into line with regulatory changes or changes in the type of personal data to which Quibim will have access. The Data Controller is responsible for reviewing the information made available by Quibim relating to data security and making and independent determination as to whether the Security Measures meet the Data Controller’s requirements and legal obligations under Data Protection Legislation.
The Data Controller acknowledged that the Security Measures are subject to technical progress and development and that Quibim may update or modify them from time to time provided that such updates and modifications do not result in a material degradation of the overall security of the Services subscribed by the Data Controller.
If, following the formalization of the Agreement, the Data Controller requires Quibim to adopt or maintain security measures other than the Security Measures agreed in this clause, or if it is compulsory to adopt them due to any rule that may be enacted in the future, and this significantly affects the cost of performing the services engaged under this Agreement, Quibim and the Data Controller shall agree on the appropriate measures to resolve the situation.
Four.- Prohibition of other uses
In accordance with the provisions of the Data Protection Legislation, and except for the provisions of Clause Three regarding anonymized data, Quibim will be considered data controller in the event that it uses the personal data for other purposes, communicates them or uses them in breach of the stipulations of this DPA, and shall therefore be deemed personally liable for the infractions that may have been incurred.
Five.- Information on the processing of the signatories and representatives’ personal data by the Parties
In accordance with applicable Data Protection Legislation, the Parties inform the signatories acting on behalf of the other Party to this EULA (the “Representatives”) that the personal data they provide herein or may subsequently provide, will be the responsibility of the other Party, which will process it on the basis of that Party’s legitimate interest in maintaining, complying with, developing, monitoring and enforcing the provisions of this EULA.
The Parties shall process the other Party Representative’s personal data for the duration of this EULA and may subsequently maintain such data blocked for the duration of the statute of limitations of any legal actions relating to such processing.
For the appropriate purposes, the Parties inform the Representatives that their personal data shall not be disclosed to any third party or internationally transferred except under a legal obligation and that only the Parties’ service providers in the systems and technology, legal and administrative management sectors shall have access to such data.
Should your Representatives wish to exercise their rights of access, rectification, erasure, restriction of processing and, in those cases where possible, objection, they may do so by writing to the address indicated in Clause 10.14 of the EULA or to the following addresses: · To exercise the rights before Quibim’s Data Protection Officer: dpo@quibim.com
In addition, the Representatives may also contact the Spanish Data Protection Agency to claim their rights.
Six.- Relationship with the EULA
The Parties agree that this DPA shall replace any existing data processing agreement or similar document that the parties may have previously entered into in connection with the Services or the Software.
This DPA will be governed and construed in accordance with the governing law and jurisdiction provisions in the EULA, unless required otherwise by applicable Data Protection Legislation.
Appendix I
Standard Contractual Clauses for the Transfer of Personal Data to Third Countries
SECTION I
Clause 1 – Purpose and scope
a. The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country
b. The Parties:
-
- the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A (hereinafter each “data exporter”), and
- the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each “data importer”)
have agreed to these standard contractual clauses (hereinafter: “Clauses”).
c. These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
d. The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2 – Effect and invariability of the Clauses
a. These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
b. These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3 – Third-party beneficiaries
a. Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
-
- Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
- Clause 8.1 (b) and Clause 8.3 (b);
- Clause 13;
- Clause 15.1 (c), (d) and (e);
- Clause 16 (e);
- Clause 18.
b. Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4 – Interpretation
a. Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
b. These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
c. These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5 – Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6 – Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7 – Docking clause
a. An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.
b. Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.
c. The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8 – Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organizational measures, to satisfy its obligations under these Clauses.
8.1 Instructions
a) The data exporter shall process the personal data only on documented instructions from the data importer acting as its controller.
b) The data exporter shall immediately inform the data importer if it is unable to follow those instructions, including if such instructions infringe Regulation (EU) 2016/679 or other Union or Member State data protection law.
c) The data importer shall refrain from any action that would prevent the data exporter from fulfilling its obligations under Regulation (EU) 2016/679, including in the context of sub-processing or as regards cooperation with competent supervisory authorities.
d) After the end of the provision of the processing services, the data exporter shall, at the choice of the data importer, delete all personal data processed on behalf of the data importer and certify to the data importer that it has done so, or return to the data importer all personal data processed on its behalf and delete existing copies.
8.2 Security of processing
a) The Parties shall implement appropriate technical and organizational measures to ensure the security of the data, including during transmission, and protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access (hereinafter “personal data breach”). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature of the personal data3, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects, and in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.
b) The data exporter shall assist the data importer in ensuring appropriate security of the data in accordance with paragraph (a). In case of a personal data breach concerning the personal data processed by the data exporter under these Clauses, the data exporter shall notify the data importer without undue delay after becoming aware of it and assist the data importer in addressing the breach.
c) The data exporter shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
8.3 Documentation and compliance
a. The Parties shall be able to demonstrate compliance with these Clauses.
b. The data exporter shall make available to the data importer all information necessary to demonstrate compliance with its obligations under these Clauses and allow for and contribute to audits.
Clause 9 – Use of sub-processors
Not applicable.
Clause 10 – Data subject rights
The Parties shall assist each other in responding to enquiries and requests made by data subjects under the local law applicable to the data importer or, for data processing by the data exporter in the EU, under Regulation (EU) 2016/679.
Clause 11 – Redress
a. The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorized to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
The data importer agrees that data subjects may also lodge a complaint with an independent dispute resolution body at no cost to the data subject. It shall inform the data subjects, in the manner set out in paragraph (a), of such redress mechanism and that they are not required to use it, or follow a particular sequence in seeking redress.
Clause 12 – Liability
a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
b) Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.
c) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
d) The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
e) The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.
Clause 13 – Supervision
Not applicable.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14 – Local laws and practices affecting compliance with the Clauses
Not applicable
Clause 15 – Obligations of the data importer in case of access by public authorities
Not applicable
SECTION IV – FINAL PROVISIONS
Clause 16 – Non-compliance with the Clauses and termination
a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
-
- the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
- the data importer is in substantial or persistent breach of these Clauses; or
- the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non- compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
d. Personal data collected by the data exporter in the EU that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall immediately be deleted in its entirety, including any copy thereof. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
e. Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17 – Governing law
These Clauses shall be governed by the law of a country allowing for third-party beneficiary rights. The Parties agree that this shall be the law of Spain.
Clause 18 – Choice of forum and jurisdiction
Any dispute arising from these Clauses shall be resolved by the courts of Spain.
Annex I
A. List of Parties
Data exporter(s):
- Name: Quibim, as above identified.
Address: Avda. Aragón 30, Edificio Europa, 13th floor, Offices I-J, 46021 Valencia (Spain)Contact person’s name, position and contact details: Privalex, S.L., Quibim’s Data Protection Officer: dpo@quibim.comActivities relevant to the data transferred under these Clauses: Quibim, in its capacity as the Data Processor acting on behalf of the Data Controller, shall have access to certain personal data for which the Data Controller is responsible.Quibim shall process such personal data strictly in accordance with the Data Controller’s documented instructions and solely for the purpose of providing the contracted services. The types of processing operations carried out by Quibim on behalf of the Data Controller may include, but are not limited to: collection, recording, organization, structuring, storage, adaption or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, interconnection, restriction, erasure, comparison, limitation, use, anonymization and destruction.In the context of the service provision, Quibim shall also facilitate the Data Controller’s remote access to the personal data for which it is responsible. Where such access takes place from a location outside the European Economic Area (EEA), it shall be regarded as an international transfer of personal data. Accordingly, Quibim undertakes to ensure that such transfers are carried out in compliance with Chapter V of the GDPR and the applicable Standard Contractual Clauses.Signature and date: Please refer to the date and signature of the Quotation.Role (controller/processor): Processor
Data importer(s):
- Name: The Data Controller.Address: As indicated in the Quotation.Contact person’s name, position and contact details: As indicated in the Agreement.Activities relevant to the data transferred under these Clauses: The Data Controller shall have access, via Quibim’s Software, to the personal data for which it is responsible and which Quibim processes on its behalf in the context of providing the contracted services.Given that such access shall take place from a location outside the European Economic Area (EEA) it shall be considered an international transfer of personal data. In such cases, Quibim acknowledges that it is carrying out an international data transfers within the meaning of Chapter V of the GDPR and shall ensure that such transfers are conducted in full compliance with applicable Data Protection Legislation.Signature and date: Please refer to the date and signature of the Agreement.
Role (controller/processor): Controller
B. Description of Transfer
Categories of data subjects whose personal data is transferred
The personal data transferred relates to data subjects whose information is provided to Quibim via the Services by or on behalf of the Data Controller. This includes, in particular, patients and End Users as defined in the Agreement and related documentation.
Categories of personal data transferred
The categories of personal data transferred may include:
- Identifying information.
- Special categories of personal data, specifically health-related information.
- Other data related to personal characteristics necessary for service provision.
Sensitive data transferred (if applicable) and applied restrictions or safeguards
The processing includes special categories of data, specifically data concerning the health of patients of the Data Controller. Such data is processed in a pseudonymized manner by Quibim; it is only associated with a patient code, and only the Data Controller can re-identify the data subject. Quibim implements appropriate technical and organizational measures to protect the data, including access controls, encryption in transit and at rest, and data minimization practices.
The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis).
The personal data is transferred on a continuous basis, as required for the ongoing performance of the Services under the Agreement.
Nature of the processing
Quibim transfers the data back to the Data Controller given its role as Data Processor. In this sense, Quibim allows the Data Controller to have access, via the Software, to the personal data it processes on the Data Controller’s behalf in accordance with the Agreement and the EULA. The data is processed during and for the provision of the Services.
Purpose(s) of the data transfer and further processing
Given that Quibim processes personal data on the Data Controller’s behalf to provide it with the Services, as described in the EULA and the Agreement, the Data Controller should be able to access such data under its responsibility at any time, which implies a processor-to-controller international transfer regulated by virtue of these Standard Contractual Clauses.
The purpose of the transfer is for Quibim to comply with its role as data processor.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Quibim will retain and process the personal data for the duration of the Agreement and the EULA, or as otherwise instructed by the Data Controller, unless otherwise required to retain the data by applicable law.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Quibim shall not transfer the Data Controller’s personal data to sub-processors located outside the EEA (unless it obtains the prior written consent of the Data Controller or they are auxiliary services needed by Quibim in order to correctly provide its services as per Section o) of the DPA herein), although it may subcontract certain services to sub-processors within the EEA. Sub-processor shall mean any third party engaged by Quibim to process personal data (but shall not include Quibim employees, advisors or consultants). Where sub-processors are engaged within the EEA, they are contractually bound to adhere to data protection obligations equivalent to those set out in this Agreement. Sub-processors may only process the personal data for the purpose of providing their specific contracted service and for the duration necessary to fulfill that purpose.
Schedule 5.2 (B)
HIPAA Business Associate Agreement
This Business Associate Agreement (“BAA”) is entered into by and between Customer (“Covered Entity”) and Quibim (“Business Associate”) (each a “Party” and collectively, the “Parties”).
Business Associate performs certain services for or on behalf of Covered Entity, and in performing said services, Business Associate may create, receive, maintain, or transmit Protected Health Information (“PHI”). The Parties intend to protect the privacy and provide for the security of the PHI Disclosed (as defined below) by Covered Entity to Business Associate, or created, received, maintained, or transmitted by Business Associate, when providing services. Such PHI will be protected in compliance with the Health Insurance Portability and Accountability Act (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (Public Law 111-005) (the “HITECH Act”) and its implementing regulations and guidance issued by the Secretary of the U.S. Department of Health and Human Services (“Secretary”) (collectively, the “HIPAA Regulations”).
Covered Entity is required under the HIPAA Regulations to enter into a Business Associate Agreement that meets certain requirements with respect to the Use (as defined below) and Disclosure of PHI, which are met by this BAA. Accordingly, to the extent Business Associate is functioning as a “business associate” as defined in the HIPAA Regulations, Business Associate agrees to comply with this BAA. In consideration of the above recitals and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the Parties agree as follows:
Definitions
The following terms shall have the respective meanings set forth below. Capitalized terms used in this BAA and not otherwise defined shall have the meanings ascribed to them in the HIPAA Regulations.
- “Breach” shall have the meaning given to such term under 45 C.F.R. § 164.402.
- “Designated Record Set” shall have the meaning given to such term under 45 C.F.R. § 164.501.
- “Disclose” and “Disclosure” mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside of Business Associate or to other than members of its workforce, as set forth in 45 C.F.R. § 160.103.
- “Electronic PHI” or “e-PHI” means PHI that is transmitted or maintained in electronic media, as set forth in 45 C.F.R. § 160.103.
- “Protected Health Information” and “PHI” mean any information, whether oral or recorded in any form or medium, provided by Covered Entity to Business Associate, that: (a) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual; (b) identifies the individual (or for which there is a reasonable basis for believing that the information can be used to identify the individual); and (c) shall have the meaning given to such term under 45 C.F.R. § 160.103. Protected Health Information includes e-PHI.
- “Required by Law” shall have the meaning given to such term under 45 C.F.R. § 164.103.
- “Security Incident” shall have the meaning given to such term under 45 C.F.R. § 164.304.
- “Services” shall mean the services or functions performed by Business Associate for or on behalf of Covered Entity pursuant to any Agreement that constitute a “business associate” relationship, as set forth in 45 C.F.R. § 160.103.
- “Unsecured PHI” shall have the meaning given to such term under 42 U.S.C. § 17932(h), 45 C.F.R. § 164.402, and guidance issued pursuant to the HITECH Act including, but not limited to the guidance issued on April 17, 2009 and published in 74 Federal Register 19006 (April 27, 2009) by the Secretary.
- “Use” or “Uses” mean, with respect to PHI, the sharing, employment, application, utilization, examination or analysis of such PHI within Business Associate’s internal operations, as set forth in 45 C.F.R. § 160.103.
Obligations of Business Associate
2.1. Permitted Uses and Disclosures of PHI. Business Associate shall not Use or Disclose PHI created, received, maintained, or transmitted for or on behalf of Covered Entity except to perform the Services required by the Agreement, or as permitted by this BAA or Required by Law. Business Associate shall not Use or Disclose PHI in any manner that would constitute a violation of the HIPAA Regulations if so Used or Disclosed by Covered Entity.
Without limiting the generality of the foregoing, Business Associate is permitted to (i) Use and Disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that with respect to any such Disclosure either: (a) the Disclosure is Required by Law; or (b) Business Associate obtains agreement from the person to whom the PHI is to be Disclosed that such person will hold the PHI in confidence and will not Use or further Disclose such PHI except as Required by Law and for the purpose(s) for which it was Disclosed by Business Associate to such person, and that such person will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached; (ii) Use PHI for Data Aggregation purposes in connection with the Health Care Operations of Covered Entity; and (iii) Use PHI to create de-identified information in accordance with the requirements outlined in the HIPAA Regulations. Data that has been de-identified will no longer be subject to the terms of this BAA.
2.2. Adequate Safeguards of PHI. Business Associate agrees to use appropriate safeguards and comply, where applicable, with Subpart C of 45 C.F.R. Part 164 with respect to e-PHI, to prevent use or disclosure of the information other than as provided for by this BAA.
2.3. Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of the requirements of this BAA.
2.4. Reporting Breaches, Security Incidents, and Non-Permitted Uses or Disclosures. Business Associate shall notify Covered Entity of any Use or Disclosure by Business Associate or its Subcontractors that is not permitted by this BAA and each Security Incident, including Breaches of Unsecured PHI, within five (5) business days of discovery.
Notwithstanding the foregoing, Business Associate and Covered Entity acknowledge the ongoing existence and occurrence of attempted but ineffective Security Incidents that are trivial in nature, such as pings and other broadcast service attacks, and Covered Entity acknowledges and agrees that no additional notification to Covered Entity of such ineffective Security Incidents is required, as long as no such incident results in unauthorized access, Use or Disclosure of PHI. If Business Associate determines that a Breach of Unsecured PHI has occurred, Business Associate shall provide a written report to Covered Entity without unreasonable delay and no later than thirty (30) calendar days after discovery of the Breach. To the extent that information is available to Business Associate, Business Associate’s written report to Covered Entity shall be in accordance with 45 C.F.R. § 164.410(c).
2.5. Delegated Responsibilities. To the extent that Business Associate agrees in the Agreement to carry out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate must comply with the requirements of Subpart E that apply to Covered Entities in the performance of such obligations.
2.6. Availability of Internal Practices, Books, and Records to Government. Business Associate agrees to make its internal practices, books and records relating to the Use and Disclosure of Covered Entity’s PHI available to the Secretary for purposes of determining Covered Entity’s compliance with the HIPAA Regulations.
2.7. Access to and Amendment of Protected Health Information. To the extent that Business Associate maintains a Designated Record Set on behalf of Covered Entity, Business Associate shall (i) make the PHI it maintains (or which is maintained by its Subcontractors) in such Designated Record Set available to Covered Entity for inspection and copying to enable Covered Entity to fulfill its obligations under 45 C.F.R. § 164.524 within fifteen (15) business days of a written request by Covered Entity; and (ii) amend the PHI it maintains (or which is maintained by its Subcontractors) in such Designated Record Sets to enable the Covered Entity to fulfill its obligations under 45 C.F.R. § 164.526 within fifteen (15) business days of a written request by Covered Entity.
2.8. Accounting. Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. Business Associate shall provide to Covered Entity or, at the request of Covered Entity directly to an individual, in the time and manner designated by Covered Entity, but in no event longer than fifteen (15) days after Business Associate’s receipt of a written request from Covered Entity, information collected in accordance this Section 2.8 of this BAA, to permit Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528.
2.9. Use of Subcontractors. Business Associate shall require each of its Subcontractors that creates, receives, maintains, or transmits PHI on behalf of Business Associate, to execute a written agreement that includes substantially the same restrictions and conditions that apply to Business Associate under this BAA with respect to PHI.
2.10. Minimum Necessary. Business Associate (and its Subcontractors) shall, to the extent practicable, limit its request, Use, or Disclosure of PHI to the minimum amount of PHI necessary to accomplish the purpose of the request, Use or Disclosure, in accordance with 42 U.S.C. § 17935(b) and 45 C.F.R. § 164.502(b)(1) or any other guidance issued thereunder.
Term and Termination
3.1. Term. This BAA shall remain in effect until all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with Section 3.3.
3.2. Termination for Cause. In addition to and notwithstanding the termination provisions set forth in any Agreement, upon Covered Entity’s or Business Associate’s knowledge of a material breach or violation of this BAA by the other Party, the non-breaching Party shall notify the breaching Party of the breach in writing, and provide an opportunity for the breaching Party to cure the breach or end the violation within thirty (30) days of such notification; provided that if the breaching Party fails to cure the breach or end the violation within such time period to the satisfaction of the non-breaching Party, the non-breaching Party may immediately terminate this BAA upon written notice to the breaching Party.
3.3. Disposition of PHI Upon Termination. Upon termination or expiration of this BAA, Business Associate shall either return or destroy all PHI received from, or created or received by Business Associate on behalf of Covered Entity, the Business Associate still maintains in any form, and retain no copies of such PHI. If return or destruction is not feasible, Business Associate shall continue to extend the protections of this BAA to the PHI for as long as Business Associate retains the PHI and limit further Uses and Disclosures of such PHI to those purposes that make the return or destruction of the PHI infeasible.
Miscellaneous
4.1. Covered Entity’s Obligations. Covered Entity shall notify Business Associate in writing of any of the following, to the extent that such limitation, change, revocation, or restriction may affect Business Associate’s Use or Disclosure of PHI: (i) any limitation(s) in Covered Entity’s notice of privacy practices; (ii) any changes in, or revocation of, permission by an individual to Use or Disclose PHI; or (iii) any restriction to the Use or Disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R. § 164.522. Covered Entity will obtain any consent or authorization that may be required by the HIPAA Regulations, or applicable state law, prior to furnishing Business Associate with PHI.
4.2. Relationship to Agreement Provisions. In the event that a provision of this BAA is contrary to a provision of an Agreement, the provision of this BAA shall control. Otherwise, this BAA shall be construed under, and in accordance with, the terms of such Agreement, and shall be considered an amendment of and supplement to such Agreement.
4.3. No Third-Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.