DATA PROCESSING AGREEMENT

Last updated: 13 November 2026

1. ABOUT THIS AGREEMENT

1.1 The parties. This Data Processing Agreement (the 'DPA') is made between Brahim Ouasti EI, trading as Inumbra Labs, an individual entrepreneur (entrepreneur individuel) registered in France in the national business register (Registre national des entreprises) under SIREN 538 543 034, intra-community VAT number FR24538543034, and which operates Harnay ('Harnay', 'we', 'us' or 'our'), and the veterinary practice that has accepted the Practice Terms (the 'Practice', 'you' or 'your').

1.2 How it applies. This DPA forms part of the Practice Terms at https://harnay.com/practice-terms, which incorporate it by reference. It applies to Harnay Pro as the Practice Terms define it: the Portal at pro.harnay.com, its Seats, the Vetty Scribe it includes, the listing on the Marketplace, and the Consultations, records and reports handled through them. It covers the processing of Vetty Scribe within Harnay Pro, as clauses 7.6 to 7.12 describe. The Vetty Scribe data processing agreement at https://vettyscribe.com/dpa applies only to a standalone Vetty Scribe subscription taken on vettyscribe.com, which is separate from Harnay Pro.

1.3 Purpose. This DPA sets out the terms on which Harnay processes personal data on the Practice's behalf, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 (the 'GDPR') and by the equivalent rules of the other Data Protection Laws.

1.4 Order of precedence. Where this DPA and the Practice Terms differ on the processing of personal data, this DPA prevails. Where the Standard Contractual Clauses apply under clause 10 and differ from this DPA, the Standard Contractual Clauses prevail.

1.5 Language. This DPA is written in English, and the English text governs. We publish translations into other languages; each is for convenience only.

2. DEFINITIONS

2.1 Terms defined in the Practice Terms (including Administrator, Client, Consultation, Guest, Marketplace, Member, Participant, Portal, Practice Link, Seat, Veterinarian and Vetty Scribe) have the same meaning in this DPA.

2.2 'Controller', 'processor', 'data subject', 'personal data', 'processing', 'personal data breach' and 'supervisory authority' have the meanings given in the GDPR. Under the other Data Protection Laws, they include the equivalent terms used there, such as 'organisation' and 'data intermediary' under the Singapore law.

2.3 In this DPA:

• Client Copies: the copies that a Client keeps in their own harnay.com account of their intake answers and attachments, of the messages and files exchanged in a Consultation's chat, and of the version of each signed report written for them.
• Data Protection Laws: the GDPR and the French data-protection law; the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the 'UAE PDPL'); the Singapore Personal Data Protection Act 2012 (the 'PDPA'); the Australian Privacy Act 1988, including the Australian Privacy Principles; and the New Zealand Privacy Act 2020; in each case as far as it applies to the processing.
• Practice Records: the personal data described in clause 3.1 and Annex 1.
• Standard Contractual Clauses: the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914.
• Sub-processor: a third party that Harnay engages to process Practice Records.

3. ROLES AND SCOPE

3.1 Harnay as processor. The Practice is the controller, and Harnay is the processor, of the Practice Records, which are:

• (a) the Practice's client and patient records in the Portal: the clients and patients it adds or imports, and its notes on clients, patients and appointments;
• (b) the content of each Consultation as it is held for the Practice: the Client's intake answers and attachments; the messages and files exchanged in the chat; the recording of each Participant's microphone, until it is deleted; the record of each Participant's joining, with the version of the recording notice shown; the transcript; and the draft and signed report, both the clinical note and the version written for the Client;
• (c) the files the Practice adds to appointments;
• (d) the records of each in-person consultation recorded with Vetty Scribe: the recording, until it is deleted; the confirmation that the client consented, with its time; the transcript and the raw result from the speech-to-text Sub-processor; the facts extracted from it; the draft and signed report, with its versions and audit trail; and the client and patient details entered for it; and
• (e) any other personal data that the Practice or its Members enter into the Portal about the Practice's clients and patients.

3.2 Harnay as controller. Harnay is an independent controller, and this DPA does not apply, for owner accounts and marketplace data, as our Privacy Policy at https://harnay.com/privacy-policy describes. This covers:

• (a) the accounts of pet owners on harnay.com, their profiles and the pets they register there;
• (b) the Client Copies;
• (c) bookings, payments, refunds, cancellations, no-shows, reviews and the records of New-Client Fees;
• (d) the Marketplace: the public profiles and listings of Practices and Veterinarians;
• (e) the accounts of Members, their licences and the licence review, and a Veterinarian's voice sample and writing samples (clause 7.9);
• (f) the security, fraud-prevention, rate-limiting and error records of the service, and consent records for cookies.

3.3 Data held in both roles. Some content exists both in the Practice Records and as a Client Copy: the intake, the chat, and the version of each signed report written for the Client. Harnay holds the Practice's copy as processor under this DPA, and the Client Copy as controller so that the Client keeps access to it. The end of this DPA, or the closing of the Practice, ends the first and not the second. Both are deleted at the end of the period in clause 13.1.

3.4 Details of the processing. Annex 1 sets out the subject matter, duration, nature and purpose of the processing, and the categories of personal data and of data subjects.

4. THE PRACTICE'S INSTRUCTIONS AND OBLIGATIONS

4.1 Documented instructions. The Practice instructs Harnay to process the Practice Records to provide Harnay Pro as the Practice Terms describe, including to record, transcribe and draft reports as clause 7 describes and to retain and delete them as clause 13 describes. The Practice Terms, this DPA, the Practice's use and configuration of the Portal, and any other written instruction the Practice gives and Harnay accepts, are the Practice's complete documented instructions.

4.2 The Practice's obligations. The Practice:

• (a) is responsible for having a lawful basis for the Practice Records and for Harnay's processing of them under this DPA;
• (b) tells its clients how their data is handled, including that every Consultation is recorded and transcribed to produce the report the Client receives, on the basis of the contract under which the Consultation is held (clause 7.1), that reports are drafted with artificial intelligence and reviewed and signed by the Veterinarian, and that the records are kept with Harnay;
• (c) before an in-person consultation is recorded with Vetty Scribe, tells everyone present that it is recorded and transcribed, obtains any consent to the recording that the law of the place of the consultation requires, and records no one who has refused or withdrawn consent, as clause 8.9 of the Practice Terms describes;
• (d) answers its clients' requests about the Practice Records, with Harnay's assistance under clause 11;
• (e) keeps the records that its regulator and the law require, exporting them where it must keep them longer than Harnay does; and
• (f) gives Harnay only instructions that comply with the Data Protection Laws.

5. HARNAY'S OBLIGATIONS

5.1 Instructions. Harnay processes the Practice Records only on the Practice's documented instructions, including with regard to transfers to a third country, unless a law of the European Union or of a Member State to which Harnay is subject requires otherwise. In that case Harnay tells the Practice of that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

5.2 Unlawful instructions. Harnay tells the Practice at once if, in its opinion, an instruction infringes the Data Protection Laws. Harnay may suspend the processing concerned until the Practice confirms or changes the instruction.

5.3 Confidentiality. Harnay ensures that every person it authorises to process the Practice Records is bound by an obligation of confidentiality, by contract or by law, and processes them only as needed to provide the service.

5.4 Security. Harnay implements the technical and organisational measures in Annex 3, which are designed to meet Article 32 of the GDPR. Harnay may change them over time, provided that the overall level of protection is not reduced.

5.5 No other use. Harnay does not sell the Practice Records, does not use them for its own purposes, and does not use them, or let any Sub-processor use them, to train artificial intelligence models.

5.6 Assistance. Taking into account the nature of the processing and the information available to it, Harnay assists the Practice in meeting its obligations under Articles 32 to 36 of the GDPR: security, the notification of personal data breaches, data protection impact assessments and prior consultation of a supervisory authority. Harnay provides the information it holds about the processing, such as this DPA and its annexes, and answers reasonable questions.

6. PERSONNEL AND INCIDENT OWNER

Brahim Ouasti is Harnay's privacy contact and is responsible for data protection and incidents at Harnay. He may be reached at privacy@harnay.com. Clause 15.4 sets out his role under the PDPA.

7. RECORDING, TRANSCRIPTION AND AI DRAFTING

7.1 Notice given for the Practice. Every Consultation is recorded and transcribed. Before joining a Consultation, each Participant, Guests included, is told that the Consultation's audio is recorded and transcribed, and joining is agreement to it. Harnay gives the notice and stores each join, with its time and the version of the notice shown, on the Practice's behalf. There is no option to join without recording. The recording is made to produce the report the Client receives, and its basis is the performance of a contract (Article 6(1)(b) of the GDPR): the Practice's contract with its Client, and the terms each Participant has accepted, namely Harnay's Terms of Service for the Client and any Guest and, for Members, the Practice Terms and their membership of the Practice.

7.2 What is recorded and when it is deleted. Only each Participant's microphone audio is recorded; video and screen sharing are never recorded. The audio is stored in a private storage area in Frankfurt, Germany, transcribed after the Consultation, and deleted as soon as the transcript is stored. The audio of a Consultation that does not complete is deleted at once, and in any event within 24 hours.

7.3 Transcription. The audio is transcribed by the speech-to-text Sub-processor named in Annex 2. Once Harnay has retrieved a transcript, it asks that Sub-processor to delete its copy of the transcript.

7.4 AI drafting. The draft report is prepared by the AI Sub-processors named in Annex 2 from the transcript, the Client's intake answers and the patient's profile. The Veterinarian reviews, corrects and signs the report, and only a signed report reaches the Client. No decision producing legal effects for a Client, or similarly significantly affecting them, is taken solely by automated means.

7.5 AI providers and training. Harnay has no zero-retention agreement with its AI providers. They may keep inputs for a short period for abuse monitoring under their own terms. None of them may train their models on the Practice Records: Anthropic's commercial terms bar training on customer content; OpenAI does not use data sent through its API for training unless the customer opts in, which Harnay has not done, and keeps abuse-monitoring logs for up to 30 days; and Harnay has opted out of training in its ElevenLabs account's data-use settings.

7.6 Vetty Scribe. With Vetty Scribe, a Veterinarian records an in-person consultation in the browser of a device of their choosing. Harnay transcribes the recording and drafts a report from it for the Veterinarian to review, edit and sign, as clauses 7.7 to 7.12 describe. Clauses 7.1 to 7.4 apply to video Consultations only; clause 7.5 applies to both.

7.7 Consent in the room. Before a recording starts, Vetty Scribe asks the Veterinarian to confirm that the client has consented, in the Practice's own consent wording or, if the Practice has set none, in Harnay's. Once consent is confirmed for a client, it is kept on file for the Practice and is not asked again. Each consultation records that consent was confirmed, with its time, and a report cannot be signed without that confirmation. The confirmation is the Practice's statement to Harnay. It does not transfer to Harnay the Practice's responsibility under clause 4.2(c).

7.8 The recording. The audio is saved in the recording device's browser storage before it is uploaded, so that a dropped connection does not lose the consultation, and is then stored in a private storage area in Frankfurt, Germany. It is sent to the speech-to-text Sub-processor named in Annex 2 through a signed link that expires after one hour. Once Harnay has retrieved the transcript and finished processing the consultation, it deletes that Sub-processor's copy of the transcript. The raw result from the Sub-processor is kept with the record as the evidence behind the transcript.

7.9 Voice and writing samples. A Veterinarian may enrol a short sample of their own voice, of a few seconds. Vetty Scribe places it at the start of each recording that Veterinarian makes, so that the transcript can tell their voice apart from the client's, and it therefore reaches the speech-to-text Sub-processor with each recording. A Veterinarian may also paste in past reports as a style reference; they are de-identified before they are stored and used only to shape that Veterinarian's own reports. Harnay holds voice and writing samples as controller, under its Privacy Policy, and stores a voice sample only with the Veterinarian's explicit consent. Voices are transcribed, not used to identify anyone.

7.10 AI drafting. From the transcript, the AI Sub-processors named in Annex 2 extract the clinical facts, draft the report in the template the Veterinarian chose, check the draft against the transcript and, where used, translate it or adapt it to the Veterinarian's writing style. Harnay calls OpenAI, when it is selected, with the storage of responses switched off. The Veterinarian reviews, corrects and signs the report. No decision producing legal effects for a client, or similarly significantly affecting them, is taken solely by automated means. Vetty Scribe sends no report or email to the Practice's clients.

7.11 Audio periods. On the Practice's instruction in clause 4.1, the audio of a consultation whose report has not been signed is deleted 30 days after it was recorded, and the audio of a consultation whose report has been signed is deleted 7 days after the first signature; a later amendment does not extend that period. These periods are fixed. Deleting the audio does not delete the transcript or the draft.

7.12 Deleting a consultation. While the Practice is open, it may delete a Vetty Scribe consultation at any time. That removes its audio at once and hides it from the Practice's lists; its transcript and report stay with the Practice Records, as clause 13.1 describes, unless the Practice instructs Harnay in writing to erase them sooner.

8. SUB-PROCESSORS

8.1 General authorisation. The Practice gives Harnay general written authorisation to engage Sub-processors. The Sub-processors in place on the date of this DPA are listed in Annex 2, and the Practice authorises them.

8.2 Sub-processor contracts. Harnay engages each Sub-processor under a written contract that imposes data-protection obligations providing the same level of protection as this DPA, in particular sufficient guarantees of appropriate technical and organisational measures. Harnay remains fully liable to the Practice for the performance of each Sub-processor's obligations.

8.3 Changes. Harnay tells the Practice at least 30 days before it adds or replaces a Sub-processor, by email to the Practice's Administrators and by updating Annex 2. Where a change is urgently needed to keep the service secure or running, Harnay may make it sooner and tells the Practice as soon as it can, with its reasons.

8.4 Objection. The Practice may object to a new Sub-processor in writing to privacy@harnay.com within that notice period, on reasonable data-protection grounds. Harnay will consider the objection in good faith and propose a solution where one is reasonably available. If the parties cannot resolve the objection, the Practice may end the Practice Terms by closing the Practice before the change takes effect, and Harnay refunds the unused part of any Subscription period paid in advance.

9. WHERE THE PRACTICE RECORDS ARE PROCESSED

9.1 Storage in the European Union. Harnay is established in France. The Practice Records are stored in the European Union, in Frankfurt, Germany, where Harnay's database, file storage and server functions run.

9.2 Processing outside the European Union. Some Sub-processors process Practice Records outside the European Economic Area, as Annex 2 shows:

• (a) the speech-to-text and AI drafting Sub-processors process them in the United States;
• (b) the email Sub-processor processes names, email addresses and notification content in the United States;
• (c) the video Sub-processor, LiveKit, routes the live audio and video of each Consultation through the LiveKit server nearest each Participant, which may be outside the European Economic Area, and keeps the session records and logs it retains in its project data region, the United States;
• (d) the hosting Sub-processor, Vercel, is established in the United States and delivers the Portal through its worldwide network; and Sub-processors established in the United States, including Supabase, Upstash and PostHog, may reach Practice Records stored in Frankfurt from there, for example to support or maintain their service.

10. INTERNATIONAL TRANSFERS

10.1 Transfers to Sub-processors. Where a Sub-processor processes Practice Records in a country outside the European Economic Area that has no adequacy decision of the European Commission, or reaches them from such a country, the transfer is covered by the EU–US Data Privacy Framework where the Sub-processor is certified under it, otherwise by the European Commission's standard contractual clauses (Module 3, processor to processor) in the Sub-processor's contract with Harnay, together with any supplementary measures the transfer requires. Annex 2 gives the safeguard for each Sub-processor.

10.2 Practices established outside the European Economic Area. Harnay is a processor established in the European Union. Where the Practice is established in a country outside the European Economic Area that has no adequacy decision of the European Commission (at the date of this DPA, the United Arab Emirates, Australia and Singapore, but not New Zealand), and to the extent the GDPR requires it, Module 4 (processor to controller) of the Standard Contractual Clauses applies to the transfer of Practice Records from Harnay to the Practice and is incorporated into this DPA by reference, with these choices:

• (a) Harnay is the data exporter and the Practice is the data importer;
• (b) the optional docking clause (Clause 7) does not apply;
• (c) Clause 17: the clauses are governed by French law;
• (d) Clause 18: disputes are resolved by the courts of Pontoise, France;
• (e) Annex I.A: the parties are those in clause 1.1, with the addresses given there and in the Portal; the data exporter's contact is Brahim Ouasti at privacy@harnay.com, and the Practice's contact is the one held in the Portal; Annex I.B is Annex 1 of this DPA.

10.3 Transfers under other laws. Where the Data Protection Law of the Practice's country restricts the transfer of the Practice Records to Harnay in France or onward to a Sub-processor, the parties agree that this DPA, and where relevant the Standard Contractual Clauses, are the contractual safeguard for that transfer, and clause 15 applies.

11. DATA SUBJECTS' REQUESTS

11.1 Assistance. Taking into account the nature of the processing, Harnay assists the Practice, by appropriate technical and organisational measures and as far as possible, to answer requests from data subjects to exercise their rights over the Practice Records. The Portal lets the Practice see, correct and export the Practice Records. For anything the Portal does not allow, the Practice may write to privacy@harnay.com, and Harnay will help without undue delay.

11.2 Requests made to Harnay. If Harnay receives a request about Practice Records from a data subject, it passes it to the Practice without undue delay and does not answer it itself, except to tell the person that it has been passed on or where the law requires Harnay to answer. A request that concerns data for which Harnay is the controller, including the Client Copies, is answered by Harnay under its Privacy Policy.

12. PERSONAL DATA BREACHES

12.1 Notice to the Practice. Harnay notifies the Practice without undue delay, and in any event within 48 hours of becoming aware of it, of any personal data breach affecting the Practice Records. Notice is given by email to the Practice's Administrators.

12.2 Content of the notice. The notice describes, as far as Harnay then knows: the nature of the breach, including the categories and approximate number of data subjects and records concerned; its likely consequences; the measures taken or proposed to address it and to mitigate its effects; and the contact point for more information. Where Harnay cannot give all of this at once, it gives it in stages without further undue delay.

12.3 Who notifies the authorities and the people concerned. The Practice, as controller of the Practice Records, decides on and makes any notification to its supervisory authority and to the data subjects concerned. Harnay gives the Practice the information and help it reasonably needs to do so. Harnay does not notify the Practice's supervisory authority or the Practice's clients about a breach of the Practice Records on the Practice's behalf, unless the Practice asks it to or the law requires it. Where the same breach also affects data for which Harnay is the controller, including the Client Copies, Harnay makes its own notifications: to the CNIL without undue delay and, where the GDPR requires notification, within 72 hours of becoming aware of the breach; to any other competent authority within the time applicable law requires; and to the people affected where the law requires it.

12.4 Containment. Harnay takes reasonable steps to contain the breach, limit its effects and prevent it from happening again. A notice under this clause is not an admission of fault or liability.

13. RETENTION, DELETION AND RETURN

13.1 Retention during the service. On the Practice's instruction in clause 4.1, Harnay deletes the content of each Consultation (the intake, the chat messages and files, the transcript and the report) 5 years after the Client's last Consultation with the Practice. The audio is deleted earlier, as clause 7.2 describes. The records of Vetty Scribe (clause 3.1(d)) and the Practice's other client and patient records are kept while the Practice's account is open; the audio of Vetty Scribe is deleted earlier, as clause 7.11 describes. The Practice may ask Harnay in writing to delete particular Practice Records sooner, and Harnay will do so unless the law requires it to keep them; this does not affect the Client Copies.

13.2 Return. While the Practice is open, an Administrator can download an export of the Practice Records from the practice settings at any time: a ZIP file of the consultation records and signed reports, Vetty Scribe's included, transcripts as text, and lists of the Consultations, clients, patients and notes. Audio is not included, because it is deleted once transcribed.

13.3 At the end of the service. When the Practice is closed, or the Practice Terms end for any other reason, the person who closed the Practice can download the export for 30 days. At the end of those 30 days, Harnay deletes the Practice Records as clause 16 of the Practice Terms describes, unless the law of the European Union or of a Member State requires Harnay to keep them. By accepting this DPA, the Practice chooses this combination of return and deletion. The Client Copies are not Practice Records and stay in the Client's account until the end of the period in clause 13.1.

13.4 Backups. Deleted data remains in Harnay's backups until they are overwritten, which happens within 30 days. Harnay does not restore deleted data from backups except to recover from an incident.

13.5 Confirmation. On the Practice's written request, Harnay confirms in writing that the Practice Records have been deleted.

14. INFORMATION AND AUDITS

14.1 Information. Harnay makes available to the Practice all information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, starting with this DPA and its annexes and its written answers to the Practice's reasonable questions.

14.2 Audits. Where that information is not enough to demonstrate compliance, or where a supervisory authority requires it, Harnay allows for and contributes to audits, including inspections, conducted by the Practice or by an independent auditor it mandates, on these conditions:

• (a) the Practice gives at least 30 days' written notice and a proposed scope;
• (b) no more than one audit takes place in any 12 months, unless a supervisory authority requires another or a personal data breach of the Practice Records has occurred;
• (c) the audit takes place during business hours, without unreasonably disrupting Harnay's operations, and is limited to the processing of the Practice's own Practice Records;
• (d) the auditor is bound by confidentiality, is not a competitor of Harnay, and does not access other customers' data or information whose disclosure would compromise the security of the service;
• (e) each party bears its own costs, and the Practice pays the auditor.

Harnay tells the Practice at once if it considers that an instruction given in an audit infringes the Data Protection Laws.

15. COUNTRY-SPECIFIC TERMS

15.1 How this clause works. The rest of this DPA applies to every Practice. This clause adds what the Data Protection Law of the Practice's country requires in addition. Each party complies with the Data Protection Laws that apply to it.

15.2 European Union. For a Practice established in Cyprus, Spain, Greece, Italy or Portugal, this DPA is the contract required by Article 28(3) of the GDPR, and the Practice's supervisory authority is the authority of its own Member State. Harnay's lead supervisory authority is the French Commission nationale de l'informatique et des libertés (CNIL).

15.3 United Arab Emirates. For a Practice established in the United Arab Emirates, outside the financial free zones that have their own data-protection law, Harnay acts as the Practice's processor under the UAE PDPL. Harnay processes the Practice Records only on the Practice's instructions and for the purposes in Annex 1, applies the measures in Annex 3, notifies the Practice of breaches as clause 12 describes, and deletes the Practice Records as clause 13 describes. The Practice remains responsible for any notification to the UAE Data Office and to data subjects, and for the lawfulness of transferring the Practice Records to Harnay outside the United Arab Emirates.

15.4 Singapore. For a Practice in Singapore, Harnay acts as the Practice's data intermediary under the PDPA. Harnay's Data Protection Officer for the purposes of the PDPA is Brahim Ouasti, at privacy@harnay.com. Harnay protects the Practice Records by reasonable security arrangements, ceases to retain them when they are no longer needed for the purposes in Annex 1, as clause 13 describes, and notifies the Practice without undue delay, and within the 48 hours in clause 12.1, when it has reason to believe a data breach has occurred in relation to them. The Practice remains responsible for assessing whether a breach is notifiable and for notifying the Personal Data Protection Commission and affected individuals within the time the PDPA requires. For the Transfer Limitation Obligation, this DPA binds Harnay, and through their contracts its Sub-processors, to give the Practice Records a standard of protection comparable to that of the PDPA.

15.5 Australia. For a Practice in Australia that is bound by the Privacy Act 1988, Harnay handles the Practice Records consistently with the Australian Privacy Principles that apply to their security, use, disclosure and overseas disclosure, and helps the Practice assess a suspected eligible data breach under the Notifiable Data Breaches scheme within the 30 days that scheme allows. The Practice remains responsible for notifying the Office of the Australian Information Commissioner and affected individuals.

15.6 New Zealand. For a Practice in New Zealand, Harnay holds the Practice Records as the Practice's agent for the purposes of section 11 of the Privacy Act 2020, solely to provide the service, and does not use or disclose them for its own purposes. The Practice remains responsible for notifying a notifiable privacy breach to the Privacy Commissioner and affected individuals.

16. LIABILITY

16.1 The Practice Terms apply. Each party's liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the exclusions and limits in clause 21 of the Practice Terms, and counts towards the single cap set there. This DPA does not create a second cap.

16.2 Data subjects and authorities. Nothing in this DPA limits either party's liability to data subjects under Article 82 of the GDPR or under the other Data Protection Laws, or the rights of data subjects under the Standard Contractual Clauses. Each party bears any fine imposed on it by a supervisory authority.

17. TERM, LAW AND CHANGES

17.1 Term. This DPA takes effect when the Practice accepts the Practice Terms and lasts for as long as Harnay processes Practice Records. Clauses 12, 13, 14 and 16 survive for as long as they are relevant.

17.2 Law and courts. This DPA is governed by French law, and the courts of Pontoise, France, have exclusive jurisdiction, as clause 24 of the Practice Terms provides, except where the Standard Contractual Clauses provide otherwise.

17.3 Changes. Harnay may change this DPA as clause 23 of the Practice Terms describes, with at least 30 days' notice of a material change, except for a change to Annex 2, which follows clause 8.3. No change may reduce the protection this DPA gives the Practice Records below what the Data Protection Laws require.

18. CONTACT

Brahim Ouasti EI, trading as Inumbra Labs
Individual entrepreneur (entrepreneur individuel) registered in France (RNE), SIREN 538 543 034, intra-community VAT number FR24538543034
Privacy contact, data protection and incidents: Brahim Ouasti, privacy@harnay.com

ANNEX 1. DETAILS OF THE PROCESSING

Subject matter. Hosting and handling the Practice Records so that the Practice can hold video Consultations with its clients through Harnay Pro, record its in-person consultations with Vetty Scribe, keep its client and patient records, and receive draft consultation reports for its Veterinarians to review and sign.

Duration. For as long as the Practice uses Harnay Pro, then until the deletion described in clause 13. The audio of a Consultation is kept only until it is transcribed, and at most 24 hours if the Consultation does not complete. The audio of a Vetty Scribe recording is kept as clause 7.11 describes.

Nature of the processing. Collection, recording, storage, organisation, transcription by speech-to-text, automated drafting by AI models, display to the Practice's Members, transmission of signed reports to Clients, export, and deletion. Live audio and video are transmitted but not stored, except each Participant's microphone audio, which is recorded until it is transcribed. For Vetty Scribe: recording in the Veterinarian's browser and uploading, transcription, extraction of the clinical facts, drafting, checking against the transcript, translation or adaptation to the Veterinarian's style, editing, signing and versioning.

Purposes. To provide the Consultation and its chat; to tell each Participant before joining that the Consultation is recorded, and to record each join; to record, transcribe and draft a report for the Veterinarian's review, from a Consultation or from an in-person consultation recorded with Vetty Scribe; to deliver the signed report to the Client; to keep, display and export the Practice's client and patient records; and to delete them at the end of the retention period or of the service.

Categories of data subjects.

• the Practice's clients (pet owners), including people it adds or imports to the Portal;
• Guests whom a Client invites to a Consultation;
• anyone whose voice a Vetty Scribe recording captures, such as the client and anyone with them;
• the Practice's Members, as far as they appear in the Practice Records (for example as the author or signer of a note or report, or as a voice in a recording).

Animals are not data subjects, but the data about them is linked to their owners.

Categories of personal data.

• identity and contact details of clients: name, email address, phone number, and postal addresses where given;
• patient data linked to the client: the animal's name, species, breed, date of birth, sex, neuter status, weight, microchip number, photo, allergies, medications, chronic conditions and history;
• intake answers and attachments (images);
• chat messages and files (images and PDF documents);
• the audio of each Participant's microphone, their name as shown in the call, and the record of each Participant's joining, with its time and the version of the recording notice shown;
• the transcript, with speakers identified by role;
• the draft and signed report, the Veterinarian's notes and the Practice's notes;
• files the Practice adds to appointments;
• for Vetty Scribe: the audio of the consultation and everything said in it; the confirmation that the client consented, with its time; the transcript and the raw speech-to-text result; the facts extracted; the draft and signed report, with its versions, audit trail and the Veterinarian's signature.

Special categories. The Practice Records are not intended to contain special categories of personal data. A Consultation may reveal some incidentally, for example a fact about a Client's health mentioned during the call, and Harnay applies the same measures to it. Harnay does not use voices to identify anyone.

Frequency. Continuous, for as long as the Practice uses Harnay Pro.

Competent supervisory authority for Harnay. The Commission nationale de l'informatique et des libertés (CNIL), France.

ANNEX 2. SUB-PROCESSORS

These Sub-processors process Practice Records for Harnay Pro on the date of this DPA. Each is engaged under clause 8. In the last column, 'DPF or SCCs' means the EU–US Data Privacy Framework where the Sub-processor is certified under it, otherwise the standard contractual clauses (Module 3), as clause 10.1 describes.

Stripe is not a Sub-processor under this DPA. The Practice contracts with Stripe directly for its Stripe Account, and Harnay's own use of Stripe data is covered by its Privacy Policy.

ANNEX 3. TECHNICAL AND ORGANISATIONAL MEASURES

Location and hosting. The Practice Records are stored in the European Union, in Frankfurt, Germany, with an established hosting provider whose storage is encrypted at rest.

Encryption in transit. All traffic to harnay.com and pro.harnay.com is served over HTTPS, and browsers are told to use HTTPS only (HTTP Strict Transport Security). Video and audio are carried over encrypted WebRTC connections.

Access control. Database access rules limit each user to the data of their own Practice or their own account, and each new table and function is given explicit access rights. Practice Records are held in private storage. A Member's access to the Practice Records ends at once when they are removed or leave. Administrators control who belongs to the Practice and in which role.

Consultation audio. The audio is kept in a separate private storage area that no user account can reach, only Harnay's servers. Each upload credential is limited to a single file and expires after 6 hours. The audio is deleted once the transcript is stored, and the Participant's name is then cleared from the recording's record. Video and screen sharing are never recorded.

Vetty Scribe. A recording cannot start without the Veterinarian's confirmation that the client consented, and a report cannot be signed without it. Vetty Scribe audio, voice samples and exports are held in private storage and reached only through authenticated requests. A Vetty Scribe consultation is visible only to the Veterinarian who recorded it and the Practice's Administrators. The speech-to-text provider receives the audio through a signed link that expires after one hour. Each report keeps its versions and an audit trail of the events on the consultation, including signing and amendment. Audio is saved in the recording device's browser storage before it is uploaded, so that a dropped connection does not lose a consultation.

Files. Files are reached through signed links that expire after 6 hours, or through authenticated requests to Harnay's servers. Exports are downloaded only through an authenticated request, never through a public link. The type of each uploaded file is checked from its content, and sizes are limited.

Authentication. Every email address is confirmed with a one-time code before use. Passwords must have at least 8 characters and are stored by the authentication service in hashed form. Members may sign in with Google instead. Sign-up and other sensitive requests are rate-limited.

Operator access. Harnay's operator console can be used only by named operator accounts that Harnay has authorised, and each operator action is written to an audit log.

Payment data. Card data is collected and held by Stripe and never reaches Harnay's servers.

Data minimisation and retention. Consultation audio is deleted once transcribed, and Vetty Scribe audio as clause 7.11 describes. Writing samples are de-identified before they are stored. The speech-to-text provider's copy of each transcript is deleted once retrieved. Consultation content is deleted 5 years after the Client's last Consultation with the Practice, and the Practice Records 30 days after the Practice is closed, as clause 13 describes. Backups are overwritten within 30 days.

Sub-processors. Each Sub-processor is engaged under a written contract with data-protection obligations, and none may train AI models on the Practice Records.

People. Everyone Harnay authorises to process Practice Records is bound by confidentiality. Brahim Ouasti is responsible for data protection and for handling incidents.