Common use of VIDEO CONSULTATIONS Clause in Contracts

VIDEO CONSULTATIONS. The video consultation service provided through the accuRx platform is hosted by Whereby who are compliant with GDPR and based in the European Economic Area (EEA). A unique URL to the video consultation is generated and all participants are visible in the consultation, no third party can 'listen in'. The video and audio communication of the video consultation is only visible to participants on the call, and is not recorded or stored on any server (not accuRx’s, not Whereby’s and not on any third party's servers). All communication between participants’ devices and Whereby’s service is transmitted over an encrypted connection (secure web traffic using HTTPS and TLS or secure websocket traffic or secure WebRTC). The video consultation connection either: ● connects participants to one another, relaying the encrypted data content through Whereby’s TURN server, where it is not retained beyond this relay operation; or ● connects devices using ‘peer-to-peer’ connections between devices. In both cases, as long as the participants are using their devices in the European Economic Area, it is guaranteed that any data is hosted and processed within the EEA, in line with NHS best practice guidelines on health and social care cloud security. The data collected about patients is limited to that necessary to provide the meeting room service, and includes: ● Display name (if enabled and the user chooses to set one) ● Video meeting URL accessed ● Technical logs - information will be recorded in technical logs when the service is used. These logs will contain: ○ IP address ○ Time of registered actions ○ Browser type and version Technical logs are purged after 90 days, sufficient to allow accuRx as the Data Processor to assist the Data Controller to complete investigations into data protection or clinical safety incidents. Whereby’s Data Processing Agreement (available on their Data Storage and Security page) details the commitments it makes to us when we contract with them as a sub-processor.

VIDEO CONSULTATIONS. The video consultation service provided through the accuRx AccuRx platform is hosted by Whereby who are compliant with GDPR and based in the European Economic Area (EEA). A unique URL to the video consultation is generated and all participants are visible in the consultation, no third party can 'listen in'. The video and audio communication of the video consultation is only visible to participants on the call, and is not recorded or stored on any server (not accuRxAccuRx’s, not Whereby’s and not on any third party's servers). All communication between participants’ devices and Whereby’s service is transmitted over an encrypted connection (secure web traffic using HTTPS and TLS or secure websocket traffic or secure WebRTC). The video consultation connection either: ● connects participants to one another, relaying the encrypted data content through Whereby’s TURN server, where it is not retained beyond this relay operation; or ● connects devices using ‘peer-to-peer’ connections between devices. In both cases, as long as the participants are using their devices in the European Economic Area, it is guaranteed that any data is hosted and processed within the EEA, in line with NHS best practice guidelines on health and social care cloud security. The data collected about patients is limited to that necessary to provide the meeting room service, and includes: ● Display name (if enabled and the user chooses to set one) ● Video meeting URL accessed ● Technical logs - information will be recorded in technical logs when the service is used. These logs will contain: contain information such as, but not restricted to ○ IP address ○ Time of registered actions ○ Browser type and version Technical logs are purged after 90 days, sufficient to allow accuRx AccuRx as the Data Processor to assist the Data Controller to complete investigations into data protection or clinical safety incidents. Whereby’s Data Processing Agreement (available on their Data Storage and Security page) details the commitments it makes to us when we contract with them as a sub-processor.