← All legal documents

Data Processing Agreement

Effective Date: 2026 • Last Updated: 2026

This Data Processing Agreement ("DPA") is entered into between:

LEGAL_ADDRESS=, a company incorporated under the laws of the Federal Democratic Republic of Ethiopia ("LEGAL_ADDRESS=", "we", "us", or "Processor");

and

The pharmacy, healthcare organization, business, or other entity accepting this Agreement ("Customer", "you", or "Controller").

LEGAL_ADDRESS= and the Customer are individually a "Party" and collectively the "Parties."

This DPA forms part of and is incorporated into the LEGAL_ADDRESS= Terms of Service.

1. Purpose and Scope

This DPA governs the processing of Personal Data by LEGAL_ADDRESS= on behalf of the Customer in connection with the LEGAL_ADDRESS= pharmacy management platform and related services.

The purpose of this DPA is to establish the respective responsibilities of the Parties regarding the collection, access, storage, use, security, disclosure, retention, and deletion of Personal Data processed through the LEGAL_ADDRESS= platform.

This DPA applies only to Personal Data processed by LEGAL_ADDRESS= on behalf of the Customer.

Where LEGAL_ADDRESS= processes information for its own independent business purposes, including account administration, billing, security, fraud prevention, legal compliance, and operation of its own business, LEGAL_ADDRESS= may act as an independent Data Controller for that processing.

2. Definitions

For purposes of this DPA:

  • "Personal Data" means information relating to an identified or identifiable natural person.
  • "Data Subject" means the individual to whom Personal Data relates.
  • "Controller" means the person or organization that determines the purposes and means of processing Personal Data.
  • "Processor" means a person or organization that processes Personal Data on behalf of a Controller.
  • "Processing" includes collecting, recording, organizing, storing, retrieving, using, disclosing, transmitting, modifying, restricting, deleting, or otherwise handling Personal Data.
  • "Security Incident" means an event resulting in or reasonably suspected to result in unauthorized access, disclosure, alteration, loss, destruction, or compromise of Personal Data.
  • "Sub-processor" means a third party engaged by LEGAL_ADDRESS= to process Personal Data on behalf of the Customer.

The terms in this DPA are intended to be interpreted consistently with applicable Ethiopian data-protection law, including the Personal Data Protection Proclamation No. 1321/2024.

3. Roles of the Parties

3.1 Customer as Controller

The Customer is responsible for determining:

  • what Personal Data is collected;
  • why the Personal Data is collected;
  • the lawful basis for processing;
  • which individuals may access the data;
  • how long the data should be retained; and- whether the processing is appropriate for the Customer's business and legal obligations.

The Customer remains responsible for obtaining any required notices, permissions, consents, or other legal authorizations necessary for its processing activities.

3.2 LEGAL_ADDRESS= as Processor

LEGAL_ADDRESS= will process Personal Data on behalf of the Customer only as necessary to:

  • provide the LEGAL_ADDRESS= services;
  • maintain and operate the platform;
  • provide technical support;
  • maintain security;
  • perform backups;
  • prevent fraud and abuse;
  • troubleshoot technical problems; and
  • comply with lawful instructions and applicable law.

4. Customer Instructions

LEGAL_ADDRESS= will process Customer Personal Data according to:

  1. this DPA;
  2. the Terms of Service;
  3. the Customer's documented instructions; and
  4. applicable law.

The Customer is responsible for ensuring that its instructions are lawful.

LEGAL_ADDRESS= may refuse an instruction where carrying out the instruction would violate applicable law or create an unreasonable security or technical risk.

5. Categories of Personal Data

Depending on how the Customer uses LEGAL_ADDRESS=, Personal Data may include:

Staff information

  • name;
  • telephone number;
  • email address;
  • username;
  • role;
  • permissions;
  • employment-related account information;
  • login and security information.

Customer information

Where the Customer chooses to record it:

  • name;- telephone number;
  • customer account information;
  • transaction information;
  • loyalty or purchase information.

Pharmacy operational information

  • sales records;
  • transaction records;
  • user activity;
  • supplier information;
  • branch information;
  • audit logs.

Patient-related information

LEGAL_ADDRESS= may technically support information entered by a Customer relating to patients.

Customers must not enter unnecessary patient or health information into LEGAL_ADDRESS=.

Where the Customer uses LEGAL_ADDRESS= to process patient-related or other sensitive Personal Data, the Customer is responsible for ensuring that such processing is legally permitted and appropriately authorized.

6. Sensitive Personal Data

The Customer acknowledges that health-related information may constitute sensitive Personal Data and may require additional safeguards and legal requirements.

The Customer shall:

  • minimize the amount of sensitive information entered into LEGAL_ADDRESS=;
  • ensure that processing is legally authorized;
  • restrict access to authorized personnel;
  • maintain appropriate confidentiality controls; and
  • avoid entering sensitive information into fields or features not intended for such information.

LEGAL_ADDRESS= may restrict or disable particular functionality where necessary to maintain legal, security, or operational compliance.

7. Confidentiality

LEGAL_ADDRESS= shall ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

LEGAL_ADDRESS= shall not intentionally disclose Customer Personal Data to unauthorized third parties except:

  • with the Customer's authorization;
  • as necessary to provide the Services;
  • through an authorized Sub-processor;
  • when required by law; or
  • when necessary to protect the security and integrity of the Service.

8. Security Measures

LEGAL_ADDRESS= will maintain reasonable technical and organizational security measures appropriate to the nature and risks of the Personal Data processed.

These measures may include:

  • authentication controls;
  • role-based access controls;
  • password protection;
  • encryption where appropriate;
  • secure communication protocols;
  • access logging;
  • audit mechanisms;
  • backup procedures;
  • vulnerability management;
  • monitoring;
  • incident response procedures; and
  • employee confidentiality obligations.

No internet-based system can be guaranteed to be completely secure.

The Customer acknowledges that security risks may arise from compromised credentials, unauthorized Customer users, third-party infrastructure, malware, telecommunications failures, or other events outside LEGAL_ADDRESS='s reasonable control.

9. Sub-processors

LEGAL_ADDRESS= may use carefully selected third-party service providers to operate the Service.

These may include providers for:

  • cloud hosting;
  • databases;
  • authentication;
  • email;
  • payment processing;
  • analytics;
  • communications;
  • infrastructure;
  • security; and
  • AI or machine-learning services.

LEGAL_ADDRESS= will require applicable Sub-processors to maintain appropriate contractual and security obligations.

The Customer authorizes LEGAL_ADDRESS= to use Sub-processors reasonably necessary to provide the Service.

10. AI Services and Customer Data

Where LEGAL_ADDRESS='s AI Pharmacist Assistant processes information submitted by a Customer, LEGAL_ADDRESS= will process that information according to the applicable Terms, Privacy Policy, and AI Terms.

LEGAL_ADDRESS= will not represent that information submitted to the AI assistant is automatically suitable for use as a patient record or as a substitute for professional clinical judgment.

Customers should avoid submitting unnecessary Personal Data into AI prompts. Where third-party AI infrastructure is used, processing will be subject to the applicable technical, contractual, and legal safeguards.

11. Data Subject Requests

Where LEGAL_ADDRESS= receives a request from a Data Subject relating to Personal Data controlled by the Customer, LEGAL_ADDRESS= may direct the Data Subject to the Customer.

Where reasonably requested, LEGAL_ADDRESS= will provide appropriate technical assistance to enable the Customer to respond to lawful requests concerning:

  • access;
  • correction;
  • deletion;
  • restriction;
  • objection; or
  • other applicable data-protection rights.

The Customer remains primarily responsible for responding to requests concerning Personal Data for which it is the Controller.

12. Security Incidents

LEGAL_ADDRESS= will maintain procedures for detecting and responding to Security Incidents.

Where LEGAL_ADDRESS= becomes aware of a Security Incident affecting Customer Personal Data, LEGAL_ADDRESS= will notify the Customer without undue delay, subject to applicable law and legitimate security considerations.

Where reasonably available, the notification may include:

  • the nature of the incident;
  • categories of affected data;
  • known or suspected impact;
  • mitigation measures;
  • remedial actions; and
  • other information reasonably necessary for the Customer to assess its obligations.

The Customer remains responsible for determining whether notification to regulators, Data Subjects, or other parties is legally required.

13. Data Retention

LEGAL_ADDRESS= will retain Customer Personal Data for as long as reasonably necessary to provide the Service, satisfy contractual obligations, maintain security, comply with legal obligations, resolve disputes, and enforce agreements.

Upon termination, LEGAL_ADDRESS= will handle Customer Personal Data in accordance with the Terms of Service and applicable data-retention requirements.

The Customer is responsible for exporting information it requires before account termination.

14. Data Deletion

Following termination of the Customer's account, LEGAL_ADDRESS= may delete or anonymize Customer Personal Data after the applicable retention period.

LEGAL_ADDRESS= may retain limited information where necessary for:

  • legal compliance;
  • fraud prevention;- security;
  • dispute resolution;
  • accounting;
  • tax;
  • enforcement of contractual rights.

15. Data Location and International Transfers

LEGAL_ADDRESS= may use infrastructure or service providers located inside or outside Ethiopia.

Where Personal Data is transferred outside Ethiopia, LEGAL_ADDRESS= will implement the safeguards and requirements applicable under Ethiopian law.

The Parties acknowledge that Ethiopian law contains requirements concerning data sovereignty and cross-border transfers, including specific provisions concerning sensitive Personal Data.

LEGAL_ADDRESS= will not knowingly structure its processing to circumvent applicable data-protection requirements.

16. Customer Responsibilities

The Customer is responsible for:

  • securing its accounts;
  • protecting login credentials;
  • controlling employee access;
  • ensuring appropriate user permissions;
  • ensuring lawful collection and use of Personal Data;
  • obtaining required permissions or consents;
  • providing required privacy notices;
  • entering accurate information;
  • avoiding unnecessary sensitive information;
  • complying with pharmacy and healthcare requirements; and
  • promptly reporting suspected unauthorized access.

17. Audit and Compliance

Upon reasonable written request, LEGAL_ADDRESS= may provide information reasonably necessary to demonstrate compliance with this DPA.

Any audit must:

  • provide reasonable advance notice;
  • occur during normal business hours;
  • avoid unnecessary disruption;
  • protect confidential information; and
  • not expose the security systems of LEGAL_ADDRESS= or other customers.

Where appropriate, LEGAL_ADDRESS= may satisfy audit requests through security documentation, policies, certifications, questionnaires, or similar materials.

18. Liability

Nothing in this DPA excludes liability that cannot lawfully be excluded. Subject to applicable law, LEGAL_ADDRESS='s liability shall be governed by the limitation-of-liability provisions contained in the Terms of Service.

The Customer remains responsible for unlawful or unauthorized processing conducted through its account or by its personnel.

19. Term and Termination

This DPA begins when the Customer accepts the Terms of Service or otherwise begins using LEGAL_ADDRESS=.

It remains effective for as long as LEGAL_ADDRESS= processes Personal Data on behalf of the Customer.

Termination of the Customer's LEGAL_ADDRESS= account terminates this DPA except for provisions that by their nature survive termination.

20. Governing Law

This DPA shall be governed by the laws of the Federal Democratic Republic of Ethiopia, unless otherwise required by applicable law or agreed in writing by the Parties.

21. Changes to this DPA

LEGAL_ADDRESS= may update this DPA where reasonably necessary due to:

  • changes in the Service;
  • changes in technology;
  • changes in applicable law;
  • regulatory requirements;
  • security improvements; or
  • changes to LEGAL_ADDRESS='s business operations.

Material changes will be communicated through appropriate channels.

22. Contact

  • Company: LEGAL_ADDRESS=
  • Email: PRIVACY_EMAIL=
  • Address: [Business Address]