Data Processing Agreement

1. Roles

BedWatch Africa acts as:

• Data Controller for subscriber personal data
• Data Processor when processing data on behalf of institutional account holders
• Joint Controller with government partners for aggregated health intelligence data

2. Processing Activities

Processing activities covered by this DPA include:

• Storage and retrieval of subscriber profile data
• Processing of emergency routing requests
• Generation of insurance documentation
• Aggregation of health facility capacity data
• Transmission of anonymised data to intelligence dashboards

3. Data Protection Obligations

BedWatch Africa commits to:

• Processing personal data only as instructed by the Data Controller or as required by law
• Implementing appropriate technical and organisational security measures
• Not engaging sub-processors without prior written consent from the Data Controller
• Assisting Data Controllers in fulfilling data subject rights requests
• Notifying the Data Controller within 72 hours of becoming aware of a personal data breach
• Deleting or returning all personal data at the end of the processing relationship

4. International Transfers

Where personal data is transferred outside Ghana or the European Economic Area, BedWatch Africa will ensure appropriate safeguards are in place including Standard Contractual Clauses, adequacy decisions, or other approved transfer mechanisms.

5. Audit Rights

Data Controllers may audit BedWatch Africa’s data processing practices with 30 days’ written notice. BedWatch Africa will cooperate with reasonable audit requests and provide relevant documentation.