ANAMNESIS · AIAgens

Data Processing Agreement (DPA)

v1.0 Effective: 29 April 2026 Download PDF

This Data Processing Agreement (DPA) governs the processing of personal data between you (Controller: physician / clinic) and AIAgens, a brand of Exatoshi AG (Processor) in the context of the Anamnesis medical-scribe solution. It meets the requirements of GDPR art. 28 and FADP art. 9.

1. Contracting parties

Controller and Processor

Controller: the physician or clinical establishment using Anamnesis in their daily practice.

Processor: Exatoshi AG, Piazza Cioccaro 4, 6900 Lugano TI, Schweiz · CHE-266.634.159

2. Subject matter and duration

Processing activities

Anamnesis records and transcribes voice from a medical consultation and produces a structured documentation draft (SOAP) for final validation by the Controller. No diagnostic codes, treatment proposals or billing codes are generated. Processing lasts for the duration of the subscription and ends per section 12.

3. Categories of personal data

Processed data types (special categories art. 9 GDPR)

Consultation audio recordings
Clinical transcripts (anamnesis, symptoms, findings)
Medications and examinations mentioned during the consultation
Patient names where mentioned in conversation

No biometric identifiers (voiceprint) are persisted outside the ASR pipeline.

4. Categories of data subjects

Patients and physicians

Patients of the practice / clinic
Treating physicians and medical staff

5. Processor obligations

Confidentiality, security, sub-processors

Processing only on documented Controller instruction.
Confidentiality undertaking for all persons handling data.
Appropriate technical and organisational measures (section 7).
Assistance to Controller for GDPR art. 32-36.
Sub-processors only per list (section 8) with prior notice.

6. Data subject rights

Access, rectification, erasure, portability, objection

Processor assists Controller without delay on GDPR art. 15-21 requests. Self-service endpoints at /anamnesis/privacy. SLA: tombstone within 24h, physical erasure within 7 days.

7. Technical and organisational measures

Encryption, access control, audit

Data at rest: AES-256-GCM with MultiFernet key rotation.
In transit: TLS 1.3 only.
Servers in Switzerland (eu-central-2, Zurich) by default.
Immutable audit log with hash chain.
PostgreSQL Row-Level Security (RLS) for multi-tenant isolation.
MFA for staff access, JIT privileges, audit trail.

8. Sub-processor list

Current and approved sub-processors

The current list is at /legal/anamnesis/subprocessors. Any change is announced by email with 30-day notice.

9. International data transfers

CH/EU default, SCC for exceptions

Processing is limited to Switzerland and the European Union by default. Any transfer to a sub-processor outside the EEA relies exclusively on the EU Standard Contractual Clauses (SCC 2021) and the Swiss FDPIC addendum; the applicable recipients and locations are set out in the sub-processor list.

10. Breach notification

72-hour SLA, FDPIC and supervisory authorities

In case of a personal-data breach, the Processor notifies the Controller without undue delay and within 72 hours of awareness (GDPR art. 33). In Switzerland the FDPIC notification obligation under FADP additionally applies. Operational escalation follows runbook docs/anamnesis_breach_response_sop.md.

11. Controller audit right

Self-assessment, third-party reports, on-site audit

The Controller may exercise audit right yearly. By default, AIAgens, a brand of Exatoshi AG, provides current SOC 2 Type II / ISO 27001 third-party reports and a documented security dossier. On-site audits permitted with 30-day notice at Controller's cost.

12. Return and erasure of data

End-of-contract procedure

On contract termination, the Processor returns or deletes (at Controller's choice) all personal data within 30 days, unless retention is legally required. A written certificate of deletion is provided.

13. Governing law and venue

Swiss law, Lugano TI

Swiss law applies. Exclusive venue: Lugano TI, Switzerland.