1. You authorize CDoctorsTeams to use the sub-processors listed in Annex II to provide the service. 2. CDoctorsTeams will notify you on the Platform at least 15 days before adding or replacing a sub-processor. 3. If you disagree with the change, you may object or close your account before it takes effect, after exporting your data. 4. Each sub-processor is contractually bound to data protection obligations equivalent to those in this agreement.

6. International transfers

Data may be processed in the United States and in the hosting region listed in Annex II. Where the law of your country requires it, CDoctorsTeams will use a valid transfer mechanism, such as standard contractual clauses.

7. Other data

This agreement only covers your patients' data that you process on the Platform. Each User's account data, and the Optional Health Data a General User enters in their own profile, are processed by CDoctorsTeams, LLC and the Local Entity as controllers, under the Terms and Conditions and the Privacy Policy.

8. End of processing

1. Before closing your account or canceling your membership, you can export your Consultation Notes. 2. After your account is closed, CDoctorsTeams keeps your patients' data for 90 days so you can recover it, and then deletes it, unless a law requires it to be kept. In that case, it keeps the data blocked and uses it only to meet that obligation. 3. Backups are deleted according to their normal rotation cycle.

9. Liability

Each party is liable for its own breaches of this agreement and of data protection law. Otherwise, the limitations of liability in the Terms and Conditions apply, without prejudice to obligations imposed directly by law.

10. United States

When telemedicine is active in the United States and the Professional is a HIPAA covered entity, the Professional must also sign a Business Associate Agreement (BAA) with CDoctorsTeams before using the Clinical Features. That agreement prevails over this one on the matters it governs.

11. Governing law and changes

1. This agreement is governed by the law stated in the Terms and Conditions, without prejudice to the data protection laws of your country, which prevail in case of conflict. 2. If CDoctorsTeams changes this agreement, it will publish a new version and ask you to accept it. Until you do, the previous version remains in effect. 3. On matters of your patients' data protection, this agreement prevails over the Terms and Conditions.

---

Annex I. Security measures

• Encryption of data in transit (TLS) and at rest.
• Access control by user and role: each Professional only sees their own patients' data.
• Patients can never see the full transcript of their consultation.
• Permanent deletion of the full transcript when the Consultation Note is finalized or after 14 days.
• Activity logs that do not store clinical content, only the event type, date and identifiers.
• Strong authentication for CDoctorsTeams staff with system access.
• Regular backups.
• Incident response and breach notification procedure.
• Periodic review of these measures.

Annex II. Sub-processors