Purpose
This agreement ("the Agreement") governs the processing of personal data that AnzarSeha ("the Processor") carries out on behalf of the client institution or clinician ("the Controller"), within the Service. It meets the requirements of Article 28 of the General Data Protection Regulation and the equivalent obligations of Moroccan Law No. 09-08.
It supplements the Terms of Service; in the event of conflict over the processing of patient data, the Agreement prevails.
Definitions
The terms "personal data", "processing", "controller", "processor", "data breach" and "data subject" have the meaning given by Law No. 09-08 and the GDPR. The "data subject" mainly refers to the patient whose data is processed in a study.
Roles of the parties
Scope of processing
| Nature of processing | Hosting, structuring, assisted extraction, export and retention of clinical research data. |
| Purpose | To enable the Controller to build and use a traceable research dataset. |
| Categories of data | Pseudonymised identifying data, clinical and health data, source documents. |
| Categories of persons | Patients included in the Controller's studies. |
| Duration | The duration of the relationship, unless otherwise instructed by the Controller. |
Documented instructions
AnzarSeha processes the data only on the Controller's documented instructions, including for transfers, save for a legal obligation to which it is subject (in which case it informs the Controller, unless legally prohibited). The study parameters, protocol locking, database freeze and consent decisions constitute such instructions.
Confidentiality
AnzarSeha ensures that persons authorised to process the data commit to confidentiality and are bound by an appropriate obligation. Internal access to the data is limited to what is strictly necessary.
Security measures
AnzarSeha implements the following technical and organisational measures, suited to the risk posed by health data:
- Partitioning — row-level security closed by default; each study is isolated; the application API is the only door in; the browser holds no key.
- Encryption — in transit (HTTPS) and at rest at the infrastructure level.
- Traceability — hash-chained audit log: any alteration of a past entry is detectable (ALCOA+-type integrity).
- Authentication — named accounts, email confirmation, administrative approval, sign-in attempt limiting.
- Minimisation — pseudonymisation of direct identifiers before any external processing.
- Hosting — data residing on European Union infrastructure.
Sub-processors
The Controller authorises AnzarSeha to use the sub-processors listed below. AnzarSeha imposes equivalent protection obligations on them and informs the Controller of any intended change, giving it the opportunity to object on legitimate grounds.
| Sub-processor | Processing entrusted | Location |
|---|---|---|
| Supabase | Database, storage, authentication | European Union |
| Vercel | Application hosting | United States / global network |
| Brevo (Sendinblue) | Transactional emails | European Union |
| Cloudflare | DNS, edge security | Global network |
| Google (Gemini) / Anthropic | Assisted extraction on pseudonymised text | Outside the European Union |
International transfers
Any transfer outside Morocco or the European Union is covered by appropriate safeguards (standard contractual clauses or an equivalent mechanism). Patient data resides in the European Union; only pseudonymised extracts may be transmitted, with consent, to an AI model located outside the Union.
Processing by artificial intelligence
When an extraction feature calls on an external model:
- the text is pseudonymised beforehand — direct identifiers are removed;
- a consent gate, recorded in the log, precedes each request;
- no value produced by a model is retained without human validation and a verified citation of its source;
- the data transmitted is not used to train the providers' models, subject to those providers' contractual commitments.
Assistance to the controller
Given the nature of the processing, AnzarSeha assists the Controller:
- in responding to data-subject rights requests (access, rectification, erasure, portability) through the export and management features;
- with security, breach notification and, where applicable, the data-protection impact assessment;
- by making available the information needed to demonstrate compliance with its obligations.
Breach notification
In the event of a personal-data breach affecting the data processed for the Controller, AnzarSeha informs the Controller without undue delay after becoming aware of it, with the information needed to enable the Controller, where applicable, to notify the supervisory authority within the applicable time limits (72 hours under the GDPR).
Fate of the data
At the end of the relationship, and at the Controller's choice, AnzarSeha returns the data in a usable open format, or deletes it, together with existing copies, save for a legal retention obligation. The return relies on the Service's export features.
Audit
AnzarSeha makes available to the Controller the information needed to demonstrate compliance with this Agreement and allows for audits, including inspections, by the Controller or a mandated third party, under reasonable conditions that preserve the security and confidentiality of other clients.
Moroccan specifics (CNDP)
The processing of health data in Morocco is subject to the prior authorisation of the CNDP. This obligation lies with the Controller. AnzarSeha, as processor, complies with its own declaration obligations and provides the Controller with the technical information useful for its process. AnzarSeha does not substitute for the Controller in obtaining this authorisation.