Data Processing Agreement (DPA)

<aside>

This Data Processing Agreement ("Agreement") forms part of the Principal Service Agreement ("Principal Agreement") between Alos Health (the "Data Processor") and XXXXX (the "Company") (referred to together as the "Parties"). WHEREAS

(A) The Company acts as a Data Controller.

(B) The Company wishes to subcontract certain Services, which imply the processing of personal data, to the Data Processor in accordance with Annex 1 to this Agreement.

(C) The Parties seek to implement a data processing agreement that complies with the requirements of the current legal framework in relation to data processing, specifically Regulation (EU) 2016/679 (General Data Protection Regulation - "GDPR").

(D) The Parties wish to lay down their rights and obligations.

</aside>

IT IS AGREED AS FOLLOWS:

Definitions and Interpretation

Processing of Company Personal Data

Processor Personnel

Security

Subprocessing

Data Subject Rights

Personal Data Breach

Data Protection Impact Assessment (DPIA)

Deletion or Return of Personal Data

Audit Rights

Data Transfer

Governing Law and Jurisdiction