DentalX Back to home

Argentina Annex: Processor Terms

ANX-AR · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

Convenience translation: the Español text controls.

Read in: English · Español

SHA-256 of this text: 80e856801b699521a6909de04eda1a5fb16e008ee151a302cfae1766067e5e25

Argentina — ANX-AR (Argentina Annex) and TM-AR (Model Contract, Disp. 60-E/2016)

Document IDs: ANX-AR v1.0 and TM-AR v1.0 · Effective date: [[TO CONFIRM: publication date]] Language: Spanish controls (es/annex-ar.md). This English text is a convenience translation. Applies to: Clinics established in the Argentine Republic. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.

Reading order in the bundle: MDPA → ANX-AR (Part I) → TM-AR (Part II).

PART I — ANX-AR: Processor ("encargado") terms

1. Legal framework

This Annex implements, for the Clinic as responsable of the database and VstreamX as the provider of computerised data-processing services, the following:

  • Article 25 of Law 25.326 on the Protection of Personal Data ("Law 25.326");
  • Article 25 of its Regulatory Decree 1558/2001; and
  • Law 26.529 on Patients' Rights, Medical Records and Informed Consent ("Law 26.529").

2. Use only for the Clinic

VstreamX:

  • processes the Clinic Data only on the Clinic's instructions and for the purposes in MDPA Schedule 1;
  • does not apply or use it for any other purpose; and
  • does not assign (ceder) it to other persons, not even for its storage, except to the Sub-processors listed in MDPA Schedule 3 under clause 4 of TM-AR (Law 25.326, Art. 25.1).

3. Security levels

3.1 Measures. VstreamX applies the measures in MDPA Schedule 2. Taking into account that the database contains sensitive health data, those measures meet the security level that Law 25.326, Article 9 and the regulations of the Agency for Access to Public Information ("AAIP") require, including the measures recommended by AAIP Resolution 47/2018.

3.2 Required specification. Decree 1558/2001, Article 25 requires the contract to specify the security levels. The Parties specify them as those in MDPA Schedule 2, which forms part of this Annex.

4. Confidentiality

  • Who is bound. VstreamX, its personnel and its Sub-processors are bound by professional secrecy over the Clinic Data, as Law 25.326, Article 10 provides, and by MDPA clause 5.
  • How long it lasts. That duty survives the end of the relationship.

5. End of the service: destruction or retention by express instruction

5.1 Destruction. Once the service has been provided, the Clinic Data is destroyed, as MDPA clause 14 provides, after the complete export has been made available to the Clinic (Law 25.326, Art. 25.2).

5.2 Retention only by express instruction. VstreamX keeps Clinic Data after the end of the service only where the Clinic expressly instructs it to do so because further services may be engaged. In that case:

  • the Clinic gives the instruction in writing in the Service;
  • the data is kept, with due security, for no more than two years; and
  • it is then destroyed.

5.3 Backups and audit trail.

  • Backups. Copies in backups expire within seven days of the destruction (MDPA clause 14.5(a)).
  • Audit trail. The audit trail is kept for seven years only with the details that could identify a patient removed, so that it is no longer personal data. [[TO CONFIRM: counsel's confirmation that the de-identified audit trail falls outside Law 25.326 Art. 25.2]]

6. Medical records

6.1 The Clinic's duty to keep them. The Clinic must keep its medical records for at least 10 years from the last entry (Law 26.529, Art. 18). Provincial rules may require longer periods [[TO CONFIRM: provincial retention periods for dental records in the main provinces]]. DentalX does not auto-delete clinical records.

6.2 Computerised records. For records kept in computerised form, the Service keeps an audit trail of changes. It does not permit an entry to be altered without a record of the change, in support of the integrity, authenticity and unalterability that Law 26.529, Article 13 requires. [[TO CONFIRM: that field-level change history (before/after values) is recorded for clinical entries; if not, a roadmap date]]

7. Prescriptions

DentalX is not registered in the National Registry of Digital Health Platforms (ReNaPDiS) under Law 27.553 and its regulations. Prescriptions produced by DentalX are therefore not valid electronic prescriptions for dispensing. The Service either disables them for Argentine Clinics or labels them as non-dispensable drafts. [[TO CONFIRM: which of the two product options applies at publication]]

8. Data subject rights

VstreamX assists the Clinic within 5 business days, as MDPA clause 8 provides. This allows the Clinic to answer requests for access within 10 calendar days (Law 25.326, Art. 14) and requests for rectification, updating or suppression within 5 business days (Art. 16). For the rectification clock, VstreamX acts on the Clinic's request without delay, and the Service lets the Clinic perform the change itself.

9. Registration and legend

9.1 Registration of the database. The Clinic is responsible for registering its database with the National Registry of Personal Databases. VstreamX provides the information on itself and its Sub-processors that the registration requires (MDPA clause 11.2).

9.2 The AAIP legend. DentalX includes the legend required by AAIP (formerly DNPDP) Disposition 10/2008 in the patient-facing forms it generates for Argentine Clinics.

10. Sub-processors: prior written consent

  • Consent given at acceptance. The Clinic's acceptance of TM-AR is its prior written consent to the Sub-processors listed in MDPA Schedule 3.
  • New Sub-processors. Any new Sub-processor requires the Clinic's prior written consent in the Service under MDPA clause 7.5. The 30-day objection mechanism in MDPA clause 7.4 does not replace that consent.

11. Governing law and jurisdiction for data protection

  • What applies. For all matters concerning the protection of personal data, this Annex and TM-AR are governed by Argentine law. They are subject to the jurisdiction that TM-AR designates.
  • No waiver. Nothing in the Terms or the MDPA waives the rights of data subjects under Law 25.326.

12. Precedence

  • TM-AR prevails. TM-AR prevails over this Annex, the MDPA and the Terms (MDPA clause 19).
  • Not modified in substance. The Parties declare that TM-AR is the model approved by the AAIP, completed only in its blank fields and not modified in substance. No filing with the AAIP is therefore required under Article 2 of Disposition 60-E/2016.