Costa Rica — ANX-CAC §CR: Central America and Caribbean Annex, Costa Rica Section
Document ID: ANX-CAC §CR · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]]
Language: Spanish controls (es/annex-cr.md). This English text is a convenience translation.
Applies to: Clinics established in the Republic of Costa Rica. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here. The CAC Annex has three sections (§CR, §PA, §DO). Only the section for the Clinic's country applies.
1. Legal framework and roles
1.1 Roles. This Section governs the processing of Clinic Data by:
- VstreamX, as encargado (processor); and
- the Clinic, as responsable de la base de datos (controller).
1.2 The law. It is made under Law 8968 on the Protection of the Person with regard to the Processing of their Personal Data (the "Law") and its Regulation, Executive Decree 37554-JP (the "Regulation").
2. Obligations of the encargado (Regulation, Art. 31)
VstreamX:
- (a) processes the Clinic Data only in accordance with the Clinic's instructions (MDPA clause 3);
- (b) does not use the data for purposes other than those the Clinic instructs (MDPA clause 4);
- (c) implements the security measures in MDPA Schedule 2. These are consistent with the minimum protocol of action that the Clinic adopts under clause 3;
- (d) keeps the data confidential, including after the end of its relationship with the Clinic (MDPA clause 5);
- (e) does not transfer or disclose the data to third parties, except to the authorised Sub-processors (clause 5) or where the law requires; and
- (f) deletes the data at the end of the relationship, or on the Clinic's instruction, after returning it (MDPA clause 14).
3. Minimum protocol of action
3.1 The Clinic's protocol. The Clinic adopts the minimum protocol of action (protocolo mínimo de actuación) that Article 32 of the Regulation requires of the responsable. DentalX provides a template.
3.2 VstreamX's acknowledgement. VstreamX acknowledges the Clinic's protocol. It undertakes to apply, in the processing it performs, the measures the protocol assigns to the encargado, to the extent they are consistent with MDPA Schedule 2. Where they are not, VstreamX tells the Clinic, and the Parties agree how to address it.
4. Equivalent secrecy
Article 9.1(d) of the Law allows sensitive health data to be processed by a health professional subject to professional secrecy, or by another person subject to an equivalent obligation of secrecy. Therefore:
- (a) VstreamX. VstreamX and its personnel are bound by an obligation of secrecy equivalent to professional secrecy in respect of all health data of the Clinic's patients (MDPA clause 5.3).
- (b) Sub-processors. VstreamX's Sub-processors are bound by the confidentiality obligations in their data processing terms, as MDPA Schedule 3 records, and the Clinic Data is protected in their hands by the encryption in MDPA Schedule 2. VstreamX does not represent that they are bound by professional secrecy or an equivalent secrecy. [[TO CONFIRM: Costa Rican counsel's view on whether this suffices for Article 9.1(d) of the Law]]
- (c) Duration. VstreamX's obligation is permanent and survives the end of this Agreement.
- (d) Breach. A breach of it is a breach of this Agreement, without prejudice to the liability that the Law and criminal law impose.
5. Sub-processors
5.1 Authorisation. The Clinic authorises the Sub-processors in MDPA Schedule 3, each of which is located in the United States or operates in other countries as stated there.
5.2 Changes. Changes follow MDPA clause 7.
6. Audit
The Clinic and PRODHAB may verify VstreamX's compliance with this Section (Regulation, Art. 29), as MDPA clause 12 provides.
7. Security breaches
7.1 Notice to the Clinic. VstreamX notifies the Clinic of any security breach affecting the Clinic Data within 48 hours of becoming aware of it, and in any event within 24 hours of establishing it (MDPA clause 9).
7.2 What the Clinic must do. This allows the Clinic to inform PRODHAB and the affected data subjects within 5 business days.
8. Rights of data subjects
VstreamX assists the Clinic within 5 business days (MDPA clause 8). Where the Clinic's own period is 5 business days, VstreamX acts within 2 business days of the Clinic's request, so that the Clinic can answer in time.
9. Storage in the United States and patients' consent
9.1 Consent before health data is entered. Article 40 of the Regulation does not treat the communication of data to an encargado as a transfer. Whether the Law nevertheless requires the patient's consent to this processing is not settled: Articles 5 and 14 of the Law require informed and express consent for processing and transfers, while Article 9.1(d) may allow health data to be processed without consent by a person bound by professional or equivalent secrecy. Until Costa Rican counsel decides the point, the Parties apply the stricter reading. The Clinic obtains from each patient, before any of that patient's health data is entered into DentalX, an express consent, in writing or by an equivalent means, that:
- names the storage and processing of their data in the United States; and
- names the use of the AI features and WhatsApp, where the Clinic uses them.
DentalX enforces this with the consent gate in clause 9.2(c), so that the Clinic's commitment and the Service's behaviour match.
[[TO CONFIRM: Costa Rican counsel's opinion on whether consent is required (Law 8968, Arts. 5, 9.1(d) and 14; Regulation, Art. 40). If it is not, a new version may replace the gate with a notice duty]]
9.2 DentalX's tools. DentalX provides:
- (a) a Spanish privacy notice template containing the information that Article 5.1 of the Law requires;
- (b) a consent template with a separate tick for storage in the United States, the use of AI and WhatsApp, signed by the patient and stored with their record; and
- (c) a consent gate: DentalX does not save health data for a patient until a consent with that separate tick is on file. Before then, the Clinic can record only the patient's name, contact details and appointments, so that it can send the consent. [[TO CONFIRM: counsel's view on that minimal record]]
10. Retention
The personal data must not be kept for more than 10 years from the end of the purpose for which it was collected, unless a special rule provides otherwise (Law, Art. 6). The Service lets the Clinic set its retention, and shows a prompt to anonymise records at 10 years. It does not delete clinical records automatically.
11. Acceptance of the role
VstreamX accepts the role of encargado for the Clinic on the terms of this Section. The acceptance certificate in the Executed Copy serves as VstreamX's letter of acceptance of the role (carta de aceptación del cargo). A separate signed letter in the form PRODHAB uses is available in the Service. [[TO CONFIRM: whether PRODHAB requires a separate letter in a particular form]]
12. Registration
The Clinic's internal patient database is exempt from registration with PRODHAB where it is for the Clinic's internal use only. Where the Clinic must register, VstreamX provides the information it needs (MDPA clause 11.2).
13. Applicable law
The Law and the Regulation apply to the processing of the Clinic Data whatever law governs the commercial relationship under MDPA clause 23.
Items to confirm before publication (Costa Rica)
- Publication date.
- Costa Rican counsel's opinion on whether consent is required, and on the minimal pre-consent record (§9).
- Whether PRODHAB requires a separate letter of acceptance of the role in a particular form (§11).
- Costa Rican counsel's view on the Sub-processors' confidentiality under Article 9.1(d) (§4(b)).