Ecuador — ANX-EC: Processing Contract (Contrato de Encargo)
Document ID: ANX-EC · Version: 1.0 · Status: PREPARED, NOT LIVE. Ecuador is not offered at signup until VstreamX has completed the prerequisites in clause 12. Existing Ecuadorian Clinics may accept it in the app under clause 12.3.
Language: Spanish controls (es/annex-ec.md). This English text is a convenience translation.
Applies to: Clinics established in the Republic of Ecuador. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.
1. Legal framework and roles
1.1 The parties and the law. This Annex is the processing contract between:
- the Clinic, as responsable del tratamiento (controller); and
- VstreamX, as encargado del tratamiento (processor).
It is made under the Organic Law on the Protection of Personal Data ("LOPDP"), its General Regulation ("RGLOPDP"), and the resolutions of the Superintendence for the Protection of Personal Data ("SPDP").
1.2 Content. It contains the content required by Article 41 of the RGLOPDP and Article 34 of the LOPDP. [[TO CONFIRM: final article references against the official texts]]
1.3 Not a transfer. The communication of the Clinic Data to VstreamX under this Annex is an encargo. It is not an international transfer (SPDP Resolution 2026-0004-R, Art. 23). [[TO CONFIRM: counsel's opinion on whether the VstreamX → Google leg is a transfer requiring additional clauses and an annual report]]
2. Content required by Article 41 RGLOPDP
| No. | Element | Content |
|---|---|---|
| 1 | Object and scope | The processing of the Clinic Data by VstreamX to provide DentalX to the Clinic. |
| 2 | Duration | The term of the Clinic's use of the Service, followed by the periods in MDPA clause 14 and clause 5 of this Annex. |
| 3 | Nature and purpose | As MDPA Schedule 1 states. |
| 4 | Type of personal data and categories of data subjects | As MDPA Schedule 1 states, including sensitive health data and data of children and adolescents. |
| 5 | Obligations and rights of the responsable | Clause 3.4 of the MDPA and clause 10 of this Annex. |
| 6 | Obligations of the encargado | Clause 3 of this Annex and the MDPA. |
| 7 | Security measures | MDPA Schedule 2. |
3. Obligations of the encargado
VstreamX:
- (a) processes the Clinic Data only according to the Clinic's documented instructions (MDPA clause 3). It informs the Clinic immediately if an instruction infringes the LOPDP;
- (b) does not use the Clinic Data for its own purposes or for purposes other than those instructed (MDPA clause 4);
- (c) does not use anonymised or pseudonymised health data of Ecuadorian data subjects for any purpose, including research, statistics or the training of models, without the authorisation that LOPDP Article 31.3 requires. VstreamX does not seek such authorisation. This ban applies to all Clinic Data as MDPA clause 4.2 provides;
- (d) keeps confidentiality, and binds its personnel to it (MDPA clause 5);
- (e) applies the security measures in MDPA Schedule 2;
- (f) assists the Clinic with data subjects' rights (clause 6), security breaches (clause 7) and impact assessments (MDPA clause 10);
- (g) keeps a record of the processing activities it performs as encargado (MDPA clause 11);
- (h) allows and contributes to audits by the Clinic or the SPDP (MDPA clause 12), including the SPDP's verification of compliance; and
- (i) returns or destroys the Clinic Data at the end of the service (clause 5).
4. Sub-encargados
4.1 Authorisation. The Clinic authorises the following sub-encargados, each named with its country (RGLOPDP Art. 45):
| Sub-encargado | Service | Country |
|---|---|---|
| Google LLC (Google Cloud / Firebase) | Hosting, database, storage, sign-in, functions, backups, logs | United States |
| Google LLC (Vertex AI) | AI features chosen by the Users | United States and other countries (global endpoint) [[TO CONFIRM: endpoint at publication]] |
| Google LLC (Gmail) | Sending emails | United States and other countries |
| Meta Platforms, Inc. / WhatsApp LLC | WhatsApp messages, for clinics that use DentalX's number | United States and other countries |
| Google LLC (reCAPTCHA) | Verification of a second factor by SMS; no patient data | United States and other countries |
4.2 Changes. Any new or replacement sub-encargado requires the Clinic's express written authorisation in the Service before the Clinic's data is routed to it (MDPA clause 7.5).
4.3 Obligations. Each sub-encargado is bound by the same obligations as VstreamX. VstreamX remains fully liable for them.
5. Return or destruction
5.1 Return. At the end of the service, VstreamX returns the Clinic Data to the Clinic through the complete export (MDPA clause 14).
5.2 Destruction. It then destroys the data within the periods of MDPA clause 14, and gives the Clinic a written certificate of destruction stating what was destroyed, when and by what method.
5.3 Supervision. Where the regulations or the SPDP require the destruction to be supervised or verified, VstreamX allows that supervision and provides the evidence. [[TO CONFIRM: the SPDP's current requirement on supervised destruction]]
5.4 What remains. Only database backups remain, and they expire within seven days of the destruction (MDPA clause 14.5(a)). The audit trail is returned in the export, and VstreamX's copy is deleted or anonymised (MDPA clause 14.5(c)).
6. Rights of data subjects
VstreamX assists the Clinic within 5 business days (MDPA clause 8). This allows the Clinic to answer requests within the 15-day period of the LOPDP.
7. Security breaches
7.1 Notice to the Clinic. VstreamX notifies the Clinic of any breach of security affecting the Clinic Data within 2 business days of becoming aware of it, and in any event within the 24 hours of MDPA clause 9 where it has established the breach (SPDP Resolution 2026-0040-R, Art. 11).
7.2 Where the notice is sent. It sends the notice by email to the address the Clinic designates in the Service for this purpose: «Clinic breach-notice email».
7.3 What the Clinic must do. This allows the Clinic to notify the SPDP and ARCOTEL within 5 business days, and the data subjects within 3 days.
8. Liability
8.1 No exemption. No clause of the Terms or the MDPA exempts or limits VstreamX's liability for breaching its obligations under the LOPDP, the RGLOPDP or this Annex, to the extent SPDP Resolution 2025-0006-R prohibits such exemptions (MDPA clause 17.2(b)).
8.2 Joint liability. VstreamX is liable jointly with the Clinic where the LOPDP so provides.
9. VstreamX's representation in Ecuador
9.1 Special attorney. VstreamX undertakes to appoint a special attorney (apoderado especial) domiciled in Ecuador, and to file the apostilled power of attorney with the SPDP, before Ecuador is offered to new Clinics. Once appointed, the attorney is named here and in the Service:
- name: [[TO CONFIRM: name of the apoderado especial]];
- address: [[TO CONFIRM: address of the apoderado especial]];
- email: [[TO CONFIRM: email of the apoderado especial]].
9.2 Data protection officer. VstreamX undertakes to register its data protection officer (Delegado de Protección de Datos) with the SPDP before Ecuador is offered to new Clinics. Once registered:
- name: [[TO CONFIRM: name of the registered DPD]];
- email: [[TO CONFIRM: email of the registered DPD]].
9.3 Existing Clinics. For a Clinic that accepts this Annex under clause 12.3 before these steps are complete, clauses 9.1 and 9.2 are undertakings on the dated plan in clause 12.3, not statements that the steps are complete.
10. Obligations of the Clinic
The Clinic is responsible for:
- informing its patients, including about the processing by VstreamX and the AI features (LOPDP Art. 12);
- the legal basis for processing health data;
- registering in the SISPDP where required. VstreamX provides the information on the encargado and sub-encargados, with their locations, retention and security measures; and
- its own data protection officer where required.
11. Retention of clinical records
The Clinic keeps its clinical records for the period the health regulations require [[TO CONFIRM: retention period, reported as 15 years in secondary sources]]. DentalX does not auto-delete clinical records.
12. Entry into force
12.1 Prerequisites. This Annex enters into force for new Clinics when VstreamX has completed all of:
- (a) the appointment and filing of its apoderado especial;
- (b) the registration of its DPD, who has passed the SPDP's course;
- (c) its record of processing activities as encargado;
- (d) the DPIA for the AI features; and
- (e) the publication in its privacy policy of the large-scale processing it carries out.
12.2 The audit. VstreamX also undertakes the annual audit required of it and keeps its reports for 5 years.
12.3 Existing Clinics. An Ecuadorian Clinic that already uses DentalX may accept this Annex in the app before the prerequisites are complete. VstreamX will then complete them on the dated plan it gives the Clinic: [[TO CONFIRM: dated plan for completing the Ecuadorian prerequisites]].
13. Applicable law
The LOPDP and its regulations apply to the processing of the Clinic Data whatever law governs the commercial relationship under MDPA clause 23.
Items to confirm before publication (Ecuador)
- The final article references against the official texts (§1.2).
- Counsel's opinion on whether the VstreamX → Google leg is a transfer (§1.3).
- The Vertex AI endpoint at publication (§4.1).
- The SPDP's current requirement on supervised destruction (§5.3).
- Name, address and email of the apoderado especial (§9.1).
- Name and email of the registered DPD (§9.2).
- The retention period for clinical records (§11).
- The dated plan for completing the Ecuadorian prerequisites (§12.3).