DentalX Back to home

Other-Country Attestation

ATT-OTHER · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 1903ecf1a2cfdbb016d0a71f6ec1a8d78b8e5b28c2cc770997cfebe5da13570f

Other Country — ATT-OTHER: Other-Country Attestation, with optional SCC Addendum

Document ID: ATT-OTHER · Version: 1.0 · Languages: English, Spanish, Portuguese, French (each authentic for the Clinic that accepts it in that language) · Effective date: [[TO CONFIRM: publication date]] Applies to: Clinics that choose "Other country" at signup, and whose country is neither offered nor blocked. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.

1. Routing before this attestation

1.1 Identify the country. The country typed at signup is matched to an ISO 3166-1 country code.

1.2 Offered countries. If it is a country DentalX offers, the Clinic follows that country's flow instead.

1.3 Blocked countries. If it is a country that VstreamX cannot serve, signup stops with an explanation. That covers:

  • countries under Canadian or United States sanctions, or within Google Cloud's prohibited territories; and
  • countries whose law requires health data to be stored locally (for example China and Russia), until counsel has reviewed them.

The list of these countries is kept in configuration.

2. The attestation

The Clinic's signatory accepts the following by a separate checkbox, unticked by default:

Other-country attestation. On behalf of «Clinic legal name», in «Country», I confirm that:

  1. VstreamX has not assessed the data protection, health-records or professional-secrecy laws of our country, and makes no statement that DentalX complies with them.
  2. We have verified our local law ourselves. Under it, we may use a service provider that stores and processes our patients' information in the United States and the other countries named in Schedule 3 of the Data Processing Agreement, and that is accessed from Canada.
  3. We hold, or before entering any patient's information we will obtain, every consent, notice, registration or authorisation our law requires for that processing and for that storage outside our country.
  4. We will tell VstreamX in writing of any terms our law requires in our agreement with a service provider. We accept that VstreamX may decline to serve us if it cannot agree to them.
  5. We understand that patient features stay locked until VstreamX has reviewed our country.

3. Country review gate

3.1 Account opens, patient features locked. The account is created at once, but the features that process patient data stay locked (status pending_country_review). They unlock when VstreamX's staff record a review decision with:

  • the country;
  • the reviewer;
  • the date;
  • the outcome (open, open with conditions, or decline); and
  • any annex required.

3.2 Decline. If the outcome is to decline, VstreamX tells the Clinic and the reasons. It closes the account under the Terms, with any fees prepaid refunded.

3.3 Promotion to a listed country. When two or more Clinics from the same country have been reviewed, VstreamX considers listing that country with its own terms.

4. Optional SCC Addendum

4.1 What the Clinic may ask for. If the Clinic's law recognises the EU Standard Contractual Clauses (as many laws modelled on the GDPR do), the Clinic may ask in the Service to add the TM-EEA EEA Transfer Module to its agreement, with the following adaptations, before the review gate is lifted:

  • (a) references to the GDPR are read as references to the Clinic's law;
  • (b) the competent supervisory authority is the authority of the Clinic's country; and
  • (c) the governing law and courts of the Clauses are those of Ireland, unless the Clinic's law requires its own.

4.2 How it is added. The adapted Module is a separate document (ATT-OTHER-SCC) with its own version and hash. The Clinic's signatory accepts it in the Service by its own checkbox, unticked by default (acceptance specification, Box 7), and it is recorded in the acceptance record like any other document. It is not added by a MINOR change, because it changes the Parties' rights and obligations (MDPA clause 18.2). [[TO CONFIRM: counsel's approval of the adapted-SCC mechanism for "Other" countries]]

5. Precedence

5.1 Mandatory local law. Where the Clinic's local law is mandatory, it prevails as MDPA clause 19 provides.

5.2 No representation by VstreamX. This attestation does not make VstreamX responsible for the Clinic's compliance with that law. It does not limit any non-excludable duty VstreamX has under it.

6. Legal basis of electronic acceptance

  • What the Parties agree. The Parties agree that this attestation and the MDPA are accepted electronically with the effect of a signed writing (MDPA clause 25.2), consistent with Article 11 of the UNCITRAL Model Law on Electronic Commerce.
  • No representation by VstreamX. VstreamX makes no representation that this is valid under any specific national law.

Items to confirm before publication (Other)

  1. Publication date.
  2. Counsel's approval of the adapted-SCC mechanism for "Other" countries (§4).
  3. The initial list of blocked countries (sanctions and data localisation), including the current status of Syria (§1.3).