Schedule 3: Sub-processors

Schedule 3 — Sub-processors

Version: 1.0. This Schedule is versioned separately from the Master Agreement and changes under clause 7. The current list is always at dentalx.studio/legal/subprocessors.

Transfer Instruments. Where a Transfer Instrument governs the Clinic's transfers (TM-BR for Brazil, TM-AR for Argentina), each onward transfer to a Sub-processor is also made under that Instrument, as the Country Annex states.

Not Sub-processors:

• Stripe processes VstreamX's own billing and receives no Clinic Data.
• Services the Clinic connects itself are governed by the Clinic's own agreement with their provider. These are its own Google Calendar and its own WhatsApp Business account.
• OpenAI is not called by the Service. If VstreamX ever enables it, clause 7.3 applies first.

Annex Index

Part A — Documents in every bundle (non-US)

Part B — Country Annexes and Transfer Instruments

Part C — United States

US Clinics accept the DentalX Business Associate Agreement (baa.md) instead of this Agreement.

Part D — Countries not offered

DentalX is not offered at this time to Clinics in France, Finland or Germany, or in the Canadian provinces and territories not listed in Part B (Newfoundland and Labrador, Prince Edward Island, Yukon, the Northwest Territories and Nunavut). The reasons are in the country matrix.

Items to confirm before publication (MDPA)

1. Publication date of v1.0 (Effective date).
2. Automatic removal of non-current file versions at the deletion date (clause 14.5(b)).
3. A clinic-scoped WhatsApp opt-out list, deleted with the Clinic Data (clause 14.5(d)).
4. Dedicated privacy address and the external privacy office (EU DPO, Brazil encarregado, Panama Oficial, Peru Oficial) (clause 24.1).
5. Name and address of the EU Article 27 representative (clause 24.2).
6. Name and address of the UK Article 27 representative (clause 24.2).
7. The date phase B′ (field encryption of new consents and prescriptions) went live, stated as 2026-10-06 (Schedule 2, A.3).
8. Completion date of the sealing sweep for earlier consents and prescriptions (Schedule 2, A.3).
9. The owner's confirmation that the off-platform sealed copy of the encryption key exists (Schedule 2, A.4).
10. Whether key custody moves to Cloud EKM/HSM under external control (Schedule 2, A.4).
11. That every Google Cloud project administrator account enforces 2-step verification (Schedule 2, B.11).
12. A roadmap date for read-access logging of every patient-data view (Schedule 2, C.12).
13. That written confidentiality undertakings and annual training cover everyone with production access (Schedule 2, G.22).
14. That VstreamX holds no independent certification today (Schedule 2, G.25).
15. The Google contracting entity on VstreamX's Google Cloud account (Schedule 3, row 1).
16. The live DPF listings for Google LLC and Meta Platforms, Inc., with a dated record (Schedule 3, rows 1 and 4).
17. Blocking: the Vertex AI regional endpoint live for every tenant, and named (Schedule 3, row 2; clause 13.1).
18. Blocking: the email sender on a Google Workspace account with the Cloud Data Processing Addendum accepted (Schedule 3, row 3).
19. The Meta contracting entity and the data-processing terms accepted for DentalX's WhatsApp Business account (Schedule 3, row 4).
20. The mapping of each Sub-processor's terms against GDPR Article 28(3)(a)–(h) and the ANPD clauses, recorded in Schedule 3 (clause 7.2).
21. Deletion or anonymisation of the audit trail at the deletion date (clause 14.5(c)).