PART II — TM-AR: International transfer model contract for the provision of services
1. Adoption
1.1 What is adopted. By accepting the MDPA, the Clinic (as exporter, responsable) and VstreamX (as importer, encargado providing services) enter into the model contract in Annex II of Disposition 60-E/2016 of the former National Directorate for the Protection of Personal Data (now the AAIP): "Contrato modelo de transferencia internacional de datos personales con motivo de prestación de servicios" (the "Model Contract").
1.2 The text.
- The full Spanish text is reproduced in the bundle the Clinic reads before accepting, and in the Executed Copy. [[TO CONFIRM: embed the official Spanish text of Annex II from the Boletín Oficial source file — never retyped]]
- Only the blank fields are completed, as follows.
[[TO CONFIRM: that Disposition 60-E/2016 Annex II remains the current AAIP model for provision of services, with no newer AAIP resolution replacing it]]
2. Completed fields
Parties
| Exporter | Importer | |
|---|---|---|
| Name | «Clinic legal name» | VstreamX Studio Inc. |
| CUIT | «CUIT» | Not applicable (foreign company) |
| Address (domicilio) | «Clinic address», Argentina | Office B – 1043 Rosser Ave, Brandon, Manitoba R7A 0L5, Canada |
| Representative / signatory | «Signatory name», «Signatory role», DNI «Signatory DNI» | Authorised officer of VstreamX (electronic signature on the acceptance certificate) |
| Contact | «Clinic owner email» | admin@vstreamx.com |
Appendix to the Model Contract: description of the transfer
| Item | Content |
|---|---|
| Data subjects | Patients (including minors), their parents, guardians and representatives, emergency contacts, policyholders, the exporter's professionals and staff, and third parties who correspond with the exporter. |
| Purposes of the transfer and of the processing | Provision of DentalX, a cloud dental-practice management service, to the exporter (MDPA Schedule 1): hosting, storage, backup, security, communications at the exporter's instruction, AI-assisted drafting, and support. |
| Categories of data | As MDPA Schedule 1. |
| Sensitive data | Health data: medical and dental history, diagnoses, odontogram, treatments, images, prescriptions and consents. |
| Recipients (sub-processors) and countries | MDPA Schedule 3: Google LLC (Google Cloud/Firebase, Vertex AI, Gmail, reCAPTCHA), United States and other countries; Meta Platforms, Inc. / WhatsApp LLC, United States and other countries. Prior written consent of the exporter given by acceptance (Model Contract clause on sub-contracting). |
| Security measures | MDPA Schedule 2. |
| Retention period | As Part I §5 of this Annex and MDPA clause 14. |
Jurisdiction
The jurisdiction and competent courts are those that the Model Contract establishes: the Argentine courts. [[TO CONFIRM: the clause numbers of the jurisdiction clause (expected Cl. 7) and the sub-contracting clause (expected Cl. 10) in the official text]]
Items to confirm before publication (Argentina)
- Publication date.
- Counsel's confirmation that the de-identified audit trail falls outside Law 25.326 Art. 25.2 (Part I §5.3).
- Provincial retention periods for dental records in the main provinces (Part I §6.1).
- That field-level change history is recorded for clinical entries, or a roadmap date (Part I §6.2).
- Which product option applies to prescriptions: disabled, or labelled as drafts (Part I §7).
- Embedding of the official Spanish text of Annex II of Disposition 60-E/2016 (Part II §1.2).
- That Disposition 60-E/2016 Annex II is still the current AAIP model (Part II §1.2).
- The clause numbers of the jurisdiction and sub-contracting clauses in the official text (Part II §2).