APAC Data Processing Agreement

This APAC Data Processing Agreement (the DPA) forms part of the Service Agreement between 2Care AI Inc. and the clinic identified on the Order Form (the Clinic). It applies where the Clinic is established in, or processes the personal data of individuals in, Singapore, Australia, Malaysia, the Philippines, Hong Kong, Japan or New Zealand. Because the Services handle patient personal data, including health information, both parties commit to the following.

1. Applicable law

In this DPA, APAC Law means each of the following laws, as amended and with its regulations and binding guidelines, to the extent it applies to the processing:

• Singapore: the Personal Data Protection Act 2012 (PDPA), the Healthcare Services Act 2020 and, from its commencement, the Health Information Act 2026.
• Australia: the Privacy Act 1988, including the Australian Privacy Principles (APPs).
• Malaysia: the Personal Data Protection Act 2010, as amended in 2024.
• Philippines: the Data Privacy Act of 2012.
• Hong Kong: the Personal Data (Privacy) Ordinance.
• Japan: the Act on the Protection of Personal Information (APPI).
• New Zealand: the Privacy Act 2020.

2. Roles

The Clinic decides why and how personal data is processed. It is the organisation, APP entity, data controller, personal information controller, data user, business operator or agency, as the APAC Law in question names it. 2care processes personal data only on the Clinic's behalf. It is a data intermediary under the PDPA, a data processor in Malaysia and Hong Kong, a personal information processor in the Philippines, an entrusted party under the APPI, and a service provider in Australia and New Zealand.

2care processes personal data only on the Clinic's documented instructions, which include the Agreement and the Clinic's configuration of the Services. If 2care believes that an instruction breaks APAC Law, it tells the Clinic and does not follow that instruction.

3. Scope of processing

• Subject matter: AI voice agents and administrative automations, including inbound and outbound calls, scheduling, insurance and eligibility checks, referrals, patient outreach by SMS, email and chat, and lead management.
• Duration: the term of the Agreement, and the return or deletion period in section 11.
• Nature and purpose: answering and placing calls for the Clinic, booking and managing appointments, checking coverage, processing referrals, and sending messages that the Clinic configures.
• Data subjects: the Clinic's patients, prospects, callers and their representatives.
• Personal data: name, contact details, date of birth, identification numbers where the Clinic provides them, insurance details, appointment and referral information, call audio, recordings, transcripts, summaries and messages.
• Sensitive data: health information and medical records that patients or the Clinic disclose through the Services.

4. 2care's obligations

• Protection: maintain reasonable security arrangements against unauthorised access, collection, use, disclosure, copying, modification, disposal and loss. These include encryption in transit and at rest, role-based access, multi-factor authentication for staff and audit logs of access to patient records.
• Retention limitation: keep personal data only as long as the Services or the Clinic's instructions need it, and then delete it or make it anonymous.
• Confidentiality: make sure that everyone who processes the personal data is bound by confidentiality and trained on data protection.
• No other use: not use the personal data for 2care's own purposes, not sell it, and not use it to train or fine-tune AI models.
• Requests from individuals: forward to the Clinic, within 5 business days, any access, correction or other request that 2care receives directly, and help the Clinic to answer it within the time that APAC Law sets.
• Assistance: help the Clinic with data protection impact assessments, regulator enquiries and the Clinic's other duties under APAC Law, as far as these relate to the Services.
• Audit: give the Clinic the information that it needs to show compliance, and allow one reasonable audit a year on 30 days' notice. 2care can meet this duty with a current independent audit report, such as a SOC 2 report, once available.

5. Sub-processors

The Clinic gives general authorisation for 2care to use sub-processors, for example cloud hosting, telephone, SMS, AI model and integration providers. A current list, with the country where each one processes data, is available on request. 2care tells the Clinic at least 30 days before it adds or replaces a sub-processor. The Clinic can object on reasonable data protection grounds, and the parties then discuss a solution in good faith. 2care binds each sub-processor to obligations that are at least as protective as this DPA and stays responsible for its sub-processors.

6. Data breaches

• 2care notifies the Clinic without undue delay after it becomes aware of a breach that affects the Clinic's personal data.
• Where the breach affects health information that the Clinic must report to the Singapore Ministry of Health under the Health Information Act, 2care notifies the Clinic within 1 hour. In all other cases, 2care notifies the Clinic within 24 hours.
• The first notice gives the facts known at that time: what happened, the categories of data, the approximate number of individuals, the steps taken and a contact person. 2care sends updates as it learns more.
• 2care helps the Clinic to assess whether the breach is notifiable and to meet its deadlines. Examples are notice to the PDPC within 3 calendar days of assessing a notifiable breach in Singapore, and the notifiable data breaches scheme in Australia.
• 2care does not notify regulators or individuals for the Clinic unless the Clinic instructs it to or the law requires it.

7. Overseas transfers

2care stores the Clinic's personal data in the region stated in the Order Form. The Clinic authorises transfers to the United States, the European Union and India, where 2care, its affiliate Billion AGI Pvt. Ltd. and its sub-processors operate. For each transfer, 2care makes sure that the recipient is bound by legally enforceable obligations that give the personal data a standard of protection at least comparable to the APAC Law that applies. These include the transfer limitation obligation of the PDPA, APP 8, the cross-border rules of the Malaysian PDPA and the third-party transfer rules of the APPI.

8. Marketing calls and messages in Singapore

• Before the Services send a marketing call, SMS or other specified message to a Singapore number, 2care checks the number against the Do Not Call Registry, unless the Clinic confirms that it has clear and unambiguous consent in written or other accessible form. 2care keeps a record of each check.
• The Services follow the Spam Control Act labelling and unsubscribe rules for unsolicited commercial messages, and use sender IDs registered with the Singapore SMS Sender ID Registry.
• The Clinic decides whether a message is a marketing message and is responsible for the consent and the message content.

9. Identification numbers

2care does not use NRIC numbers, FIN numbers or other national identification numbers to verify a person's identity. The Services mask these numbers in transcripts and logs, and collect a full number only when the Clinic instructs it and the law permits it.

10. AI use

• The AI agents tell callers at the start of each call that they are an AI assistant, and transfer callers to the Clinic's staff as the Clinic instructs.
• AI output can be wrong. The Clinic reviews important output before it relies on it for patient care.
• 2care documents how the Services use AI, consistent with the PDPC Advisory Guidelines on the use of personal data in AI systems and the Singapore AI in Healthcare Guidelines, and shares this information with the Clinic on request.

11. The Clinic's obligations

• Have a lawful basis, consent or valid notification for the processing, including for health information.
• Tell patients and callers how the Clinic uses the Services, including that an AI agent can answer or place calls and that calls can be recorded.
• Make sure that contact lists shared with 2care were collected lawfully.
• Meet its own duties under APAC Law and healthcare law, including appointing its own data protection officer and reporting breaches to regulators.
• Give only lawful instructions.

12. Return and deletion

When the Agreement ends, 2care returns or deletes the Clinic's personal data, as the Clinic chooses, within 30 days, and confirms this in writing on request. Backup copies expire within 14 days after that. 2care can keep data that the law requires it to keep, under the protections of this DPA.

13. Liability, precedence and contact

Each party is responsible for its own compliance with APAC Law. The liability limits in the Agreement apply to this DPA, except where the law does not permit them. If this DPA conflicts with the Agreement about personal data, this DPA controls. 2care's Data Protection Officer can be reached at support@2care.ai. This document is a plain-language agreement and not legal advice. Both parties should have it reviewed by a qualified lawyer before signing.