Annex IV — List of sub-processors

Courtesy translation. Only the Romanian text is binding: read the original

Version SUBP-1.3 · 9 October 2026

Annex to the Data Processing Agreement, version DPA-1.3 (https://www.optiswift.ro/abonament/contract-imputernicire), of which it forms an integral part under Clause 1(d). The version of this annex in force is published at https://www.optiswift.ro/abonament/subimputerniciti.

The Provider is OPTISWIFT S.R.L., a limited liability company with its registered office at București, Sectorul 3, Str. Nerva Traian nr. 27-33, Scara B, Etaj 1, Birou 6, registered in the Trade Register under no. J2026055914008 (EUID ROONRC.J2026055914008), CUI (Romanian company tax ID) 55636472, subscribed and paid-up share capital 500 lei, email contact@optiswift.ro. The Practice is the controller identified in Annex I.

In this annex, “GDPR” means Regulation (EU) 2016/679, “EEA” means the European Economic Area, and “sub-processor” means a processor engaged by the Provider to carry out processing activities on behalf of the Practice (Article 28(2) and (4) GDPR). Other terms have the meaning given in the Agreement.

The Agreement uses Option 2 of Clause 7.7(a): general written authorisation for sub-processors from an agreed list. The agreed list is § 1. Each entry in § 1 sets out the sub-processor’s name, address and published contact details and a description of the processing (the elements of Annex IV to Commission Implementing Decision (EU) 2021/915), together with the categories of data and of data subjects, the place of processing, the transfer mechanism, the security measures, the duration of the processing and the sub-processor’s data processing agreement.

Section	Contents
§ 1	the Provider’s sub-processors: the agreed list
§ 2	the Practice’s messaging provider, which is not the Provider’s sub-processor
§ 3	destinations that are not sub-processors
§ 4	authorisation, notice of changes and the right to object
§ 5	version history

§ 1 · The Provider’s sub-processors

The Provider engages the sub-processors below only for the processing described in Annex II and only on the instructions in Clause 7.1. Each processes the Practice’s data only for the service described in its entry and within the limits stated there, including, for OpenAI, the abuse monitoring logs (§ 1.3), under the data processing agreement named in the entry, which the Provider has concluded in its own name. The Provider remains fully liable to the Practice for the performance of each sub-processor’s obligations, under Clause 7.7(d), and provides the Practice, on request, with a copy of the data processing agreement concluded with it (Clause 7.7(c)).

The sub-processors that each of them uses are listed in the lists they publish, at the addresses given in the entries. Those lists are not reproduced in this annex; the Provider passes changes to them on to the Practice under § 4.3.

1.1 · Hosting, the database, authentication, file storage and server functions


Name	Supabase Pte. Ltd.
Address	65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513
Contact person	Supabase’s privacy team: privacy@supabase.io (the contact details in the Supabase data processing agreement)
Country of establishment	Singapore, a third country for which the European Commission has not adopted an adequacy decision
Service	Hosts the Practice’s entire database: patient records, consultations, refractions and prescriptions, clinical documents and images, appointments, orders, sales and fiscal documents, stock, messaging, consents, settings, user accounts and the audit log. Hosts the five private file storage buckets: `clinical-images` (clinical images), `documents` (clinical documents, supporting documents for expenses and the Practice’s graphic assets), `efactura` (electronic invoice files), `patient-photos` (patient photographs) and `feedback` (screenshots attached to issue reports). Provides authentication (the accounts of the Practice’s staff and the Practice’s licence account; the Provider also processes the licence account data in its own right, for the contractual relationship, § 3.8), runs the Software’s server functions and task scheduler, and keeps the error reports sent automatically by the application. It is the sub-processor that has access to all of the Practice’s data.
Categories of data	all categories in Annex II, including data concerning health (Article 9 GDPR)
Data subjects	all categories in Annex II: the Practice’s patients, including minors and their representatives; the Practice’s staff; doctors and collaborators; the Practice’s corporate customers and their representatives who are natural persons; third parties named in free-text fields
Place of processing	The data is stored in the Provider’s Supabase project, in the Amazon Web Services `eu-west-1` region (Ireland). The Software’s server functions run on Supabase infrastructure. The Software’s code does not fix the region in which Supabase runs the server functions; they may also run outside the EEA, in which case the transfer mechanism below applies. Access to the data from outside the EEA by Supabase or its sub-processors, for example for technical support, is not excluded and constitutes a transfer.
Transfer mechanism	the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Three (processor to processor), incorporated into the Supabase data processing agreement, which also incorporates Module Two. Supabase has published a transfer impact assessment, dated 14 March 2025, covering transfers to Supabase, Inc. (USA) and the law of Singapore (https://supabase.com/downloads/docs/Supabase%2BTIA%2B250314.pdf).
Security measures	Supabase states publicly that all customer data is encrypted at rest (AES-256) and in transit (TLS) and that it holds a SOC 2 Type 2 report and ISO 27001 certification (https://supabase.com/security). Supabase notifies the Provider of a security breach within 48 hours of becoming aware of it. In the project: every table holding practices’ data has row-level security tied to the practice of the session; the file storage buckets are private and separated by practice through the file path; only the Provider can open the `feedback` bucket; the desktop application sends the Practice’s data only to this project, over encrypted connections (HTTPS and WSS); the application’s other connections, which carry no Practice data, are described in § 1.5, § 3.1, § 3.4 and § 3.6 (Annex III).
Backups	Supabase makes a daily backup of the database and keeps it for 7 days. Point-in-time recovery is not enabled. A restore returns the whole project, for all practices at once, to its state at the last daily backup, so up to 24 hours of work may be lost. Files in the storage buckets are not included in these backups: the database backup contains only their records, not their contents, and a deleted or lost file cannot be recovered from a platform backup. Supabase’s documentation does not state where these backups are kept; they are covered by the same data processing agreement and the same standard contractual clauses.
Duration	for the term of the Agreement and the 30-day period after the subscription ends, during which the Practice may export its data under the subscription terms, until the data is deleted under Clause 10(d); after deletion, the data may remain in the database backups for up to 7 days. Error reports, including their copies in the alerts sent, are deleted automatically after 90 days, and the description the user typed in them after 30 days.
Data processing agreement	https://supabase.com/legal/dpa (version 1 of 1 August 2026), together with the Supabase terms of service (https://supabase.com/terms)
Its own sub-processors	the list published and updated by Supabase under its data processing agreement; the version in force at the date of this annex is that of 1 June 2026: https://supabase.com/legal/subprocessor-list/June-1-2026.pdf. The hosting infrastructure in the `eu-west-1` region is provided by Amazon Web Services, Inc., and technical support by Supabase, Inc. (USA).
Supabase’s notice period for changes to its own list	at least 30 days; § 4.3 applies

1.2 · Transactional email


Name	Plus Five Five, Inc., trading as Resend
Address	2261 Market Street #5039, San Francisco, CA 94114, United States of America
Contact person	Resend Security, Resend’s security and privacy team: privacy@resend.com
Country of establishment	United States of America, a third country
Service	Delivers the emails the Software sends. On behalf of the Practice: a) the daily report, to the addresses chosen and confirmed by the Practice in Settings → Daily report, and the messages confirming those addresses; b) issue reports sent by the Practice’s staff from Settings → Issues and suggestions, to the Provider’s mailbox (§ 1.4); c) error report summaries sent automatically by the application, to the Provider’s mailbox (§ 1.4). Resend also delivers the Provider’s own messages about the trial account, the licence account and the subscription; for these the Provider is the controller, and their processing is described in the Provider’s privacy policy (https://www.optiswift.ro/confidentialitate).
Categories of data	recipients’ email addresses, message content and technical delivery data. Daily report: the Practice’s activity data (sales, payments received, the cash book, balances due, orders, the number of appointments for the next day, clinical activity, stock and alerts) and, only in the case in point a) of the “Patient data” row, the names of the patients booked for the next day, with the appointment time and the doctor. Issue report: the type, subject and text written by the author, the Practice’s name and technical identifier, the user’s name, role and technical identifier, the location, the Software version, the details of the built-in browser and the operating system (user agent), the date and time of sending and, where given, the reply email address; screenshots are not sent by email, and the message only names the folder in which they are kept and their file names, derived from the names of the attached files (§ 1.1). Error summary: the error message and stack trace, the address of the application screen, which may contain the technical identifier of a patient record, the last actions taken in the Software and the description typed by the user, after the filtering described in Annex III.
Patient data	Patient data can reach Resend in four ways: a) the names of the patients booked for the next day, with the appointment time and the doctor, in the daily report, only if the Practice has ticked “I agree that the report may contain patient names” in Settings → Daily report (unticked by default); b) any text about a patient that staff write in an issue report, including in the name of an attached file, even though the form asks them not to write names, personal numeric codes (CNP) or prescriptions; c) a name or other text about a patient that the user typed into an error description or that an error message contained, if the filter did not remove it; d) the technical identifier of a patient record, contained in the screen address in an error summary; the identifier does not reveal the patient’s identity without access to the Practice’s database. Outside these cases, the messages sent through Resend contain no patient data.
Data subjects	the Practice’s staff (recipients of the daily report, authors of issue reports, users who encountered an error) and, in the cases in the previous row, the Practice’s patients or other persons named in the text
Place of processing	United States of America; the Resend data processing agreement states that processing takes place mainly in the USA
Transfer mechanism	the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which Plus Five Five, Inc. is certified, and the standard contractual clauses (Decision (EU) 2021/914), incorporated into the Resend data processing agreement
Security measures	The Software sends the messages from the server, through the Resend API, only over HTTPS, from the optiswift.ro domain, which is verified with Resend. Issue reports and error reports carry no attachments. Resend notifies security breaches without undue delay.
Duration	for the term of the Agreement; Resend keeps the messages and delivery data under its data processing agreement and, when the service ends, deletes or returns them within 90 days
Data processing agreement	https://resend.com/legal/dpa
Its own sub-processors	https://resend.com/legal/subprocessors
Resend’s notice period for changes to its own list	at least 14 days, shorter than the 30-day notice the Provider owes the Practice; § 4.3 applies

1.3 · The language model of the in-app assistant


Name	OpenAI Ireland Ltd.
Address	1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
Contact person	OpenAI’s data protection officer: dpo@openai.com; for privacy matters: privacy@openai.com (the details published in OpenAI’s European privacy policy, https://openai.com/policies/eu-privacy-policy/)
Country of establishment	Ireland, a member state of the European Union. OpenAI Ireland Ltd. is OpenAI’s contracting party for customers established in the EEA or Switzerland; the Provider’s OpenAI account is held in the name of OPTISWIFT S.R.L., with its registered office in Romania.
Service	The language model of the in-app assistant, through OpenAI’s Responses API. Drawing on the Software’s manual, the assistant answers staff questions about using the Software, about the meaning of a term in the Software and about what the Software does and does not do. For each question sent to the model, the Software’s server transmits: a fixed system instruction (the assistant’s rules and the manual’s table of contents), the text of a few manual articles, the title of the manual article that matches the open screen (but not the screen’s address), the text of the typed question, after filtering, and at most three earlier questions from the same conversation (but not the answers). Greetings and thanks that the Software recognises receive a fixed reply, without a call to the model, and are not sent with later questions either.
What the model does not receive	Nothing sent to the model comes from the Practice’s database. The model cannot read, search or act on the database: the assistant function declares no tools to the model, reads no table and does not hold the project’s service key. Requests carry no identifier of the person asking or of the Practice.
The Practice’s switch	The assistant is on by default for every practice. The Practice’s administrator (the person with the administrator role in the Software) can turn it off or on at any time in Settings → Help → Assistant (“Assistant on for the whole practice”); the change is recorded in the audit log. While the assistant is off, no question from the Practice’s staff is counted or sent to OpenAI. The Provider may also turn the assistant off for all practices at once, as a security measure or when OpenAI can no longer provide the service on the terms in this entry. The assistant does not work in trial accounts.
Categories of data	in principle none, because the questions concern the Software; in practice, whatever staff type into the question, after filtering. Despite the warning shown above the box, a question may contain a patient’s name or other data about a patient.
Data subjects	the Practice’s staff, only through the content they type, and any person whom staff name in a question
The filter	Before sending, the application replaces any personal numeric code (CNP), IBAN, email address, Romanian-format phone number, tax ID written with the “RO” prefix and access keys or tokens in the question, and the server rejects a question that still contains any of them. The filter does not recognise a person’s name, nor a tax ID written without the “RO” prefix; that is why the warning above the box asks staff not to write patient data.
Endpoint and place of processing	`https://api.openai.com/v1/responses`, OpenAI’s global endpoint. OpenAI guarantees no region for this endpoint: requests are not routed to Europe, and processing may take place outside the EEA, including in the United States. The Software’s server cannot send the request anywhere else: it rejects any address other than the two OpenAI endpoints set in the code (`api.openai.com` and `eu.api.openai.com`) and any redirect. A move to OpenAI’s European endpoint can be made only through a new version of the Agreement and of this annex.
Transfer mechanism	The processor that processes the data sent from the EEA is OpenAI Ireland Ltd., established in the European Union (OpenAI data processing agreement, § 4.1). Transfers of this data outside the EEA, to OpenAI affiliates or to third parties, are made under agreements containing the 2021 standard contractual clauses (Decision (EU) 2021/914) or under an adequacy decision (Article 45 GDPR).
Security measures	Requests are sent only from the server, over HTTPS, with the key of the Provider’s OpenAI project, which is kept as a secret on the server; the desktop application does not communicate with OpenAI directly. OpenAI’s retention and use of the data are as set out in the table below.
Duration	the duration of each request, plus the periods in the table below
Data processing agreement	https://openai.com/policies/data-processing-addendum/ (updated 1 December 2025, in force from 1 January 2026), incorporated into the OpenAI Services Agreement, § 5.3 (https://openai.com/policies/services-agreement/)
Its own sub-processors	https://platform.openai.com/subprocessors, for which the OpenAI data processing agreement (§ 2.9) gives a general authorisation; the page opens only from a signed-in OpenAI account, and the Provider sends its contents to the Practice on request
How OpenAI gives notice of changes to its own list	by a blog post, an in-service notification or an email to subscribers; the customer may object within 30 days of the notice (OpenAI data processing agreement, § 2.9); § 4.3 applies

How OpenAI retains and uses the question text

What	Condition	Duration
training or improving models	does not happen: OpenAI does not use customer content to develop or improve its services without the customer’s express consent (OpenAI Services Agreement, § 4.2). The Provider has not given this consent, and the Agreement prohibits it from giving it.	—
abuse monitoring logs	generated for all requests; the Provider does not have OpenAI’s approval for “Zero Data Retention” or “Modified Abuse Monitoring”, which would exclude their content	up to 30 days, unless the law requires longer retention
retention of the response by the Responses API	does not happen: every assistant request carries `store: false`	—
request cache (prompt caching)	OpenAI temporarily keeps intermediate computation states derived from the request content, which may include the question, in order to reuse them for a request that begins identically, only within the Provider’s OpenAI organisation	at least 30 minutes from last use; OpenAI states that it does not keep them indefinitely, but publishes no maximum duration

Sources: https://openai.com/policies/services-agreement/ · https://developers.openai.com/api/docs/guides/your-data · https://developers.openai.com/api/docs/guides/prompt-caching

1.4 · The Provider’s mailboxes and Proton Drive space


Name	Proton AG
Address	Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland (business identification number CHE-354.686.492)
Contact person	Proton’s data protection team, at the contact details published in the Proton privacy policy (https://proton.me/legal/privacy)
Country of establishment	Switzerland, a country for which the European Commission has found an adequate level of protection (Decision 2000/518/EC)
Service	Hosts the Provider’s mailboxes on the optiswift.ro domain, including contact@optiswift.ro. They receive: issue reports from the Practice’s staff and error report summaries (§ 1.2); support correspondence between the Practice and the Provider; communications about data subject requests (Clause 8) and security incidents (Clause 9). Also hosts the Provider’s Proton Drive storage space, through which the Provider delivers the full data export to the Practice (Clause 10(d) of the Agreement; Article 26(6)(b) of the subscription terms) when the Practice has not agreed a physical medium: the encrypted archive is uploaded to Proton Drive and downloaded through a link that expires within 7 days at most.
Categories of data	the content of messages and attachments; correspondents’ names and email addresses; the data in issue reports and error summaries (§ 1.2). Patient data only if the Practice’s staff write it in an issue report, an email or an error description, if it is contained in an error message that the filter did not remove or in the screen address in an error summary (§ 1.2, “Patient data” row, points b)–d)), or if it is needed for a request concerning a patient’s rights or for handling an incident. In Proton Drive: the encrypted full export archive, with all of the Practice’s data, including data concerning health.
Data subjects	the Practice’s staff; patients or other persons named in correspondence; in the export archive, everyone whose data the Software holds
Place of processing	Switzerland and, under the Proton data processing agreement, possibly other EEA states or countries with an adequacy decision; any other transfer is made under the standard contractual clauses
Transfer mechanism	the adequacy decision for Switzerland (Commission Decision 2000/518/EC, kept in force by Article 45(9) GDPR)
Security measures	Only the Provider has access to the mailboxes and to Proton Drive, through its Proton account. Messages sent by the Software carry no attachments (§ 1.2). The export archive reaches Proton Drive only once the Provider has encrypted it (AES-256), with a password that Proton does not receive and that the Provider gives the Practice through a channel other than the link; the archive is deleted from Proton Drive after the Practice confirms it has opened it, and at the latest when the link expires. Under its data processing agreement, Proton undertakes to apply the security measures required by Article 32 GDPR and to notify security breaches without delay.
Rule for the Practice	The Practice does not write patient data in issue reports or support messages (Article 15(5) of the subscription terms); when resolving a problem requires looking at such data, this is done in a remote support session (§ 1.5). A request concerning a patient’s rights or a communication about an incident contains only the patient data needed to handle it.
Duration	for the term of the Agreement; correspondence containing data processed on behalf of the Practice is deleted from the mailboxes at the latest together with the Practice’s other data, under Clause 10(d); the export archive is deleted from Proton Drive after the Practice confirms it has opened it, and at the latest when the link expires; if the link expires before the archive is opened, the Provider uploads it again at the Practice’s request
Data processing agreement	https://proton.me/legal/dpa (updated 10 February 2026), part of Proton’s terms for business use
Its own sub-processors	listed in the Proton privacy policy (https://proton.me/legal/privacy)
How Proton announces changes to its own list	within the period and by the means set out in the Proton data processing agreement; § 4.3 applies

1.5 · Remote support


Name	TeamViewer Germany GmbH
Address	Bahnhofsplatz 2, 73033 Göppingen, Germany
Contact person	TeamViewer’s data protection team, at the contact details in the TeamViewer data processing agreement and on the page https://www.teamviewer.com/en/gdpr/
Country of establishment	Germany, a member state of the European Union
Service	Remote technical support through screen sharing. Only the Practice starts a session: a person at the Practice opens the TeamViewer application on their computer, directly or from Settings → Help → “Start remote support”, and gives the Provider’s support person the code TeamViewer displays. Without this code, the Provider’s support person cannot connect. During the session, the Provider’s support person sees the screen of the Practice’s computer, including any patient data displayed, and can work on it, with the knowledge of the person at the Practice. The person at the Practice can end the session at any time by closing the connection in the TeamViewer window. The OptiSwift Software opens no session and sends no data to TeamViewer: the button in Settings → Help only launches the TeamViewer application installed on the computer or opens the TeamViewer download page.
Categories of data	the screen image transmitted during the session, which may include any category of data in Annex II shown on screen, including data concerning health; the technical connection data (TeamViewer device identifiers, IP addresses, the date, time and duration of the session)
Data subjects	the Practice’s staff taking part in the session; patients and other persons whose data appears on screen
Place of processing	According to Annex 3 to the TeamViewer data processing agreement, the infrastructure of TeamViewer’s core products is hosted in the EEA. TeamViewer’s support and professional services may be provided by TeamViewer affiliates, including from outside the EEA.
Transfer mechanism	The contracting entity is established in the European Union. Any access by a TeamViewer affiliate from outside the EEA takes place under the standard contractual clauses (Implementing Decision (EU) 2021/914) or an adequacy decision, as provided in the TeamViewer data processing agreement.
Security measures	A session starts only on the Practice’s initiative and only with the code displayed on its computer. The Provider does not set up access without a code (unattended access) on the Practice’s computers, does not record sessions, does not copy files from the Practice’s computer except at the Practice’s express request, and opens only the screens needed for the reported problem. The Provider’s support person is bound by confidentiality (Clause 7.4(b)).
Duration	the duration of each session; TeamViewer keeps the technical connection data under its data processing agreement
Data processing agreement	the TeamViewer data processing agreement, part of the TeamViewer licence terms (https://www.teamviewer.com/en/eula/)
Its own sub-processors	Annex 3 to the TeamViewer data processing agreement, version of 27 July 2026: https://media.teamviewer.com/is/content/teamviewergmbh/teamviewer/central-image-hub/pdf/en/teamviewer-dpa-annex-3-subprocessor-list-en.pdf
How TeamViewer announces changes to its own list	within the period and by the means set out in the TeamViewer data processing agreement; § 4.3 applies
The TeamViewer application on the Practice’s computer	The Practice downloads the TeamViewer application from the TeamViewer website and uses it on the terms it accepts with TeamViewer. This entry concerns the processing that TeamViewer carries out for the Provider in support sessions.

1.6 · The language model of the Provider’s development and maintenance tools


Name	Anthropic Ireland, Limited
Address	6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland
Contact person	Anthropic’s data protection officer: dpo@anthropic.com (Anthropic privacy policy, https://www.anthropic.com/legal/privacy)
Country of establishment	Ireland, a member state of the European Union; Anthropic’s contracting party for customers established in the EEA
Service	The language model (Claude) of the Provider’s development and maintenance tools, used on the conditions in § 3.7 and in § 11.1 of the Agreement: for the administration operations under instruction I-10 and for the data migration under instruction I-11, in sessions run by an authorised person of the Provider. The Provider uses these services only through a commercial account, under Anthropic’s commercial terms and the data processing agreement below, never through a consumer or personal account.
Categories of data	the data in Annex II that a query or a file needed for the operation contains, including, for the migration under I-11, data concerning health; wherever possible, queries return only counts and technical identifiers
Data subjects	the Practice’s patients and staff whose data the operation involves
Model training	does not happen: under Anthropic’s commercial terms, customer content is not used to train models
Place of processing	processing may take place outside the EEA, including in the United States
Transfer mechanism	the standard contractual clauses (Implementing Decision (EU) 2021/914, Modules Two and Three), incorporated into the Anthropic data processing agreement
Security measures	Anthropic’s services are used only through a commercial account of the Provider, over encrypted connections (HTTPS), in sessions run by an authorised person of the Provider who is bound by confidentiality (Clause 7.4(b)); wherever possible, queries return only counts and technical identifiers. Under its data processing agreement, Anthropic undertakes to apply the security measures required by Article 32 GDPR and to notify security breaches.
Duration	the duration of each session; when the contract with Anthropic ends, the data is deleted within 30 days, under the data processing agreement
Data processing agreement	https://www.anthropic.com/legal/data-processing-addendum, incorporated into Anthropic’s commercial terms (https://www.anthropic.com/legal/commercial-terms)
Its own sub-processors	https://www.anthropic.com/subprocessors
How Anthropic gives notice of changes to its own list	by notice to the customer; the customer may object within 15 days of the notice (Anthropic data processing agreement); § 4.3 applies

§ 2 · The Practice’s messaging provider is not the Provider’s sub-processor


Who	the messaging provider chosen by the Practice for SMS and WhatsApp messages to patients: Infobip, Twilio or another provider chosen by the Practice, connected through the Software’s generic HTTP interface
Who contracts	The Practice, directly. The Practice opens its own account with the chosen provider, tops up its credit and gives the Provider the access key to that account. The Provider adds no fees or commissions and issues no invoice for messaging.
Legal characterisation	The messaging provider is the Practice’s processor, under the contract the Practice concludes directly with it. It is not a sub-processor of the Provider: the Provider does not choose it, does not contract with it and does not pay for its service.
What the Provider does	On the Practice’s instruction concerning messages to patients (Clause 7.1), the Software’s server sends each message to the chosen provider’s endpoint, with the Practice’s access key, and receives from that provider the delivery confirmations and patients’ replies, such as unsubscribe requests.
What data the messaging provider receives	the patient’s phone number, the content of the message and the sender configured by the Practice
Where the access key is kept	in the encrypted vault of the database (§ 1.1); the application cannot read it back in plain text
When messages are sent	Messages to patients are sent only after the Practice has turned on the Messages module and connected its account with the chosen provider, the connection has been verified, and the Practice has completed setup in Messages → Settings → Setup (the sender, message types, templates and confirmed test message). Before that, the only message that can be sent is the test message, to a phone number of the Practice. No messages are sent from trial accounts. The Practice can stop sending at any time.
What the Practice does	concludes its own data processing agreement with the messaging provider (usually the data processing agreement that provider publishes), checks where the provider processes the data and which transfer mechanism it uses, and enters this processing in its own record of processing activities (Article 30 GDPR). This Agreement does not cover the relationship between the Practice and its messaging provider.

§ 3 · What is not a sub-processor

The destinations below appear in the Software’s traffic or in the relationship between the Provider and the Practice, but do not process data that the Provider processes on behalf of the Practice. They are not part of the agreed list, and Clause 7.7 does not apply to them.

3.1 · GitHub: application updates

The desktop application downloads the update manifest from GitHub and, where applicable, the files of the new version, and checks the update’s signature with a public key included in the application. Traffic runs in one direction only: no Practice data is sent over this channel. As with any download from the internet, GitHub sees the computer’s IP address.

3.2 · ANAF: the RO e-Factura system

The Software prepares the Practice’s electronic invoice files, and the Practice submits them to RO e-Factura, Romania’s national e-invoicing system, in its own name, in fulfilment of a legal obligation. ANAF (Romania’s tax authority) receives the invoices as a public authority, under the law and for its own purposes, and does not process data on behalf of the Provider.

3.3 · ANAF: the public register of VAT payers

When a company’s details are filled in from its tax ID, for example when an invoice is issued, the Software’s server queries ANAF’s public service for the register of VAT payers, sending only the tax ID and the date. ANAF answers from its public register and does not process data on behalf of the Provider.

3.4 · Stripe: payment for the OptiSwift subscription

Stripe Payments Europe, Limited (Ireland) processes payments for the OptiSwift subscription, on pages hosted by Stripe (checkout.stripe.com, billing.stripe.com, invoice.stripe.com), with the payment methods offered there, such as card, Apple Pay, Google Pay or Revolut Pay.

Stripe receives no patient data and no other data that the Provider processes on behalf of the Practice. It receives the Practice’s billing details (name, tax ID, Trade Register number, address and billing email address), the technical identifiers of the Practice and of its OptiSwift activation, the subscription amounts and, directly from the payer, the payment method details. The full card number and security code are entered only on Stripe’s pages and never reach the Provider; of the data received from Stripe, the Provider keeps only a summary of the payment method (for a card: the network, the last four digits and the expiry month and year).

For this data the Provider is the controller. Stripe acts as its processor for processing the payment and as an independent controller for fraud prevention, know-your-customer checks and its own legal obligations (https://stripe.com/privacy). Digital wallets (Apple Pay, Google Pay) and the card’s issuing bank, including its authentication page (3-D Secure), process the payment data in their own right.

3.5 · Revolut: the Revolut Pay payment method

Revolut appears only as a payment method on Stripe’s pages. A payer using Revolut Pay signs in to their own Revolut account and sends the payment details directly to Revolut, on Revolut’s terms. The Provider sends Revolut no patient data and no other data that it processes on behalf of the Practice.

3.6 · Vercel: the website and the account portal

Vercel Inc. (USA) hosts the www.optiswift.ro website and the www.optiswift.ro/cont account portal. The portal handles the licence account details (email address and password, at sign-in), the subscription activation form and billing details, as well as the IP address and browser identifier of whoever uses it. For this data the Provider is the controller. To display the subscription, the portal reads from the account, with the licence account session, the Practice’s name, the identification details of its companies (name, tax ID, registered office) and of its locations, and the subscription status. No data about patients or the Practice’s staff passes through the website or the portal, and the desktop application sends no Practice data to Vercel.

Vercel also appears on Supabase’s own list of sub-processors (§ 1.1); in that capacity, its processing is part of the Supabase chain.

3.7 · The Provider’s development and maintenance tools

The Provider’s development and maintenance tools, including AI-assisted tools, receive the Practice’s data only on the conditions in § 11.1 of the Agreement: through the Anthropic services in the entry in § 1.6, used through a commercial account, never through a consumer or personal account; only for the administration operations under instruction I-10 and for the data migration under instruction I-11, to the extent strictly necessary; and only in sessions run by a member of the Provider’s staff who is bound by confidentiality (Clause 7.4(b)). Wherever possible, queries return only counts and technical identifiers. The Provider does not enter the contents of its mailboxes or of remote support sessions into these tools.

The Provider’s other development tools (the code editor, the version control system, the build services) receive no Practice data and are not sub-processors. The in-app assistant (§ 1.3) is a different matter: it is a feature of the Software, used by the Practice’s staff, not a tool of the Provider.

3.8 · Data about the contractual relationship

Data about the relationship between the Provider and the Practice (the licence account, billing details, payments, proof that the contract was accepted and commercial correspondence) is processed by the Provider as controller, not on behalf of the Practice. The licence account is also used to open the Software on the Practice’s computers; the Practice’s data to which it gives access continues to be processed on behalf of the Practice (§ 1.1), and of that data the account portal reads only the data set out in § 3.6. The recipients of the contractual relationship data, including those in § 3.4–3.6, the Provider’s accountant and ANAF, are described in the Provider’s privacy policy (https://www.optiswift.ro/confidentialitate).

§ 4 · The mechanism required by Clause 7.7(a), Option 2

4.1 · General authorisation

By entering into the Agreement, the Practice gives the Provider general written authorisation to engage the sub-processors in § 1, as described in the version of this annex in force on the date the Practice accepts the Agreement, which is recorded together with the acceptance (Article 6(5)(a) of the subscription terms). The list in § 1, as amended under § 4.2–4.5, is the “agreed list” referred to in Clause 7.7(a), Option 2. The authorisation also covers the sub-processors of the entities in § 1, on the terms of their data processing agreements and of the lists given in the entries.

4.2 · Notice of a change

The Provider informs the Practice, in writing and specifically, of any intended change to the list in § 1 through the addition or replacement of a sub-processor, at least 30 calendar days before engaging it. The same procedure applies to a change that extends the processing carried out by an existing sub-processor: new categories of data, a new place of processing outside the EEA or a different transfer mechanism.

The notice is sent by email, from contact@optiswift.ro, to the Practice’s email addresses for communications under the Agreement, as set out in Annex I. It is accompanied by the text of the new version of this annex and states:

the name, address and contact person of the proposed sub-processor;
a description of the processing it will carry out and the categories of data it will have access to;
its country of establishment and place of processing and, for a transfer outside the EEA, the transfer mechanism;
the reason for the change and what happens if it does not take place;
the date from which the change applies, which is also the deadline for the Practice to object;
the address of the proposed sub-processor’s data processing agreement.

This is the information the Practice needs to exercise its right to object under Clause 7.7(a).

Ceasing to use a sub-processor without replacing it, and updating information in an entry in a way that does not change the sub-processor, the processing, the categories of data, the place of processing or the transfer mechanism (for example, an address or the version of a data processing agreement), are communicated to the Practice without delay, by email, through a new version of this annex.

4.3 · Changes in the sub-processor chain

The sub-processors in § 1 announce their own changes within the periods set in their agreements: Supabase at least 30 days in advance, Resend at least 14 days in advance, OpenAI by notice, with a right to object within 30 days of the notice, Anthropic by notice, with a right to object within 15 days of the notice, and Proton AG and TeamViewer in the manner and within the periods set out in their data processing agreements. A chain of sub-processors takes on the period of its shortest link, and the Provider cannot extend a period it does not set. To leave the Practice as much time as possible:

the Provider forwards to the Practice any notice it receives on the day it receives it;
the notice shows the date on which the Provider received it and the date from which the change applies at the sub-processor concerned, so that the Practice can see how many days it has left;
if the remaining period is shorter than 30 days, the notice says so in its first paragraph;
the Practice may object under § 4.4; if the sub-processor’s agreement allows the Provider to object, the Provider passes the objection on, within the period set in that agreement.

4.4 · Right to object

The Practice may object in writing, including by email to contact@optiswift.ro, until the date from which the change applies, as stated in the notice. The objection states what the Practice objects to: the proposed sub-processor, the place of processing, the categories of data or the transfer mechanism.

On receiving an objection, the parties proceed as follows:

The Provider replies within 10 working days and states whether there is a commercially reasonable alternative, whether the change can be kept from applying to the Practice’s data, or whether it concerns infrastructure shared by all practices and cannot be postponed for the Practice alone.
If there is an alternative, the Provider proposes it, and the procedure in § 4.2 starts again for it.
If there is none, the parties seek in good faith a solution acceptable to both of them, within no more than 30 days of the objection.
If no solution is reached, the Practice may terminate, by written notice and without penalty, both this Agreement and the OptiSwift subscription. The Provider refunds the part of the price paid in advance that corresponds to the period after the termination date. The Practice chooses between the return and the deletion of its data under Clause 10(d) and has the benefit of the 30-day data export period provided for in the subscription terms, subject to the following paragraph.

Effect of the objection (a clause expressly accepted under Article 1203 of the Civil Code). For as long as the objection has been neither withdrawn nor resolved under steps 1–3, the Provider does not process the Practice’s data through the proposed sub-processor. If the proposed sub-processor provides a function that can be turned off separately for the Practice (for example the in-app assistant or email delivery), that function remains unavailable to the Practice during this period. If the change concerns infrastructure shared by all practices, the Practice may terminate the Agreement under step 4, with effect from a date of its choosing, even before the period in step 3 has expired. In that case, the Provider hands over the full data export to the Practice and carries out the Practice’s choice under Clause 10(d) before the proposed sub-processor processes the Practice’s data; if it cannot do so by the date from which the change applies, the Provider postpones the change for the Practice’s data until it has done so. The Practice may instead withdraw its objection in writing, including for the duration of the export period only. If, after the period in step 3 has expired, the Practice neither terminates the Agreement nor withdraws its objection, the Provider may terminate the subscription under the subscription terms; until termination, the Provider does not process the Practice’s data through the proposed sub-processor. For a change in a sub-processor’s chain (§ 4.3) that the Provider can neither prevent nor postpone for the Practice’s data alone, this paragraph applies only as follows: if the affected function can be turned off separately for the Practice, the Provider turns it off for the Practice, at the Practice’s request, for as long as the objection is maintained; in all cases, the Practice may terminate the Agreement under step 4, with effect from a date of its choosing, including before the date from which the change applies.

4.5 · Emergencies (a clause expressly accepted under Article 1203 of the Civil Code)

If a sub-processor can no longer ensure the protection of the data or ceases to operate, the Provider immediately stops sending it the Practice’s data, even if the function it provided thereby becomes unavailable, and promptly takes whatever measures the situation allows to protect the data already held by that sub-processor. On the same day, the Provider notifies the Practice, stating the reason, the functions affected and the measures taken.

A new sub-processor replacing a sub-processor in § 1 in such circumstances is engaged before the 30-day period in § 4.2 has expired only with the Practice’s written consent, which may also be given by email. The request for consent contains the information listed in § 4.2 and the measures taken to maintain the level of protection. Without the Practice’s consent, the affected function remains unavailable to the Practice until the 30-day period has expired, and the Practice keeps its right to object under § 4.4.

4.6 · Versions of the annex

Each version of this annex bears an identifier (SUBP-n.m) and a date in its heading. The version that applies to the Practice is the one in force on the date the Agreement was accepted, as subsequently amended under § 4.2–4.5 and this point. A new version communicated under § 4.2 or § 4.5 applies, from the date stated in it, only to the list in § 1 and the information in the entries. An amendment to § 2, § 3 or § 4 takes effect only once the Practice accepts it in writing, and an amendment to § 4.4, paragraph “Effect of the objection”, or to § 4.5, only once the Practice accepts it expressly, under Article 1203 of the Civil Code. The version in force is published at https://www.optiswift.ro/abonament/subimputerniciti. The Provider keeps the full text of each version and makes it available to the Practice on request, so that the Practice can show which list was in force on a given date, for example before ANSPDCP (Romania’s data protection authority).

§ 5 · Version history

Version	Date	What changed
`SUBP-1.2`	8 October 2026	first version published by OPTISWIFT S.R.L.
`SUBP-1.3`	9 October 2026	Anthropic Ireland, Limited, for the AI-assisted development and maintenance tools (§ 1.6, § 3.7); OpenAI’s place of processing, worded as in the Agreement; the Stripe payment methods; Proton Drive, for delivering the full export (§ 1.4)

End of Annex IV.