Published 13 November 2026. For existing customers, material changes apply only after the notice and acceptance requirements in the applicable agreement have been met. Previously published version
Parties
This Data Processing Agreement ("DPA") is entered into between:
Controller: The Practitioner, professional services firm or clinic that subscribes to the CalorieScience platform (the "Customer" or "Controller"); and
Processor: CalorieScience Healthtech Pte. Ltd., a company incorporated in Singapore with registered office at 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914 ("CS Singapore", "CalorieScience" or "Processor").
Each a "Party" and together the "Parties".
1. Definitions
"CS India" means CalorieScience Healthtech Private Limited, a company incorporated in India with its office at 3rd Floor, T-Hub, Plot No. 1/C, Sy. No. 83/1, Raidurgam, Panmaktha, Shaikpet, Hyderabad, Telangana 500081, a group company of CS Singapore that acts as a Sub-Processor for engineering and support.
"Customer Personal Data" means personal data uploaded to or processed on the Platform by or on behalf of the Customer, including End Client data.
"Data Protection Laws" means the UK GDPR, EU GDPR, UK Data Protection Act 2018, the Singapore Personal Data Protection Act (PDPA) 2012, and any other applicable data protection or privacy laws.
"End Client" means an individual (patient, client) whose personal data is processed on the Platform under the Customer's account.
"Platform" means the CalorieScience software-as-a-service nutritional practice platform described in the SaaS Terms.
"SaaS Terms" means the SaaS Terms for Nutritionists (published on the CalorieScience website as the Platform Terms) in force between the Customer and CalorieScience.
"SCCs" means the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, as incorporated by clause 8.3.
"Sub-Processor" means any third party engaged by CalorieScience to process Customer Personal Data.
"UK Addendum" means the UK International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner under s.119A of the Data Protection Act 2018, as incorporated by clause 8.2.
Capitalised terms not defined in this DPA have the meanings given in the UK/EU GDPR or the SaaS Terms.
2. Scope and Roles
2.1 In respect of Customer Personal Data processed on the Platform, the Customer acts as the Data Controller and CalorieScience acts as the Data Processor.
2.2 The Customer represents and warrants that, in respect of all Customer Personal Data processed on the Platform: (a) it has and will maintain an appropriate Article 6 lawful basis (typically Article 6(1)(b) Contract for End Client care, or another appropriate Article 6 basis); (b) for Special Category Data concerning health, it relies on Article 9(2)(h) UK/EU GDPR (provision of health or social care or treatment) as the primary condition, undertaken by or under the responsibility of a professional subject to an obligation of professional secrecy, supplemented (where the Customer enables AI-assisted features) by Article 9(2)(a) explicit consent for the AI-assisted processing layer only; (c) it satisfies any equivalent national-law condition, including, where the Customer is established in or processes data in the United Kingdom, Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018 (Health or social care purposes), read with section 11(1) of that Act (that condition does not require an appropriate policy document; CalorieScience makes a voluntary template available); and (d) where the End Client is a child, the Customer is responsible for obtaining any parental or guardian authorisation required by applicable law (including, where relevant, under Article 8 UK/EU GDPR).
2.3 CalorieScience will only process Customer Personal Data in accordance with the Customer's documented instructions (as set out in the SaaS Terms, this DPA, and any reasonable written instructions given subsequently by the Customer), unless required to do otherwise by UK, EU or Member State law to which CalorieScience is subject. In that case CalorieScience will inform the Customer of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.
2.4 For the avoidance of doubt, this DPA does not apply to personal data for which CalorieScience acts as an independent Controller (including Practitioner account, billing, authentication, security and support data), which is governed by the Platform Privacy Notice .
3. Customer Instructions
3.1 CalorieScience will process Customer Personal Data only on documented instructions from the Customer.
3.2 Standing instructions are: (i) to provide the Platform functions selected by the Customer (account management, End Client intake, questionnaires, AI-assisted meal-plan and recipe generation, recipe tag classification, the Practitioner-facing cohort intake chat, biomarker extraction from uploaded lab reports, scheduling and calendar sync, email and push notifications, and invoice notices to End Clients); (ii) to comply with this DPA and the SaaS Terms; (iii) to implement security, backup and continuity measures described in Annex II; and (iv) to derive aggregated statistical information from Customer Personal Data that is genuinely anonymised, so that it cannot identify any Practitioner or End Client directly or indirectly, solely to operate and improve the Platform. CalorieScience will not attempt to re-identify any individual from that information.
3.3 CalorieScience will immediately inform the Customer if it believes an instruction infringes applicable Data Protection Laws, in which case it may suspend action on that instruction pending clarification.
4. Details of Processing
4.1 The subject matter, nature and purpose of processing, categories of data subjects, types of personal data, duration and retention periods are set out in Annex I.
5. Confidentiality
5.1 CalorieScience will ensure that personnel authorised to process Customer Personal Data are bound by written confidentiality obligations or statutory duties of confidentiality.
5.2 Access to Customer Personal Data is restricted on a need-to-know basis using role-based access controls.
5.3 For the purposes of Article 9(3) UK/EU GDPR, the written confidentiality obligations imposed on CalorieScience personnel and CS India personnel handling Special Category Data concerning health are expressed and operated as obligations equivalent to the obligation of professional secrecy. Other Sub-Processors are bound by the confidentiality obligations in their data processing terms (Article 28(3)(b)). CalorieScience and its Sub-Processors process such data "under the responsibility of" the Customer-practitioner.
6. Security
6.1 CalorieScience will implement and maintain the technical and organisational measures described in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to data subjects.
7. Sub-Processors
7.1 The Customer gives CalorieScience general written authorisation to engage the Sub-Processors listed in Annex III to assist in providing the Platform.
7.2 CalorieScience will inform the Customer in writing of any intended addition or replacement of Sub-Processors, by email to the Customer's notified account contact and by publishing an updated Sub-Processor list. CalorieScience will provide at least 7 days' prior written notice of such changes. Where an urgent security, availability, regulatory or business-continuity matter requires it, CalorieScience may shorten the notice period to not less than 72 hours. In every case, the new Sub-Processor will not process Customer Personal Data before the notice period ends, and the Customer may object on reasonable data-protection grounds within the notice period.
Scope of public disclosure: The published Sub-Processor list identifies, for each Sub-Processor, the legal entity name, the country or region in which Customer Personal Data is processed, the high-level purpose of the processing, the Sub-Processor's role, and the applicable international transfer mechanism. It does not disclose internal identifiers, account numbers, endpoint URLs, cryptographic material, IAM role identifiers, network configuration, specific model versions or other information that would increase the attack surface of the Platform. The corresponding Transfer Impact Assessments and Technical and Organisational Measures are available to the Customer (and to the Customer's auditors) on request under a written confidentiality undertaking.
7.3 If the Customer objects to a new Sub-Processor on reasonable data-protection grounds and the parties cannot resolve the objection in good faith, the Customer may terminate the affected Services by written notice.
7.4 CalorieScience will impose data protection obligations on Sub-Processors that are no less protective than those set out in this DPA and remains liable to the Customer for the acts and omissions of its Sub-Processors. The Practitioner is solely responsible for compliance with any statutory professional-secrecy obligations applicable to their practice.
8. International Data Transfers
8.1 CalorieScience will not transfer Customer Personal Data outside the United Kingdom or the European Economic Area except (a) to CS India, whose personnel access the production environment in Frankfurt from India for engineering and support under the signed intercompany agreement listed in Annex III, or (b) to other Sub-Processors listed in Annex III, and in each case only where a valid transfer mechanism under the UK GDPR and/or the EU GDPR is in place. Because CalorieScience is established in Singapore, the Customer's own transfer of Customer Personal Data to CalorieScience as processor is covered by clauses 8.2 and 8.3. Transfer Impact Assessments are available under clause 7.2.
8.2 UK Data Transfers
For restricted transfers of Customer Personal Data subject to the UK GDPR, the parties rely on the UK International Data Transfer Addendum to the EU SCCs (UK Addendum), which is incorporated into this DPA. The Customer is the exporter and CalorieScience is the importer. Tables 1 to 4 of the UK Addendum are completed as set out in Annex IV.
8.3 EU Data Transfers
For transfers of Customer Personal Data originating in the EEA to a jurisdiction not covered by an EU adequacy decision, the parties rely on the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two (Controller to Processor). The SCCs are incorporated into this DPA by reference and completed as set out in Annex IV. Annex I.A and I.B to the SCCs (list of parties and description of transfer) are populated by Annex I to this DPA, and Annex I.C (competent supervisory authority) by Annex IV; Annex II to the SCCs (Technical and organisational measures) is populated by Annex II to this DPA; and Annex III to the SCCs (Sub-processors) is populated by Annex III to this DPA.
8.4 Operational Transfer Architecture
Production Customer Personal Data is hosted in AWS eu-central-1 and MongoDB Atlas (EU_CENTRAL_1), both in Frankfurt, Germany. Singapore-based personnel do not access production data. Engineering access to production data is limited to named CS India operators. Each session requires multi-factor authentication, a ticket approved by a second person, a time-limited (one-hour) just-in-time role and an AWS Session Manager port-forwarding tunnel to a private bastion; shell access is denied and session records are kept (database reads through the tunnel are not yet logged query by query). Because port forwarding can deliver data to the operator's workstation, local storage of Customer Personal Data is prohibited by policy and by the intercompany agreement, rather than technically prevented. Uploaded lab reports may also be read by trained CalorieScience data operators who enter biomarker values for the Customer to review (Annex I.H).
8.5 Precedence
If there is any conflict between this DPA or the SaaS Terms and the SCCs or the UK Addendum, the SCCs or the UK Addendum prevail to the extent of the conflict.
9. Personal Data Breaches
9.1 CalorieScience will notify the Customer, without undue delay and where reasonably feasible within 48 hours of becoming aware, of any personal data breach affecting Customer Personal Data, in each case in sufficient time to enable the Customer to comply with its own notification obligations under Article 33 of the UK/EU GDPR.
9.2 The notice will include, to the extent known: the nature of the breach; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate adverse effects; and the name and contact details of the Privacy Lead or a relevant contact point.
9.3 CalorieScience will cooperate with and assist the Customer in performing the Customer's own notification obligations to supervisory authorities and data subjects where required under Articles 33 and 34 of the UK/EU GDPR.
10. Data Subject Rights
10.1 Taking into account the nature of processing, CalorieScience will provide reasonable assistance to the Customer to enable the Customer to respond to data subject rights requests (access, rectification, erasure, restriction, portability, objection and automated decision-making) under the UK/EU GDPR.
10.2 If CalorieScience receives a request directly from a data subject, it will, without responding to the request on the merits (except as required by law), forward the request to the Customer promptly and in any event within 5 working days.
11. Data Protection Impact Assessments
11.1 CalorieScience will provide reasonable assistance to the Customer in conducting Data Protection Impact Assessments (DPIAs) and prior consultations with supervisory authorities, where required under Articles 35-36 of the UK/EU GDPR.
11.2 The CalorieScience-side DPIA for the Platform is available to Customers on request.
12. Audit Rights
12.1 CalorieScience will, on reasonable written request and subject to appropriate confidentiality obligations, make available to the Customer information necessary to demonstrate compliance with Article 28 UK/EU GDPR and this DPA.
12.2 At the Customer's cost, the Customer (or an independent auditor mandated by the Customer) may conduct an audit of CalorieScience's processing activities relevant to this DPA, no more than once per year except where required by a supervisory authority, following a personal data breach, or where there are indications of non-compliance (and, where the SCCs apply, subject to Clause 8.9 of the SCCs), on at least 30 days' prior written notice and during normal business hours in a manner that does not unreasonably disrupt CalorieScience's operations.
12.3 Audit reports from independent third parties (such as SOC 2 or ISO 27001 reports, where available) may be relied on to satisfy audit requests where reasonable.
13. Return or Deletion of Personal Data
13.1 Retention periods for Customer Personal Data are set out in Annex I.G.
13.2 On termination of the subscription, CalorieScience will, at the Customer's choice, return or delete Customer Personal Data, unless applicable law requires storage.
13.3 On cancellation of a paid plan, Customer Personal Data remains available read-only for export, in a structured, commonly used and machine-readable format, for 90 days (the export period). On cancellation during a free trial, access ends immediately and Customer Personal Data is deleted after 30 days; the Customer may export it before cancelling.
13.4 At the end of the export period, CalorieScience will securely delete Customer Personal Data from production systems, and deletion from encrypted backups will be completed within the 35-day backup rotation cycle.
13.5 Records of End Clients who are minors are retained as configured by the Customer in line with applicable national law. CalorieScience does not apply its own retention rule to them.
13.6 CalorieScience will certify deletion in writing upon the Customer's request.
14. Article 27 Representatives
14.1 CalorieScience has appointed the following representatives under Article 27 of the UK GDPR and the EU GDPR:
UK Representative: DataRep, 85 Great Portland Street, London, W1W 7LT, United Kingdom.
EU Representative: DataRep (Data Protection Representative Limited, a company registered in Ireland, number 616588), 77 Camden Street Lower, Dublin, D02 XE80, Ireland.
Data subjects may contact the relevant representative on matters relating to the processing of their personal data.
15. Liability
15.1 Each party's liability under this DPA is subject to the limitations of liability in the SaaS Terms, provided that neither party excludes or limits liability that cannot lawfully be excluded or limited, including under Article 82 of the UK/EU GDPR.
16. Term
16.1 This DPA forms part of, and is incorporated by reference into, the SaaS Terms. The Customer accepts this DPA by accepting the SaaS Terms, and it takes effect on that date (the "Effective Date"). A signature is not required. CalorieScience will publish the current version of this DPA on its website and provide a copy on request. This DPA remains in force for the duration of the SaaS Terms and for so long as CalorieScience processes Customer Personal Data.
16.2 Clauses that by their nature should survive termination will survive, including security, confidentiality, return/deletion, liability and the Standard Contractual Clauses where mandated.
17. Governing Law
17.1 This DPA is governed by the laws of Singapore, without prejudice to the governing-law provisions of the UK Addendum and the EU SCCs which apply exclusively to the international-transfer obligations they govern. Nothing in this clause affects the rights of UK or EU data subjects to lodge complaints with their supervisory authority or to seek remedies under Article 79 or Article 82 GDPR in their Member State or the UK. For the avoidance of doubt, the EU SCCs are governed by the law of Ireland and disputes under them are subject to the jurisdiction of the Irish courts, as set out in Annex IV. The UK Addendum is governed by the laws of England and Wales, as its mandatory clauses provide.
Annex I - Description of Processing
A. List of Parties
Data Exporter: The Customer (Controller), acting in the capacity of a qualified nutrition or healthcare professional, as identified in the Platform registration and SaaS Terms. Contact person, address and signature: as recorded in the Customer's Platform account on acceptance of the SaaS Terms (clause 16.1). Activities relevant to the transfer: use of the Platform to provide nutrition care to End Clients. Role: controller.
Data Importer: CS Singapore (CalorieScience Healthtech Pte. Ltd.), 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914. Contact person: Sunil Rongala, Privacy Lead (sunil@caloriescience.ai). Activities relevant to the transfer: provision of the Platform. Role: processor. Production systems are hosted in AWS eu-central-1 and MongoDB Atlas (Frankfurt). Singapore-based personnel do not access production data; engineering access is by CS India personnel from India as a Sub-Processor (Annex III). Signature and date: by acceptance of the SaaS Terms (clause 16.1).
B. Categories of Data Subjects
- Practitioners and their staff, only to the extent that they appear in End Client records (for example, in notes or messages). Practitioner account data is outside this DPA (clause 2.4).
- End Clients (patients, customers) registered on the Platform under a Practitioner account.
- Individuals whose personal data is collected during initial enquiry or intake, before the Customer formally accepts them as an End Client.
C. Categories of Personal Data
- Identity and contact data: name, date of birth, sex, contact details.
- Anthropometric data: weight, height, body composition.
- Health and lifestyle data: dietary intake, activity, sleep, nutrition-related goals.
- Biomarker and laboratory data: uploaded lab reports (PDF or image) and the values extracted from them, including the End Client's name as it appears on the report.
- Treatment and interaction data: meal plans, recipes, professional notes, appointment history, messages and invoice notices (invoice number, amount and End Client name).
- AI planning data: pseudonymised, allow-listed data sent to OpenAI for meal-plan and recipe generation (nutrition targets, allergies, intolerances, dietary preferences, medical-condition names, age, gender, pregnancy trimester, activity level, BMI, city or county and country, cuisine preferences and sanitised Practitioner instructions). This is pseudonymised personal data, not anonymised data.
- Usage and diagnostic data: limited logs required to secure and operate the Platform.
D. Special Categories of Data
End Client data processed on the Platform typically includes Special Category Data concerning health (Article 9(1) UK/EU GDPR). The Customer relies on Article 9(2)(h) UK/EU GDPR (provision of health or social care or treatment) as the primary condition for such processing, undertaken by or under the responsibility of a professional subject to an obligation of professional secrecy, with corresponding national-law conditions where applicable (in the UK, Data Protection Act 2018 Schedule 1 Part 1 paragraph 2 - Health or social care purposes, read with section 11(1); that condition does not require an appropriate policy document). Where the Customer enables AI-assisted features on the Platform, the Customer additionally relies on Article 9(2)(a) UK/EU GDPR (explicit consent) as a supplementary condition for the AI-assisted processing layer only. The Customer must ensure explicit consent and any withdrawal are recorded through the client consent form or in its own records, and may contact CalorieScience at sunil@caloriescience.ai about AI-assisted processing for an End Client. CalorieScience's role is limited to processing under the Customer's documented instructions, CalorieScience and CS India personnel process Special Category Data under contractual confidentiality of an effect equivalent to professional secrecy for the purposes of Article 9(3), and other Sub-Processors under the confidentiality obligations in their data processing terms. Restrictions and safeguards: encryption in transit and at rest; engineering access to production data only by named CS India operators under the controls in clause 8.4; pseudonymisation of data sent to OpenAI; confidentiality obligations under clause 5.
E. Frequency of Transfer
Continuous, for the duration of the Customer's subscription. Access from India takes place on demand under approved tickets.
F. Nature and Purpose of Processing
The table below maps the main processing activities performed on the Platform to CalorieScience's role in each activity:
|
Activity |
Purpose |
CalorieScience Role |
|---|---|---|
|
End Client registration and consent capture |
Enable onboarding and track lawful basis artefacts |
Processor |
|
Meal-plan and recipe generation and recipe tag classification (AI-assisted, OpenAI) |
Produce nutritional plans and recipes for Practitioner review, using pseudonymised planning data |
Processor |
|
Cohort intake chat (AI-assisted, OpenAI) |
Practitioner-facing chat in which the Practitioner types cohort intake details; no AI feature interacts directly with End Clients |
Processor |
|
Biomarker extraction from uploaded lab reports (AI-assisted with Google Vertex AI, or by a trained CalorieScience data operator) |
Convert uploaded reports into structured data for the Practitioner to review and, where needed, correct |
Processor |
|
Questionnaire administration and response storage |
Capture intake and follow-up data |
Processor |
|
Appointments, calendar sync and notifications |
Operate scheduling (Google Calendar), email (Amazon SES) and push notifications (Firebase) under Customer control |
Processor |
|
Invoice notices to End Clients |
Send invoice notices issued by the Customer to End Clients by email and push notification |
Processor |
Processing for which CalorieScience is an independent controller (Practitioner accounts, subscription billing, security of the Platform, website analytics and marketing) is outside this DPA (clause 2.4) and is described in the Platform Privacy Notice .
G. Retention Period
The retention periods applicable to the principal data categories are as follows:
|
Data Category |
Retention |
|---|---|
|
End Client records: health data, lab reports, meal plans, questionnaires, notes and messages |
Determined by the Customer. Kept while the Customer's subscription is active, in line with the Customer's instructions and professional record-keeping duties (a typical professional record-keeping period is 7 years, at the Customer's choice). CalorieScience does not set its own retention for this data. On termination, clause 13 applies. |
|
Records of End Clients who are minors |
As configured by the Customer in line with national law. |
|
Prospective clients invited but not signed up |
Deleted after 30 days (SaaS Terms clause 12.5.1). |
|
AI-features consent records |
Proposed: life of the account plus 6 years, to evidence consent. |
|
Authentication and security logs |
12 months (rolling) |
|
Backups |
35-day rolling retention |
|
Anonymised, aggregated statistics (clause 3.2(iv)) |
Not personal data once genuinely anonymised; kept only as needed to operate and improve the Platform. |
H. Transfers to Third Countries
Customer Personal Data is hosted in AWS eu-central-1 and MongoDB Atlas EU_CENTRAL_1 (Frankfurt). Singapore-based personnel do not access production data. CS India personnel access production data from India for engineering and support under clause 8 and Annex III. OpenAI processes pseudonymised planning data in the United States. Biomarker values in uploaded lab reports are extracted either by Google Vertex AI or by a trained CalorieScience data operator who reads the report and enters the values. The Customer reviews every value and can correct or override it. Who the data operators are, where they work and how they access the reports is to be confirmed. Other Sub-Processor locations and transfer mechanisms are listed in Annex III. For transfers to Sub-Processors, the subject matter, nature and duration of processing are those described in this Annex I and in Annex III.
Annex II - Technical and Organisational Measures
The measures below are structured to mirror the requirements of Article 32(1) UK/EU GDPR. Each is a commitment by CalorieScience. Where a measure is already in place this is stated; the other measures are being implemented, and their current status is available to the Customer on request under clause 7.2.
1. Pseudonymisation, data minimisation and encryption
- TLS is in place on CloudFront, API Gateway and database connections. CalorieScience will use TLS 1.2 or above for all API and web traffic.
- Uploaded lab reports are stored encrypted with AWS KMS keys, and the database uses the provider's default encryption at rest. CalorieScience will keep all Customer Personal Data encrypted at rest.
- Data minimisation applied at ingest (mandatory and optional fields). Calls to OpenAI are limited by a sanitiser, on every call path, to pseudonymised, allow-listed planning data (no names, contact details, dates of birth, record identifiers, lab values or client free text); this is pseudonymisation, not anonymisation for Article 4(5) purposes. Google Vertex AI receives the uploaded lab report, which identifies the End Client, for biomarker extraction.
- AI providers do not use Customer Personal Data for model training. OpenAI requests are sent with store: false, under OpenAI's enterprise terms and a signed data processing agreement. Zero data retention applies under those terms, so OpenAI does not keep requests for abuse monitoring. On Vertex AI, caching is disabled, data-access audit logs are enabled and the zero-retention opt-out for abuse monitoring is in place.
2. Confidentiality, integrity, availability and resilience
- Production hosting in Frankfurt, Germany, with a highly available deployment (a three-node database replica set and managed AWS services in eu-central-1).
- CalorieScience will ensure that the production database has no public network endpoint and is reachable only from the application and through the access path in clause 8.4.
- Separate AWS accounts for development, staging and production, and web-application firewall rules on the API and CloudFront, are in place. CalorieScience will apply least-privilege identity and access management throughout.
- Centralised logging and alerting on security events are in place. CalorieScience will keep security and authentication logs for 12 months.
- Automated encrypted backups are kept for no more than 35 days, and restores are tested periodically.
3. Ability to restore availability and access in a timely manner
- A documented backup-restore runbook and incident-response procedure are in place. CalorieScience will test the incident-response procedure by exercise.
- CalorieScience will review every break-glass (shell) session and other elevated-privilege event independently.
4. Process for regular testing, assessing and evaluating effectiveness
- Regular vulnerability scanning of production workloads.
- An external penetration test of the production environment has been performed and its findings have been closed. CalorieScience will repeat external testing periodically.
- CalorieScience will review its security controls and vendor baseline at least once a year.
5. User identification and authorisation
- Multi-factor authentication is required on the production just-in-time role and for the database organisation. CalorieScience will enforce it for all production and administrative access.
- CalorieScience will apply role-based access control on the principle of least privilege and review production access quarterly.
- Production access only through named accounts with MFA, a ticket approved by a second person, a time-limited just-in-time role and an AWS Session Manager port-forwarding tunnel to a private bastion (shell access denied; session records kept). Local storage of Customer Personal Data is prohibited by policy, not technically prevented.
6. Data protection by design and by default
- Production, staging and development run in separate AWS accounts. Development and staging must hold synthetic data only, and CalorieScience will verify this.
- CalorieScience will keep Customer Personal Data and health data out of application logs and keep application logs for no more than 90 days.
- CalorieScience will carry out a privacy-by-design review of new features and changes that affect data handling.
7. Personnel security
- CalorieScience will carry out background checks appropriate to role and jurisdiction for personnel with access to production data.
- CalorieScience will ensure that all personnel with access to Customer Personal Data are bound by written confidentiality obligations (clause 5.1).
- CalorieScience will provide security and data protection training on onboarding and at regular intervals.
8. Governance
- Privacy Lead (data protection contact): Sunil Rongala (sunil@caloriescience.ai).
- A documented governance framework covering scope, impact assessments, international transfers and operational procedures is maintained and reviewed periodically.
- Incident response and breach notification procedures with defined roles and escalation paths.
Annex III - List of Sub-Processors
The following Sub-Processors are authorised by the Customer in accordance with Clause 7. CalorieScience will publish the current list on its website and provide it on request.
|
Sub-Processor |
Service |
Processing Location |
Transfer Mechanism |
|---|---|---|---|
|
Amazon Web Services EMEA SARL (AWS) |
Cloud hosting of the production environment: compute (Lambda, API Gateway), storage of uploaded lab reports (S3, KMS-encrypted), content delivery (CloudFront) and logging (CloudWatch) |
Germany (eu-central-1, Frankfurt); CloudFront and WAF operate at AWS's global edge |
AWS Data Processing Addendum with EU SCCs |
|
Amazon Web Services EMEA SARL (Amazon SES) |
Transactional email: sign-in codes, questionnaire reminders and invoice notices to End Clients (End Client name and invoice details; no clinical content) |
Germany (eu-central-1, Frankfurt) |
AWS Data Processing Addendum with EU SCCs |
|
MongoDB Limited (MongoDB Atlas) |
Primary database for End Client records, identity vault, audit records and backups |
Germany (EU_CENTRAL_1, Frankfurt) |
MongoDB Data Processing Agreement (accepted) |
|
Google Cloud EMEA Limited (Vertex AI, Gemini) |
Biomarker extraction from uploaded lab reports: receives the full report file (PDF or image) and extracts values and the End Client's name; caching disabled |
EU, UK and Switzerland: europe-west3 (Frankfurt) in production; configured fallbacks europe-west4, europe-west1, europe-west2 (London) and europe-west6 (Zurich) |
Google Cloud Data Processing Addendum (accepted) |
|
OpenAI (contracting entity confirmation pending) |
AI meal-plan and recipe generation, recipe and ingredient tag classification, and the Practitioner-facing cohort intake chat. Receives only pseudonymised, allow-listed planning data (for example nutrition targets, allergies, medical-condition names, age, BMI); never names, contact details, dates of birth, record identifiers, lab values or client free text. Requests are sent with store: false and are not used for model training. |
United States |
EU SCCs and UK Addendum in OpenAI's Data Processing Addendum, signed under OpenAI's enterprise terms; zero data retention applies |
|
Google (Firebase Cloud Messaging) (contracting entity confirmation pending) |
Push notifications to Practitioner and End Client devices; invoice-event payloads carry invoice number, counterpart name and amount; no clinical content |
Google's global infrastructure, including the United States |
Google's data processing terms for Firebase, with standard contractual clauses or the EU-US Data Privacy Framework |
|
Google (Google Workspace: Calendar and Meet) (contracting entity confirmation pending) |
Appointment sync: a CalorieScience service account creates calendar events whose title or attendees may include the End Client's name and email; Google Meet for video consultations |
Google's global infrastructure, including the United States |
Google Workspace data processing terms (accepted), with standard contractual clauses or the EU-US Data Privacy Framework |
|
CS India (CalorieScience Healthtech Private Limited) |
Engineering and support: access to the production environment by named operators under the controls in clause 8.4 |
India (remote access to data hosted in Frankfurt) |
Intercompany agreement with EU SCCs Module 3 and UK Addendum, signed; Transfer Impact Assessment available on request |
Tools used only for CalorieScience's internal operations that do not process Customer Personal Data are not listed above. Whether Read.ai or any similar meeting tool is used, and remains strictly internal, is to be confirmed.
Not Sub-Processors of Customer Personal Data: Stripe (Practitioner subscription billing only; no End Client data); Google Analytics 4, Google Tag Manager, Microsoft Clarity, Google Ads, Meta Pixel and LinkedIn Insight (website analytics and advertising after consent); Mixpanel (product analytics on Practitioner accounts); Zoho CRM and Zigment.ai (planned for Practitioner leads; not yet integrated); Slack (internal alerts with no End Client data); and Spoonacular (recipe lookups, no personal data). CalorieScience uses these as an independent controller, or they receive no personal data, and they are described in the Website Privacy Notice and the Platform Privacy Notice .
Analytics currently also run on logged-in Practitioner pages after consent, and Microsoft Clarity session replay or Mixpanel could capture End Client data on screen. CalorieScience will restrict analytics to marketing pages or apply strict masking. Client packages sold by Practitioners with payment through Stripe are planned, not live, and will be assessed before launch.
CalorieScience will notify Customers of additions or replacements of Sub-Processors in accordance with clause 7.2: at least 7 days' prior written notice by email and on the published list, or at least 72 hours' notice for urgent security, availability, regulatory or business-continuity changes. A new Sub-Processor does not process Customer Personal Data before the notice period ends, and Customers may object on reasonable data-protection grounds within the notice period.
Annex IV - EU SCC and UK Addendum Completions (Module 2)
Clause 7 - Docking clause:
Included. Further controllers or processors may accede with the agreement of the Parties by completing the Annexes.
Clause 9(a) - Use of sub-processors:
Option 2 (general written authorisation). The importer will inform the exporter in writing of intended changes at least 7 days in advance (at least 72 hours for urgent security, availability, regulatory or business-continuity changes), as set out in clause 7.2; the list is in Annex III.
Clause 11 - Redress:
The optional wording on an independent dispute resolution body is not used.
Clause 13 / Annex I.C - Competent Supervisory Authority:
(a) Where the Customer is established in an EU Member State: the supervisory authority competent for the Customer as exporter (its lead or competent authority).
(b) Where the Customer is not established in the EU but has appointed a representative under Article 27(1) GDPR: the supervisory authority of the Member State where that representative is established. (c) Where the Customer is not established in the EU and is not required to appoint a representative: the supervisory authority of the Member State where the data subjects whose personal data is transferred are located. In all cases data subjects keep the right to complain to the authority where they live (Article 77 GDPR). A representative does not create a lead supervisory authority.
Clause 17 - Governing Law:
These Standard Contractual Clauses shall be governed by the law of Ireland.
Clause 18 - Choice of Forum and Jurisdiction:
Any dispute arising from these Clauses shall be resolved by the courts of Ireland, without prejudice to the rights of data subjects under Clause 18(c) to bring proceedings in the Member State of their habitual residence.
UK Addendum - Tables 1 to 4:
Table 1 (Parties): the Customer as exporter and CS Singapore as importer, with the details in Annex I.A. Table 2 (Selected SCCs, Modules and Selected Clauses): the EU SCCs incorporated by clause 8.3, Module 2, with the elections in this Annex IV. Table 3 (Appendix Information): Annex I.A and I.B, Annex II and Annex III of this DPA. Table 4 (Ending this Addendum when the Approved Addendum changes): neither Party.
Signatures
Signature is optional: this DPA binds the parties on acceptance of the SaaS Terms (clause 16.1). Customers who need a countersigned copy may complete the blocks below.
For the Customer (Controller):
Name: ______
Title: ______
Entity: ______
Date: ______
Signature: ____________________________________
For CalorieScience (Processor):
Name: ______
Title: ______
Entity: CalorieScience Healthtech Pte. Ltd. (CS Singapore), Singapore
Date: ______
Signature: ____________________________________