Data Processing Agreement

Effective June 10, 2026

This Data Processing Agreement (“DPA”) governs how Relvema processes personal data on behalf of therapists and practices using the Relvema platform (“Controller”). It satisfies the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable U.S. state privacy laws including the California Consumer Privacy Act (CCPA/CPRA) and the Florida Digital Bill of Rights.

This DPA is incorporated by reference into the Relvema Terms of Service and supplements the Business Associate Agreement (BAA) for health-related personal data processed under HIPAA. Where health information is involved, the BAA governs; this DPA governs all other personal data processing.

1. Parties and roles

• Data Controller: The therapist, group practice, or organization that subscribes to Relvema. The Controller determines the purposes and means of processing personal data through the Relvema platform.
• Data Processor: Relvema. Relvema processes personal data only on behalf of the Controller and in accordance with Controller’s documented instructions (primarily: providing the Services described in the Terms of Service).
• Sub-processors: Third parties engaged by Relvema to process personal data as part of providing the Services (see Section 5).

2. Personal data processed

In providing the Services, Relvema processes the following categories of personal data on behalf of the Controller:

Category	Data elements
Patient identity	Full name, email address
Clinical content	Session audio recordings, AI-generated transcripts, SOAP/DAP/BIRP clinical notes, session summaries and insights
Patient app data	Mood scores, journaling entries, homework assignments and completion data, push notification interactions
Scheduling data	Appointment dates and times, modality, session-specific notes
Therapist profile	Name, email, phone, professional credentials (license type/number/state), specializations, practice information
Usage data	Session counts, note generation activity, platform engagement metrics (aggregated, not sold or shared)

Special category data (health data) is processed under both this DPA and the HIPAA BAA. The BAA governs in case of conflict for data subject to HIPAA.

3. Processing instructions

Relvema processes personal data solely to provide the Services described in the Terms of Service and as instructed by the Controller through the platform interface. Relvema will not process personal data for any other purpose, including but not limited to:

• Selling personal data to any third party.
• Using personal data for Relvema’s own advertising or marketing.
• Using personal data to train, fine-tune, or improve any AI or machine-learning model.
• Disclosing personal data to another Controller without the data subject’s explicit consent or a legal basis.

If Relvema is required by applicable law to process personal data in a manner inconsistent with these instructions, Relvema will notify the Controller before processing unless prohibited by law.

4. Security measures

Relvema implements the technical and organizational measures described in the HIPAA Security Policy for all personal data, including:

• AES-256 encryption at rest and TLS 1.2+ in transit for all personal data.
• Access controls limiting data access to authorized personnel and authenticated users.
• Firestore row-level security rules enforcing data isolation between therapists.
• Audit logging via Google Cloud Data Access logs.
• Incident response procedures with breach notification as required.

5. Sub-processors

The Controller authorizes Relvema to engage the following sub-processors to process personal data as part of providing the Services:

Sub-processor	Purpose	Location
Google LLC (Google Cloud)	Cloud infrastructure (Firestore, Cloud Storage, Cloud Functions, Vertex AI, Firebase Authentication, Secret Manager, App Hosting)	United States (primary); GDPR-compliant EU regions available on request
Stripe, Inc.	Payment processing (subscription billing only; does not process health data or patient data)	United States

Relvema will notify Controllers of any intended changes to this sub-processor list (additions or replacements) with at least 30 days’ advance notice, giving Controllers the opportunity to object. If a Controller objects and Relvema cannot accommodate the objection, the Controller may terminate the Services agreement without penalty.

Relvema ensures that all sub-processors are bound by data protection obligations no less protective than those in this DPA, including appropriate agreements under GDPR Article 28 or equivalent frameworks.

6. Data subject rights assistance

Relvema will assist the Controller in responding to data subject rights requests to the extent technically feasible, including:

• Right of access (GDPR Art. 15 / CCPA): Relvema will provide data exports for the Controller’s use in responding to access requests within 30 days of a written request.
• Right to rectification (GDPR Art. 16): Therapists can amend patient records directly in the portal. Relvema can update backend data upon written instruction from the Controller.
• Right to erasure (GDPR Art. 17 / CCPA “right to delete”): Relvema will delete the Controller’s and associated patient data within 60 days of account termination. Expedited deletion can be requested at support@relvema.com.
• Right to portability (GDPR Art. 20): Relvema will provide data in a structured, machine-readable format (JSON) upon written request.
• Right to object to automated decision-making (GDPR Art. 22): AI-generated clinical notes are presented as drafts requiring therapist review and signature. No automated decisions with legal or clinical effect are made without human review.

7. International data transfers

Personal data is processed primarily in Google Cloud’s United States regions. For Controllers in the European Economic Area (EEA) or United Kingdom, the transfer of personal data to Relvema (located in the United States) is governed by:

• The EU Standard Contractual Clauses (SCCs) (Module Two: Controller-to-Processor), as adopted by the European Commission in June 2021, which are incorporated by reference into this DPA. Controllers who require signed SCCs may request them at compliance@relvema.com.
• For UK Controllers, the UK International Data Transfer Addendum (IDTA) to the EU SCCs, as issued by the Information Commissioner’s Office (ICO).

Controllers in the EEA or UK who require data to be processed within the EEA should contact compliance@relvema.com to discuss Google Cloud regional configuration options.

8. Retention and deletion

Relvema retains personal data for the duration of the Controller’s active subscription plus any applicable legal retention requirement. Upon termination of the Services agreement:

• All personal data associated with the Controller’s account will be deleted from active systems within 60 days.
• Backup copies may persist for up to 90 days before being overwritten or deleted in the ordinary course of backup rotation.
• Audit logs may be retained for up to 400 days in compliance with HIPAA audit log requirements.

Controllers may request earlier deletion by emailing support@relvema.com. Deletion requests will be confirmed in writing.

9. Audits and inspections

Relvema will provide the Controller with all information reasonably necessary to demonstrate compliance with this DPA. Upon at least 30 days’ written notice, Relvema will allow for audits or inspections by the Controller or an authorized third-party auditor, subject to reasonable confidentiality protections. Alternatively, Relvema may satisfy this obligation by providing relevant third-party audit reports (SOC 2 or equivalent) covering the systems used to process Controller data.

10. Contact

For questions about data processing, to exercise rights under this DPA, or to request signed SCCs, contact Relvema’s Privacy Officer at compliance@relvema.com.