DATA PROCESSING AGREEMENT

Controller–Processor terms under the Saudi PDPL — including iCenna AI Features

Document: iCenna Data Processing Agreement (DPA)

Version: 1.0

Effective Date: 14 August 2026

This Data Processing Agreement (“DPA”) forms part of the iCenna Cloud Services Agreement (the “Agreement”) between iCenna Company, a company incorporated in the Kingdom of Saudi Arabia with commercial registration number 4030497928 and registered address at 8125 Prince Sultan Street, 2086 Ar Rawdah District, Jeddah 23435, Kingdom of Saudi Arabia (“iCenna” or “Processor”) and the Customer (“Controller”), and governs the Processing of Personal Data contained in Customer Content in connection with the Services. It is intended to satisfy the requirements applicable to controller–processor arrangements under the Saudi Personal Data Protection Law (“PDPL”) and its Implementing Regulations.

1. Definitions

“Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject” and “Sensitive Data” have the meanings given in the PDPL. “Patient Data” means Personal Data relating to patients, including health data, processed in the Services and constitutes Sensitive Data under the PDPL. “Sub-processor” means a third party engaged by iCenna to Process Personal Data on the Controller’s behalf. “AI Features” means artificial intelligence and machine learning functionality developed and operated by iCenna and made available as part of the Services, such as clinical documentation assistance, coding suggestions, scheduling optimisation and analytics. Capitalised terms not defined here have the meanings given in the Agreement.

2. Roles and Scope

2.1. The Customer is the Controller and iCenna is the Processor of Personal Data in Customer Content, including where such data is Processed through AI Features. The subject matter, duration, nature and purposes of Processing, and the categories of Personal Data and Data Subjects, are described in Annex 1.

2.2. Each party will comply with its own obligations under the PDPL. The Controller warrants that it has a lawful basis for the Processing, has provided all required notices and obtained all required consents (including for Patient Data), and that its instructions to iCenna — including enabling or configuring AI Features — comply with applicable law.

3. Processor Obligations

iCenna will:

1. Instructions. Process Personal Data only on the Controller’s documented instructions — as set out in the Agreement, this DPA, the Sales Order and the Controller’s use of the Services’ configuration options (including enabling or disabling AI Features) — unless required to do otherwise by applicable Saudi law, in which case iCenna will inform the Controller before Processing unless the law prohibits it. iCenna will inform the Controller if, in its opinion, an instruction violates the PDPL.
2. Purpose limitation. not Process Personal Data for its own purposes, and not disclose, sell or use Patient Data for marketing, advertising or profiling.
3. Confidentiality. ensure persons authorised to Process Personal Data are bound by confidentiality obligations and receive appropriate data protection training.
4. Security. implement and maintain the technical and organisational measures
5. described in Annex 2 and, in further operational detail, in the iCenna Cloud
6. Service Policy (available at https://iCenna.com/cloud-service-policy),
7. appropriate to the risk and the sensitive nature of Patient Data, and review
8. them regularly.
9. Assistance. taking into account the nature of the Processing, assist the Controller with Data Subject requests, impact assessments for high-risk Processing (including any assessment relating to AI Features), and the Controller’s security and breach-notification obligations, at the Controller’s reasonable cost where the assistance is material.
10. Records. maintain records of its Processing activities as required by the PDPL and make them available to the competent authority on lawful request.

4. AI Features

4.1. iCenna-owned, hosted in the Kingdom. The AI Features are developed, owned and operated by iCenna. All AI model hosting and inference involving Personal Data is performed by iCenna software running within iCenna’s dedicated cloud tenancy in the Kingdom of Saudi Arabia. The underlying infrastructure provider acts as a hosting Sub-processor only, as identified on the Sub-processor List; no third-party AI model provider is engaged, and no Personal Data leaves the Kingdom for the purposes of AI Processing.

4.2. No training on Personal Data. iCenna will not use Personal Data (including Patient Data) to train, fine-tune or otherwise improve AI models. AI models may be trained only on data that has been irreversibly de-identified and aggregated in accordance with applicable SDAIA guidance, such that neither the Controller, its Users nor any Data Subject can be identified, directly or indirectly, including in the model’s outputs; such data is no longer Personal Data. Inputs to and outputs of the AI Features remain Customer Content and are Processed solely to provide the Services to the Controller.

4.3. Tenant isolation. AI Features operate with logical tenant isolation. One Controller’s Personal Data is not used to generate outputs for, and is not accessible to, any other customer.

4.4. Human oversight; no automated decisions. AI Features provide suggestions and decision support only; they do not make decisions producing legal or similarly significant effects for Data Subjects. The Controller is responsible for ensuring that qualified personnel review AI-generated outputs before they are relied upon, in particular for any clinical, coverage or eligibility decision. iCenna designs the AI Features to align with the PDPL and applicable SDAIA guidance on the ethical use of artificial intelligence, including transparency, reliability and human oversight principles.

4.5. Controls and transparency. The Controller may disable AI Features (in whole or per module) through the Services’ configuration options. On request, iCenna will provide the Controller with reasonable information about the AI Features’ intended purpose, the categories of data they process, and the measures applied under this Section, to support the Controller’s own PDPL compliance and impact assessments.

5. Sub-processing

5.1. The Controller provides general authorisation for iCenna to engage the Sub-processors listed at https://iCenna.com/sub-processors (the “Sub-processor List”), as referenced in Annex 3. iCenna will give the Controller at least thirty (30) days’ prior written notice (which may be by email or portal posting) of any intended addition or replacement of a Sub-processor, and will update the Sub-processor List accordingly. The Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the affected Services and receive a pro-rata refund of prepaid fees. For clarity, iCenna does not engage any third-party AI model provider as a Sub-processor; any future change to this would follow the notice-and-objection process in this Section.

5.2. iCenna will impose on each Sub-processor, by written contract, data protection obligations no less protective than this DPA, and remains fully liable to the Controller for the Sub-processor’s performance.

6. Data Subject Requests

iCenna will promptly notify the Controller if it receives a request from a Data Subject (including a patient) relating to Personal Data Processed under this DPA, and will not respond except on the Controller’s documented instruction or as required by law. The Services include functionality enabling the Controller to access, correct, export and delete records; iCenna will provide reasonable additional assistance where such functionality is insufficient.

7. Personal Data Breach

7.1. iCenna will notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data Processed under this DPA.

7.2. The notification will describe, to the extent known, the nature of the breach, the categories and approximate numbers of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. iCenna will cooperate with the Controller and take reasonable steps to mitigate and remediate the breach. iCenna’s notification is not an acknowledgement of fault or liability. As Controller, the Customer is responsible for any notifications to the competent authority (SDAIA) and to Data Subjects required by the PDPL; iCenna will provide reasonable assistance.

8. Data Residency and Transfers

8.1. Customer Content, including Patient Data, is stored and Processed — including all AI hosting and inference under Section 4 — in data centres located in the Kingdom of Saudi Arabia, within iCenna’s dedicated cloud tenancy, as described in the Cloud Service Policy.

8.2. iCenna will not transfer Personal Data outside the Kingdom of Saudi Arabia except: (a) on the Controller’s documented instructions; and (b) in compliance with the PDPL’s requirements for transfers outside the Kingdom, including adequacy, appropriate safeguards (such as standard contractual clauses approved by the competent authority), minimisation, and any required approvals. Annex 3 identifies any Sub-processor Processing outside the Kingdom and the safeguard relied upon.

9. Audit

iCenna will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party audit reports and certifications. No more than once per year (or following a Personal Data breach affecting the Controller, or where required by a competent authority), the Controller may audit iCenna’s compliance with this DPA, on at least thirty (30) days’ notice, during business hours, under confidentiality obligations, at the Controller’s cost, and in a manner that does not compromise the security of other customers’ data or iCenna’s intellectual property in its AI models. iCenna may satisfy an audit request by providing a recent independent audit report where reasonable.

10. Return and Deletion

Upon expiry or termination of the Services, iCenna will make Customer Content available for retrieval as set out in the Agreement, and thereafter will delete Personal Data from the Services, including from backups on their scheduled expiry cycle, except where retention is required by applicable Saudi law. For clarity, because AI models are not trained on Personal Data (Section 4.2), deletion of Customer Content does not require model retraining; irreversibly de-identified, aggregated data used under Section 4.2 is not Personal Data and is not subject to return or deletion. Upon the Controller’s request, iCenna will confirm deletion in writing. The Controller acknowledges that it is responsible for retrieving Patient Data needed to meet its own health-records retention obligations before deletion.

11. Liability and Precedence

The liability of each party under this DPA is subject to the exclusions and limitations of liability in the Agreement, except to the extent liability cannot be limited under applicable law. In the event of conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA prevails. This DPA is governed by the laws of the Kingdom of Saudi Arabia and remains in force for as long as iCenna Processes Personal Data on the Controller’s behalf.

Annex 1. Details of Processing

1. Subject matter and duration: provision of the iCenna healthcare cloud Services for the Services Period, plus the retrieval and deletion periods.
2. Nature and purpose: hosting, storage, transmission, display, backup and related Processing necessary to provide the Services, including appointment management, electronic health records, billing and claims, communications, and — where enabled by the Controller — AI-assisted features such as clinical documentation assistance, coding suggestions, scheduling optimisation and analytics, as configured by the Controller.
3. Categories of Data Subjects: the Controller’s patients, employees, practitioners, contractors and other Users.
4. Categories of Personal Data: identification and contact details; national ID / Iqama numbers; demographic data; appointment and administrative data; billing, insurance and claims data; device and usage logs.
5. Sensitive Data: health data, including medical history, diagnoses, prescriptions, lab and imaging results, and related clinical records; and other Sensitive Data the Controller elects to submit.

Annex 2. Core Technical and Organisational Measures

iCenna commits to the

following core measures for the term of this DPA. Further operational detail

(availability, maintenance, support, backup and disaster recovery) is set out

in the iCenna Cloud Service Policy, available at https://iCenna.com/cloud-service-policy,

which forms part of the Service Specifications. Updates to the Cloud Service

Policy will not materially diminish the overall security of the Services during

a Services Period.

1. Governance: documented information security programme aligned with applicable cybersecurity regulations of the Kingdom of Saudi Arabia and recognised industry standards, with policies reviewed at least annually.
2. Encryption: Personal Data encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
3. Access control: role-based, least-privilege access; multi-factor authentication for administrative access; prompt de-provisioning; logical tenant isolation.
4. Data residency: Customer Content, including Patient Data and all AI hosting and inference, stored and Processed in data centres located in the Kingdom of Saudi Arabia.
5. AI controls: no Personal Data in model training sets except as permitted under Section 4.2; segregation between production inference and model development environments; output logging; periodic evaluation of AI Features for accuracy, reliability and bias.
6. Testing and monitoring: vulnerability management, at least annual independent penetration testing, and centralised logging and monitoring with alerting.
7. Personnel and incidents: confidentiality undertakings and security training for personnel; documented, tested incident response with breach notification per Section 7.

Annex 3. Sub-processors

The current list of approved Sub-processors — including, for each, the service provided, the location of Processing and, for any Processing outside the Kingdom of Saudi Arabia, the transfer safeguard relied upon — is maintained at https://iCenna.com/sub-processors and is incorporated into this DPA by reference. Changes to the list are subject to the notice-and-objection process in Section 5.

AI Processing: the AI Features are operated by iCenna itself within its cloud tenancy in the Kingdom of Saudi Arabia; the underlying infrastructure provider appears on the Sub-processor List as a hosting provider only. No third-party AI model provider is engaged as a Sub-processor.