Data Processing Addendum

DentiTalk

Data Processing & Information Security Addendum

Last Updated: 22.08.26

This Data Processing & Information Security Addendum (“Addendum”) forms part of the agreement governing the use of the DentiTalk Service between the individual or organization that purchases or subscribes to the Service (“Customer”) and Adam Gabet, an Israeli sole proprietor operating the registered business גולשים, under the trade name DentiTalk.

For purposes of this Addendum, a “User” is an individual who creates or uses a DentiTalk account. A User may also be the Customer.

This Addendum governs DentiTalk’s processing of personal information on behalf of the Customer in connection with the Service.

If this Addendum conflicts with the DentiTalk Terms of Service or another applicable agreement concerning the processing, privacy, confidentiality, or security of personal information, this Addendum will control with respect to that subject matter.

1. Roles and Instructions

The Customer determines which information is submitted through the Service and the purposes for which the Customer uses the resulting transcription or other output.

To the extent applicable under Israeli privacy law, the Customer is the party that determines the purposes of processing patient information submitted through the Service.

DentiTalk processes such information on behalf of the Customer as an external service provider and, where applicable, as a holder within the meaning of applicable Israeli privacy law.

DentiTalk will process personal information on behalf of the Customer only:

1. as necessary to provide, maintain, secure, and support the Service;
2. in accordance with the Customer’s use of and instructions through the Service;
3. as otherwise described in the applicable agreement and this Addendum; or
4. where required by applicable law.

DentiTalk will not independently determine unrelated purposes for processing patient clinical information.

The Customer instructs DentiTalk to perform the processing described in this Addendum for the purpose of providing the Service.

2. Processing Through the Service

DentiTalk provides professional dictation, speech-to-text transcription, and text-processing functionality.

Processing may include receiving or transmitting dictated audio, speech-to-text processing, automated processing of resulting text, and returning the resulting text to the professional user for use in a destination selected by that user.

Depending on what a professional user chooses to dictate, the information processed may include:

• dictated audio;
• transcription content;
• dental or medical information;
• information concerning treatments, procedures, medications, medical history, dental findings, or other clinical matters;
• patient names or other identifiers; and
• other personal information included in the dictation.

DentiTalk does not require a patient name, Israeli identification number, address, telephone number, or other direct patient identifier in order to provide its transcription functionality. DentiTalk encourages professional users not to include direct patient identifiers in their dictation unless necessary for their intended use of the Service. However, professional users may choose to include identifying or sensitive information in their dictation.

Accordingly, DentiTalk treats clinical dictation as potentially containing identifiable personal and medical information.

DentiTalk is not intended to operate as the Customer’s patient-record system or medical-record repository.

3. Clinical Content, Minimization and Retention

DentiTalk is designed to minimize retention of clinical content.

Under normal operation, audio is streamed for processing. DentiTalk does not intentionally maintain a persistent audio recording of the dictation as part of normal streaming operation.

The resulting transcription is processed transiently and returned to the professional user. DentiTalk does not intentionally retain completed clinical dictation or resulting transcription after completion of the applicable processing operation.

In processing circumstances where temporary audio data must be created to complete the requested transcription, such data will be used only for the applicable processing purpose and will be subject to technical measures designed to delete it following completion or failure of the processing operation.

DentiTalk maintains automated cleanup measures intended to prevent temporary clinical data from remaining indefinitely following application failure or abnormal termination.

The Service is not designed to maintain:

• patient profiles;
• historical dictation recordings;
• historical clinical transcripts; or
• copies of completed clinical notes generated through the Service.

The Customer is responsible for maintaining any medical or dental record it is legally or professionally required to retain in its own authorized systems.

DentiTalk may separately retain account, authentication, billing, security, operational, usage, and user-configured information as reasonably necessary to operate and provide the Service. This may include user preferences, custom instructions, and learned vocabulary. DentiTalk maintains measures designed to minimize the inclusion of patient-identifying information in such persistent customization data. Such information is maintained separately from completed clinical dictation and transcripts and is not intended to constitute or maintain a patient record or clinical history.

4. Permitted Use of Clinical Content

DentiTalk will process Customer clinical content only for purposes consistent with providing, maintaining, securing, supporting, or troubleshooting the Service, or as otherwise required by applicable law.

DentiTalk will not use or disclose Customer clinical content for:

• advertising or targeted advertising;
• sale to third parties;
• creation of advertising or marketing profiles;
• unrelated product analytics involving the retention or use of clinical content;
• training DentiTalk models;
• training third-party models on DentiTalk’s behalf; or
• unrelated secondary commercial purposes.

DentiTalk does not intentionally establish routine human review of clinical dictation or transcription content for product-development, model-improvement, or similar secondary purposes.

This Section does not prevent DentiTalk from generating and using non-clinical usage statistics or aggregate metrics relating to use of the Service, provided that such information does not include clinical content or information intended to identify a patient.

Nothing in this Section prevents automated technical processing of Customer clinical content where reasonably necessary to provide, maintain, secure, support, or troubleshoot the Service in accordance with this Addendum.

5. Confidentiality and Information Security

DentiTalk will treat patient clinical information processed through the Service as confidential.

DentiTalk will maintain technical and organizational security measures appropriate to the nature of the personal information processed and the risks associated with the processing.

Such measures include, as applicable:

• secure transmission of personal information over public networks using accepted encryption methods;
• authentication and access controls;
• restrictions on access to production systems;
• minimization of clinical-content retention;
• measures designed to separate clinical processing from product analytics;
• measures designed to prevent clinical content from being intentionally retained in ordinary application logs or analytics;
• controls for deletion of temporary clinical data;
• security-incident response procedures; and
• measures designed to prevent unauthorized access to Customer information.

Access to Customer personal information will be limited to persons and systems for which access is reasonably necessary for the applicable purpose.

Persons authorized by DentiTalk to access Customer personal information will be subject to appropriate confidentiality obligations and will be required to use such information only as permitted under this Addendum and to comply with applicable information-security requirements.

DentiTalk personnel do not routinely access clinical dictation or transcription content. Where exceptional access becomes necessary, including for investigation of a security incident or compliance with a binding legal requirement, DentiTalk will limit such access to what is reasonably necessary and subject it to appropriate confidentiality and security controls.

DentiTalk may maintain operational, account, security, and usage logs containing non-clinical information such as account identifiers, timestamps, application events, authentication events, technical status, feature usage, and performance information.

DentiTalk’s systems are designed so that patient audio, clinical dictation, and transcription content are not intentionally retained in product analytics or ordinary application logs.

6. Subprocessors

The Customer authorizes DentiTalk to engage third-party service providers where reasonably necessary to provide, maintain, secure, or support the Service, including providers that process personal information on DentiTalk’s behalf.

DentiTalk will maintain current information identifying relevant subprocessors that process personal information in connection with the Service and their relevant functions.

Where a subprocessor processes Customer personal information, DentiTalk will take reasonable measures to assess the subprocessor and will enter into appropriate contractual arrangements requiring the subprocessor to protect the information and addressing the applicable privacy, confidentiality, information-security, permitted-processing, deletion or return, and other data-protection requirements relevant to the subprocessor’s processing.

DentiTalk will not knowingly authorize a subprocessor to use Customer clinical information for its own advertising, unrelated model-training, or other unrelated secondary purposes.

DentiTalk may add or replace subprocessors as its infrastructure evolves. Where a new subprocessor will materially process patient clinical information, DentiTalk will update the applicable subprocessor information and provide notice to the Customer where required by applicable law or the Customer’s applicable regulatory requirements.

Current subprocessor information is available at:

[SUBPROCESSOR PAGE URL]

7. International Processing and Transfers

Personal information processed through the Service may be transmitted to or processed by DentiTalk or authorized service providers in countries other than the country in which the Customer or relevant data subjects are located.

DentiTalk will conduct international transfers of personal information in accordance with applicable data-protection requirements governing such transfers.

Where required by applicable law, DentiTalk will implement or obtain appropriate safeguards, contractual commitments, or other permitted transfer arrangements concerning the protection, permitted use, security, and further transfer of personal information.

DentiTalk will maintain information concerning relevant subprocessors and their applicable processing locations and make such information reasonably available to the Customer.

Unless DentiTalk expressly agrees otherwise in writing, DentiTalk does not guarantee that personal information will be processed exclusively in Israel, the European Union, the European Economic Area, or any other particular jurisdiction. Any international processing or transfer remains subject to applicable data-protection law.

8. Customer and User Responsibilities

Customer responsibilities

The Customer is responsible for:

• determining whether use of the Service is appropriate for the Customer’s activities;
• ensuring that Users accessing the Service on the Customer’s behalf are authorized to do so;
• determining the purposes for which patient information is processed through the Service on the Customer’s behalf;
• ensuring that the Customer has the authority or lawful basis required for such processing;
• providing notices or obtaining permissions where required by applicable law;
• establishing appropriate access to the Service for its Users; and
• complying with privacy, confidentiality, information-security, and other legal obligations applicable to the Customer’s use of the Service.

User responsibilities

Each User is responsible for:

• determining what information the User submits through the Service;
• ensuring that the User is authorized to submit that information;
• using the Service in accordance with applicable law and professional obligations;
• protecting the User’s account, credentials, and devices;
• reviewing transcription and other output for accuracy before incorporating or relying on it as part of a patient’s medical or dental record;
• exercising their own professional and clinical judgment; and
• ensuring that they have any rights or authorizations necessary to use the Service with third-party software or destinations they select.

A User who is also the Customer has the responsibilities applicable to both roles.

DentiTalk’s obligations under this Addendum do not replace the respective obligations of Customers or Users concerning patient information, professional practice, or their use of the Service.

9. Security Incidents

DentiTalk will maintain reasonable procedures for identifying, investigating, containing, and responding to security incidents involving Customer personal information processed by DentiTalk.

If DentiTalk becomes aware of unauthorized access to, disclosure of, alteration of, or loss of Customer personal information processed by DentiTalk, DentiTalk will take reasonable measures to investigate, contain, mitigate, and respond to the incident.

DentiTalk will notify the affected Customer without undue delay where notification is required by applicable law or is reasonably necessary to enable the Customer to meet its applicable legal obligations.

To the extent reasonably available, DentiTalk will provide information concerning the nature of the incident, the personal information affected, and relevant measures taken or proposed in response. DentiTalk may provide additional information as it becomes reasonably available.

Notification of a security incident does not constitute an admission of fault or liability.

Each party remains responsible for notifications or other actions that applicable law requires that party to undertake.

10. Assistance and Oversight

Taking into account the nature of DentiTalk’s processing and the fact that completed clinical content is designed not to be retained, DentiTalk will provide reasonable assistance concerning privacy and information-security obligations directly related to DentiTalk’s processing on behalf of the Customer.

If a patient or other data subject contacts DentiTalk concerning personal information controlled by the Customer, DentiTalk may refer that person to the relevant Customer unless applicable law requires DentiTalk to respond directly.

Because completed clinical dictation and transcription content are designed not to be retained, DentiTalk may be technically unable to retrieve such content after the applicable processing operation has been completed.

Where required by applicable Israeli privacy and information-security law, DentiTalk will report to the Customer at least annually concerning DentiTalk’s performance of its applicable obligations under the Protection of Privacy (Data Security) Regulations, 5777-2017 and this Addendum in connection with DentiTalk’s processing on behalf of the Customer.

Upon reasonable request, DentiTalk will provide information reasonably necessary for the Customer to assess DentiTalk’s compliance with the processing and information-security obligations described in this Addendum. Such information may include, as appropriate, information concerning:

• relevant security measures;
• data flows;
• subprocessors;
• processing locations;
• retention practices; and
• incident-response practices.

DentiTalk is not required to disclose information where disclosure would materially compromise the security of the Service, expose another Customer’s confidential information, reveal credentials or security secrets, or disclose proprietary information beyond what is reasonably necessary for the Customer’s assessment.

Where further information or review is required by applicable law and the information provided is insufficient for that purpose, DentiTalk will provide reasonable cooperation proportionate to the nature and risk of the processing.

11. Return and Deletion

Because DentiTalk is designed not to retain completed clinical content, clinical dictation and transcription content ordinarily will not remain available for return following completion of processing or termination of the Service.

Temporary clinical data remaining within DentiTalk’s systems will be subject to the applicable deletion mechanisms maintained for such data.

Following termination of the Customer relationship, DentiTalk will delete or anonymize retained Customer personal information when it is no longer reasonably necessary for legitimate and lawful purposes. DentiTalk may retain information as reasonably necessary for security, billing, accounting, tax, dispute-resolution, enforcement, or other legal purposes, or as otherwise permitted or required by applicable law.

DentiTalk does not intentionally retain temporary clinical audio or transient transcription content in routine persistent backups.

12. Compliance with Applicable Law

Each party will comply with privacy and information-security laws applicable to its respective activities in connection with the Service.

This Addendum establishes the contractual framework applicable to DentiTalk’s processing of personal information on behalf of the Customer as an external service provider under applicable Israeli privacy and information-security law, including, where applicable, the Protection of Privacy Law, 5741-1981, the Protection of Privacy (Data Security) Regulations, 5777-2017, and applicable requirements governing transfers of personal information outside Israel.

Nothing in this Addendum excludes, restricts, or reduces an obligation to the extent that applicable law does not permit that obligation to be excluded, restricted, or reduced.

13. Term and Relationship to Main Agreement

This Addendum applies for as long as DentiTalk processes personal information on behalf of the Customer under the applicable agreement.

Obligations concerning confidentiality, security incidents, deletion, and information that must lawfully remain protected will survive termination to the extent applicable.

Except as modified by this Addendum, the DentiTalk Terms of Service and any applicable order form or written commercial agreement remain in effect.

If this Addendum conflicts with another applicable agreement concerning the processing, privacy, confidentiality, security, subprocessors, or deletion of personal information, this Addendum will control with respect to that subject matter.

14. Contact

Questions concerning data processing, privacy, or information security under this Addendum may be directed to:

DentiTalk
Operated by Adam Gabet, an Israeli sole proprietor operating the registered business גולשים, under the trade name DentiTalk
Israel

Privacy and Security: adamgabet@gmail.com

Schedule A — Processing Details

Subject matter
Professional dental dictation, speech-to-text transcription, and limited text processing.

Duration
For the duration of DentiTalk’s processing of personal information on behalf of the Customer. Individual clinical processing operations are intended to be transient.

Purpose
Providing the transcription and text-processing functionality requested through the Service by Users on behalf of the Customer.

Nature of processing
Receiving or streaming dictated audio; automated speech recognition; limited automated text processing; transmission of resulting text to the User; and transient technical processing necessary to perform these functions.

Systems and Access

DentiTalk may access and process personal information through the DentiTalk Service and the systems and infrastructure used to provide the Service, to the extent necessary for the processing described in this Addendum.

Where a User uses the Service with third-party software or another destination selected by the User, DentiTalk may interact with that system to the extent necessary to provide the functionality initiated or authorized by the User.

Potential data subjects
Patients and Users whose information may be included in dictation or otherwise processed in connection with the Service.

Potential categories of personal information
Dictated speech, dental and medical information, treatment information, other clinical information, and identifiers or other personal information included by a User.

Clinical-content retention
DentiTalk is designed not to intentionally retain completed clinical dictation or transcription content following completion of the applicable processing operation, subject to temporary processing and deletion mechanisms described in this Addendum.

Secondary use
Clinical content is not used for advertising, sale of personal information, unrelated product analytics, or model training as described in Section 4.

Relevant subprocessors
Current information concerning subprocessors, their functions, and applicable processing locations is maintained by DentiTalk at [SUBPROCESSOR PAGE URL].