Data Processing Agreement — RESID and SID

Last updated: 28 / 09 / 2026

This Agreement applies to personal use of the applications RESID y SID. The user who adds patient information acts as the Controller, and RESID DATA SOLUTIONS S. de R.L. de C.V. acts as Processor for the processing necessary to provide the applications.

1. Parties

Controller: the account holder who decides to add patient information.
Processor (“RESID”): RESID DATA SOLUTIONS S. de R.L. de C.V., C.P. 15400, Ciudad de México, México.
Contact: contacto@resid.mx · +52 55 3110 5812

2. Definitions

Personal Data: any information relating to an identified or identifiable person.
Processing: an operation performed on data (collection, storage, access, transmission, deletion, etc.).
Subprocessor: a third party engaged by RESID to assist with Processing.

3. Purpose and instructions

RESID will process Personal Data to operate RESID and SID, host and organize information added by the user, make it available for consultation, and, when requested by the user, process messages and files using SID automated assistance features. The user determines what data to add and how to use the results.

The applications are not medical records and do not make medical decisions. The user is responsible for the lawful basis of the data they add and for reviewing any automated result before using it.

4. Processing details

Element	Description
Naturaleza	Alojamiento en servidores operados por RESID DATA SOLUTIONS en México; almacenamiento, consulta, organización y transmisión de información ingresada por el usuario; procesamiento automatizado de texto y archivos en SID cuando el usuario lo solicita; operación técnica y soporte.
Finalidad	Permitir que cada usuario organice, consulte y gestione información relacionada con sus pacientes en RESID y SID, y que utilice las funciones de asistencia de SID bajo su control.
Duración	Mientras el usuario mantenga la información en su cuenta. RESID eliminará la información de los servidores cuando el usuario la elimine o solicite eliminar la cuenta, sujeto a obligaciones legales aplicables.
Categorías de interesados	Usuarios titulares de cuentas personales y personas cuyos datos de pacientes sean incorporados por dichos usuarios.
Categorías de datos	Datos de cuenta y contacto; información de pacientes que el usuario incorpore, incluidos identificadores y datos de salud; mensajes, transcripciones de voz, archivos e imágenes; metadatos de actividad y datos técnicos de seguridad.

5. RESID obligations (Processor)

Process data to provide RESID and SID in accordance with this Agreement and the user’s actions.
Implement reasonable technical and organizational measures to protect the data.
Ensure that authorized personnel are bound by confidentiality obligations.
Notify security incidents as required by applicable law and contractual agreements.
Reasonably assist the user in responding to data subject requests and applicable obligations.
Delete patient information and the account as instructed by the user and under the Privacy Policy, subject to mandatory legal retention.

6. User obligations (Controller)

Have the legal basis and authorizations needed to add patient data.
Use account controls and share information only with people you authorize.
Be responsible for the lawfulness, accuracy, and relevance of the content you add.
Respond to data subject requests when acting as Controller.

7. Subprocessors

The user authorizes the use of auxiliary providers needed to provide the applications. SID may transmit to OpenAI messages and files that the user requests to process. Firebase Cloud Messaging may receive notification tokens; Twilio may receive the minimum data needed for SMS; and IONOS the minimum data needed for email. RESID requires these providers to maintain confidentiality and security protections.

8. International transfers

Servers operated by RESID DATA SOLUTIONS are located in Mexico. Some auxiliary providers may process data outside Mexico; RESID will apply the measures and mechanisms required by applicable regulations.

9. Security incidents

RESID will notify the user without undue delay after becoming aware of a security incident affecting data processed on the user’s behalf and provide reasonable information to support regulatory compliance.

10. Audit

The user may request reasonable information about data protection measures by writing to contacto@resid.mx. Requests must safeguard other users’ security and RESID’s confidential information.

11. Content responsibility

The user acknowledges that RESID and SID are organizational tools. The user decides what content to add and with whom to share it, must ensure its use is lawful, and must review SID’s automated results.

12. Order of precedence

If this DPA conflicts with the main agreement, this DPA will prevail on data protection matters, unless the main agreement provides stronger safeguards.

13. Acceptance

This Agreement applies generally to personal accounts and is accepted electronically within RESID or SID. By accepting it, the user acknowledges the Processor functions described here.