Data processing agreement

This agreement is between the lab or institution using Vialo ("the Lab") and the operator of Vialo, whose legal details you can request through the contact form and which are stated when contracting ("Vialo"), and supplements the terms of service. It's accepted by whoever administers the lab, on its behalf.

Roles and purpose

The Lab is the controller of the personal data it records in Vialo and decides what it's used for. Vialo is the processor: it processes the data on the Lab's behalf, only to provide the service, and doesn't use it for its own purposes, sell it or train AI models with it.

The data may concern lab members, clients of its services, suppliers and research participants, and may include health data. Processing lasts as long as the service, plus the deletion period stated below.

What the Lab does

• It has the legal basis to record the data, including any consents and ethics committee approvals required.
• It records only what's necessary and prefers codes to data that directly identifies a person.
• It decides who has access and with what role, and keeps those permissions up to date.

What Vialo does

• It processes the data only on the Lab's instructions, which are these terms and what it configures in the platform.
• It binds anyone accessing the data to confidentiality, and accesses a lab's data only if needed for support or security or when required by law.
• It keeps security measures appropriate to the data: separation between labs enforced in the database, role-based permissions, a change history, encrypted connections and backups, and daily backups with periodic test restores.
• It helps the Lab respond to people's access, correction or deletion requests. If it receives one directly, it refers it to the Lab.

Sub-processors

Vialo uses the providers listed in the privacy policy, which are authorized, and contractually requires equivalent protections from them. If it adds or changes one, it updates the list with its date and announces it in the platform; the Lab can object on reasonable grounds through the contact form and, if that isn't resolved, cancel the service.

International transfers

Data is hosted in Brazil and may be processed in other countries where those providers operate, such as the United States. Vialo maintains the safeguards required by Argentine rules, and the Lab authorizes these transfers.

Incidents

If Vialo becomes aware of a security incident affecting the Lab's data, it notifies the Lab without delay, and within 72 hours at most, with what is known: what happened, what data is affected and what is being done. Each party cooperates with the other to resolve it and to notify whoever is required.

When the service ends: return and deletion

The Lab can export its data at any time. After the service ends, it has at least 30 days to do so, and then Vialo deletes the data, attachments and history from the platform; sooner if the Lab's admins ask in writing. Encrypted backups delete themselves within the following 90 days. Vialo keeps only what the law requires, and a record that the deletion happened.

Verification

On request, Vialo gives the Lab the reasonable information needed to check it complies with this agreement. An on-site or external audit is agreed in writing, with prior notice and at the expense of whoever requests it.

Everything else

Liability is governed by the terms of service. If this agreement and the terms differ on personal data, this agreement prevails. The Spanish version is the one that applies.