GDPR Data Processing Annex
1. Purpose of the annex
This annex governs the processing of personal data carried out by MANU ASSISTANT on behalf of the Client as part of the Manu Assistant Service, in accordance with Article 28 of the GDPR.
2. Roles of the parties
The Client acts as data controller for data entrusted to the Service in the course of its professional activity. MANU ASSISTANT acts as processor and processes data only on the Client's documented instructions, unless otherwise required by law.
3. Nature and purposes of processing
For the features used, processing includes collection, receipt, organisation, transcription of optional audio, generation of documents or suggestions, storage, controlled sharing, return, export and deletion. These operations serve to prepare and document consultations, organise appointments, deliver programmes and instructions in Théra, collect patient responses and feedback, and enable video consultations. The technical operations needed for authentication, admission and service security are part of this scope.
4. Categories of data subjects and data
Data subjects are patients receiving care, people requesting an appointment and the Client's authorised users. Data includes necessary identifiers and contact details; appointment information, notes, assessments, clinical reports, histories and other documents; exercises, instructions and schedules; and questionnaires, responses and feedback submitted in Théra. Consultation audio is optional. Video consultations transmit audio and video streams during the session, without recording, and process their technical metadata. The patient accesses the items the practitioner shares in their space, without general access to the professional record.
5. Confidentiality
MANU ASSISTANT ensures that persons authorised to process data undertake to respect confidentiality and access data only to the extent necessary to perform the Service.
6. Security
MANU ASSISTANT implements appropriate technical and organisational measures, taking account of the state of the art, implementation costs, the nature of the data, risks and processing purposes. These measures may include access control, logging, encryption in transit, logical segmentation, backups, monitoring, vulnerability management and continuity and recovery procedures.
7. Subprocessors
The Client gives general authorisation for the use of subprocessors necessary to operate the Service. As of this version, the Service's technical infrastructure relies in particular on Amazon Web Services EMEA SARL. Other providers may be involved for authentication, email, payment, logging, support or text generation. MANU ASSISTANT ensures that these subprocessors are subject to data protection obligations at least equivalent to those set out in this annex.
Technical information published as of 21 October 2026
- Amazon Web Services EMEA SARL: application infrastructure in Paris; Amazon Chime SDK for video consultations, with media configured in Paris and the control API in Frankfurt. Video consultation metadata is stored in DynamoDB in Paris.
- Other features: the providers actually used for text generation, communications, payment or support must be identified in the applicable contractual list, together with their role and location. This page is not a validated, exhaustive list of named providers.
Ask the team for the list of processors and contractual framework applicable to your use. AWS's HDS certification does not automatically cover Manu's own responsibilities; their contractual and operational coverage remains to be established. Technical information is brought together on the Security page.
8. Transfers
Where a subprocessor involves a transfer outside the EU / EEA, MANU ASSISTANT puts in place the appropriate safeguards required by applicable regulations, including current standard contractual clauses where required, supplemented by measures suited to the nature of the transfer.
9. Assistance
MANU ASSISTANT assists the Client, to a reasonable extent and in light of its role as processor, with responding to requests to exercise rights, carrying out impact assessments where necessary, documenting certain security measures and managing personal data breaches.
10. Breach notification
In the event of a personal data breach affecting processing carried out on the Client's behalf, MANU ASSISTANT informs the Client without undue delay after becoming aware of it, providing relevant information reasonably available.
11. Data at the end of the contract
At the end of the contractual relationship, MANU ASSISTANT returns or deletes data processed on the Client's behalf under the terms of the contract, subject to statutory retention obligations, security constraints or data held temporarily in backups for a technically limited and proportionate period.
Closing Théra patient access does not, by itself, erase documents in the record held by the Client. Requests concerning follow-up data are handled according to the Client's instructions and retention obligations. The privacy policy distinguishes consultation audio, video consultation metadata and patient record data; the deletion procedure allows a request to be made without logging in.
12. Audit and information
The Client may request reasonable information about the security and compliance measures applicable to the Service. Any audit arrangements are organised to protect security, confidentiality, trade secrets and the rights of MANU ASSISTANT's other clients.