Version date: October 15, 2026 | Effective Date: This Policy becomes effective when published after the U.S. Department of Commerce notifies DeepHealth that its initial self-certification submission is otherwise complete.
Framework coverage: EU-U.S. Data Privacy Framework | UK Extension | Swiss-U.S. Data Privacy Framework
DeepHealth, Inc. (“DeepHealth,” “we,” “us,” or “our”) participates in and complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. DeepHealth has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles for personal data received from the European Union and European Economic Area in reliance on the EU-U.S. DPF and from the United Kingdom and Gibraltar in reliance on the UK Extension. DeepHealth has also certified that it adheres to the Swiss-U.S. DPF Principles for personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If this Policy conflicts with the applicable DPF Principles, the applicable DPF Principles govern.
DeepHealth commits to subject to the applicable DPF Principles all personal data it receives in the United States from the European Union or European Economic Area, the United Kingdom or Gibraltar, or Switzerland in reliance on the applicable framework. Learn more through the U.S. Department of Commerce Data Privacy Framework Program and view DeepHealth’s current certification on the Data Privacy Framework List.
1. Scope
This Policy applies to personal data that DeepHealth, Inc. receives in the United States in reliance on the EU-U.S. DPF, the UK Extension, or the Swiss-U.S. DPF. It supplements other DeepHealth privacy notices, employment notices, customer contracts, data processing agreements, business associate agreements, product notices, and service-specific terms.
DeepHealth’s certification covers DeepHealth, Inc. only. It does not cover any other U.S. entity or any non-U.S. affiliate.
DeepHealth may act as a controller, processor, or subprocessor depending on the processing purpose. When DeepHealth acts for a customer or another controller, it processes personal data under that controller’s documented instructions and the applicable contract. DPF participation does not replace a required controller-processor or processor-subprocessor contract, and DeepHealth’s role does not reduce its own obligations under the applicable DPF Principles.
2. Personal data covered
Covered personal data may include business contact and account information; user credentials and permissions; customer, supplier, and professional-contact information; support requests and attachments; security and access records; technical logs and telemetry; website, event, and marketing information; recruitment information; current and former employee information; and, when authorized by customer contracts and instructions, clinical imaging data, DICOM metadata, patient identifiers, health information, and related clinical or technical records.
DeepHealth treats as sensitive personal data information concerning medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, genetic data, biometric data used for unique identification, and criminal-conviction or criminal-offence data. DeepHealth also treats as sensitive any personal data received from a third party that the third party identifies and treats as sensitive.
3. Purposes
DeepHealth processes covered personal data for limited and specified purposes that may include providing, implementing, hosting, securing, maintaining, supporting, and monitoring products and services; administering accounts, contracts, billing, and customer relationships; responding to support and rights requests; operating websites and business communications; managing suppliers and professional advisers; conducting legal, quality, regulatory, product-safety, audit, and compliance activities; protecting systems, people, and facilities; administering recruitment and the employment relationship; and other compatible purposes disclosed in an applicable notice or authorized by the individual or transferring controller.
DeepHealth does not process personal data received under the DPF for a materially different purpose unless the new purpose is compatible with the original purpose and the individual has received the choice required by the applicable DPF Principles, or another exception recognized by those Principles applies.
4. Notice and choice
DeepHealth provides clear information about the categories of personal data, purposes, recipients, choices, rights, complaint routes, and other matters required by the applicable DPF Principles through this Policy and any applicable supplemental notice. When DeepHealth collects covered personal data directly, it provides the required notice when the individual is first asked to provide the information or as soon thereafter as practicable, and before the information is first used for a materially different purpose or disclosed for the first time to a third party.
When DeepHealth acts as a controller and the Choice Principle applies, DeepHealth offers individuals a clear and readily available opportunity to opt out before personal data is disclosed to a non-agent third party or used for a purpose materially different from the purpose for which it was originally collected or subsequently authorized. To exercise a DPF choice, contact [email protected] with the subject line “DPF Choice Request.”
When DeepHealth acts as a controller and the Choice Principle applies, DeepHealth obtains affirmative express consent (opt in) before disclosing sensitive personal data to a third party or using it for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual through opt-in choice, unless an exception recognized by the applicable DPF Principles applies. Disclosures to agents performing tasks on DeepHealth’s behalf are governed by written contracts.
When DeepHealth acts as a processor or subprocessor, the applicable customer or controller is responsible for the individual-facing lawful basis, notice, and choice decisions assigned to it. DeepHealth follows documented instructions and assists as required by contract and the applicable DPF Principles.
5. Disclosures and onward transfers
DeepHealth may disclose covered personal data to the following categories of recipients for the limited purposes described below:
- The relevant customer or controller, to provide the contracted services, follow instructions, and support rights or incident handling.
- Authorized DeepHealth personnel and approved affiliates, to perform assigned service, support, security, administrative, legal, quality, regulatory, product-safety, finance, or employment functions.
- Service providers and subprocessors, to provide hosting, infrastructure, communications, implementation, support, security, analytics, payment, benefits, recruitment, professional, or other contracted services.
- Professional advisers, auditors, insurers, and transaction counterparties, for legal, audit, insurance, financing, diligence, integration, or corporate-transaction purposes subject to appropriate restrictions.
- Regulators, courts, law-enforcement authorities, and other public bodies when disclosure is required or permitted by applicable law.
- Other recipients identified in an applicable notice or authorized by the individual or transferring controller.
For a transfer to a third party acting as a controller, DeepHealth applies the Notice and Choice Principles and requires the recipient by contract to process the data only for limited and specified purposes consistent with the applicable authorization, provide the same level of protection as the applicable DPF Principles, notify DeepHealth if it can no longer meet that obligation, and cease processing or take reasonable and appropriate steps to remediate nonconforming processing.
For a transfer to a third party acting as an agent, DeepHealth transfers personal data only for limited and specified purposes; ascertains that the agent is obligated to provide at least the same level of protection as the applicable DPF Principles; takes reasonable and appropriate steps to ensure compliant processing; requires notice if the agent can no longer provide the required protection; and takes reasonable and appropriate steps to stop and remediate unauthorized processing.
DeepHealth remains responsible under the applicable DPF Principles for covered personal data it receives and subsequently transfers to a third party acting as an agent on its behalf. DeepHealth remains liable if the agent processes that personal data in a manner inconsistent with the applicable DPF Principles unless DeepHealth proves that it is not responsible for the event giving rise to the damage.
6. Security
DeepHealth maintains reasonable and appropriate administrative, technical, and physical safeguards designed to protect covered personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks of the processing and the nature of the personal data. Safeguards include, as appropriate, access controls, authentication, encryption, logging, vulnerability management, secure development, incident response, supplier controls, backup and recovery controls, and workforce confidentiality and security obligations.
7. Data integrity, purpose limitation, and retention
DeepHealth limits covered personal data to information that is relevant for the purposes of processing. To the extent necessary for those purposes, DeepHealth takes reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete, and current.
DeepHealth retains personal data in identifiable form only for as long as it serves a permitted processing purpose or is necessary to satisfy an applicable legal, regulatory, quality, product-safety, contractual, legal-hold, audit, security, or claims requirement. DeepHealth continues to apply the applicable DPF Principles to covered personal data for as long as it retains, uses, or discloses the data.
8. Access, correction, and deletion
Individuals may request access to covered personal data that DeepHealth holds about them and may request correction, amendment, or deletion when the information is inaccurate or has been processed in violation of the applicable DPF Principles, subject to the exceptions and limitations permitted by those Principles. Requests may be sent to [email protected] with the subject line “DPF Rights Request.”
DeepHealth may request information reasonably necessary to verify identity and locate the relevant data. When DeepHealth acts as a processor or subprocessor, it may refer the request to the relevant controller and assist that controller in responding.
9. Human resources data
DeepHealth’s DPF commitments include personal data about current and former employees received in the United States from the EU or EEA, the United Kingdom or Gibraltar, or Switzerland in the context of the employment relationship. Additional information is provided in the DeepHealth Human Resources Data Privacy Framework Notice, which is distributed to affected employees and is available from People Operations and the DeepHealth Privacy Office.
For covered human resources data, DeepHealth commits to cooperate with investigations by and comply with the advice of the competent EU data protection authorities, the UK Information Commissioner’s Office and Gibraltar Regulatory Authority, and the Swiss Federal Data Protection and Information Commissioner, as applicable.
10. Complaints and independent recourse
DeepHealth commits to resolve complaints about its collection or use of personal data received in reliance on the DPF. Individuals should first contact [email protected]. DeepHealth will investigate and respond to a DPF Principles-related complaint within 45 days.
For unresolved complaints, DeepHealth has elected to cooperate with the panel established by EU data protection authorities, the UK Information Commissioner’s Office and Gibraltar Regulatory Authority, and the Swiss Federal Data Protection and Information Commissioner, and to comply with the advice given by those authorities, as applicable. These independent recourse mechanisms are available to the individual at no cost.
Official complaint routes: EU/EEA DPA complaint form | UK ICO DPF complaints tool | Gibraltar Regulatory Authority | Swiss FDPIC complaint form
11. Binding arbitration
Under certain conditions, an individual may invoke binding arbitration to address residual claims concerning DeepHealth’s compliance with the applicable DPF Principles after completing the required pre-arbitration steps. For EU/EEA claims, this option is unavailable where an EU data protection authority has authority to resolve the same claim against DeepHealth under the applicable DPF Principles. The arbitration panel may impose individual-specific, non-monetary equitable relief as provided in the Annex I Binding Arbitration Mechanism.
12. Federal Trade Commission jurisdiction
The Federal Trade Commission has investigatory and enforcement jurisdiction over DeepHealth’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
13. Lawful requests by public authorities
DeepHealth may be required to disclose personal data in response to lawful requests by public authorities, including to meet national-security or law-enforcement requirements. DeepHealth limits any disclosure to the extent required by applicable law and applies the DPF Principles subject to the exceptions recognized in those Principles.
14. Contact
DeepHealth, Inc.
Privacy Office
212 Elm St.
Somerville, MA 02144
United States
[email protected]
Data Protection Officer: [email protected]
External Data Protection Officer: [email protected]
15. Changes and continued protection
DeepHealth may update this Policy to reflect changes in law, the DPF program, or DeepHealth’s practices. DeepHealth will not make a material change that is inconsistent with the applicable DPF Principles while continuing to claim participation. The version date appears at the top of this Policy. If DeepHealth withdraws from or is removed from an applicable framework for a reason other than persistent failure to comply with the applicable DPF Principles, it will continue to apply the applicable DPF Principles to personal data received in reliance on that framework for as long as it retains the data, unless it provides adequate protection through another authorized means or returns or deletes the data, as the applicable DPF Principles require. If DeepHealth is removed for persistent failure to comply, it will return or delete the personal data received in reliance on the applicable framework, as the applicable DPF Principles require.