Introduction These Terms and Conditions govern your use of The Aspiring Medics AI Platform. By accessing or using our platform, you agree to be bound by these terms.
• The platform is designed for educational purposes, offering personalized feedback using AI technology. • Users must provide accurate information and are responsible for maintaining the confidentiality of their account.
• The content and technology used on our platform are the property of The Aspiring Medics AI Platform and are protected by intellectual property laws.
• Users must not misuse the platform or engage in any activity that interferes with its functionality. • The platform must not be used for any unlawful purposes.
• The Aspiring Medics AI Platform is not liable for any direct, indirect, incidental, or consequential damages resulting from the use or inability to use the services.
• We reserve the right to modify these terms at any time. Continued use of the platform after changes implies acceptance of the new terms.
• We may terminate or suspend access to our platform immediately, without prior notice, for any breach of these terms.
• These terms are governed by and construed in accordance with the laws of the jurisdiction of The Aspiring Medics AI Platform.
• For any queries regarding these terms, please contact us at contact@theaspiringmedics.co.uk
This Data Processing Addendum (“DPA”) governs OpenAI’s processing of The Aspiring Medics Data (i) provided by The Aspiring Medics to OpenAI through OpenAI’s API or any OpenAI services for businesses (“API Services”) or (ii) pursuant to OpenAI’s provision of the ChatGPT Enterprise service for businesses (the “ChatGPT Enterprise Services”) (for purposes of this DPA, the API Services and ChatGPT Enterprise Services are together the “Services”) under the terms of the OpenAI Business Terms (located at openai.com/policies/business-terms), Enterprise Agreement, or other agreement between The Aspiring Medics and OpenAI governing The Aspiring Medics’s use of the Services (the “Agreement”) and is hereby incorporated into the Agreement. If and to the extent language in this DPA conflicts with the Agreement, the conflicting terms in this DPA shall control. Capitalized terms not defined in this DPA have the meaning set forth in the Agreement. For purposes of this DPA only, “The Aspiring Medics” includes any affiliate entity of The Aspiring Medics’s that (a) has entered into an Order Form with OpenAI and that (b) directly or indirectly, through one or more intermediaries controls, is controlled by, or is under common control with The Aspiring Medics.
OpenAI and The Aspiring Medics each agree to comply with their respective obligations under applicable data privacy and data protection laws (collectively, “Data Protection Laws”) in connection with the Services. Data Protection Laws may include, depending on the circumstances, Cal. Civ. Code §§ 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 (the California Consumer Privacy Act) (“CCPA”), Colo. Rev. Stat. §§ 6-1-1301 et seq. (the Colorado Privacy Act) (“CPA”), Connecticut’s Data Privacy Act (“CTDPA”), Utah Code Ann. §§ 13-61-101 et seq. (the Utah Consumer Privacy Act) (“UCPA”), VA Code Ann. §§ 59.1-575 et seq. (the Virginia Consumer Data Protection Act) (“VCDPA”) (collectively “U.S. Privacy Laws”), and the United Kingdom and/orEuropean Union General Data Protection Regulation (Regulation (EU) 2016/679) (collectively the “GDPR”), and applicable subordinate legislation and regulations implementing those laws.
In connection with the Agreement, The Aspiring Medics is the person that determines the purposes and means for which The Aspiring Medics Data (as defined below) is processed (a “Data Controller”), whereas OpenAI processes The Aspiring Medics Data in accordance with the Data Controller’s instructions and on behalf of the Data Controller (as a “Data Processor”). “Data Controller” and “Data Processor” also mean the equivalent concepts under Data Protection Laws. For purposes of the Agreement and this DPA, (i) “Personal Data” has the meaning assigned to the term “personal data” or “personal information” under applicable Data Protection Laws; and (ii) “The Aspiring Medics Data” means Personal Data that The Aspiring Medics provides to OpenAI that OpenAI processes on behalf of The Aspiring Medics to provide the Services. OpenAI will process The Aspiring Medics Data as The Aspiring Medics’s Data Processor to provide or maintain the Services and for the purposes set forth in this DPA, the Agreement and/or in any other applicable agreements between The Aspiring Medics and OpenAI.
Processing Requirements. As a Data Processor, OpenAI agrees to:
a. process The Aspiring Medics Data only (i) on The Aspiring Medics’s behalf for the purpose of providing and supporting OpenAI’s Services (including to provide insights, reporting, analytics and platform abuse, trust and safety monitoring); (ii) in compliance with the written instructions received from The Aspiring Medics; and (iii) in a manner that provides no less than the level of privacy protection required of it by Data Protection Laws; b. promptly inform The Aspiring Medics in writing if OpenAI cannot comply with the requirements of this DPA; c. not provide The Aspiring Medics with remuneration in exchange for The Aspiring Medics Data from The Aspiring Medics. The parties acknowledge and agree that The Aspiring Medics has not “sold” (as such term is defined by the CCPA) The Aspiring Medics Data to OpenAI; d. not “sell” (as such term is defined by U.S. Privacy Laws) or “share” (as such term is defined by the CCPA) Personal Data; e. inform The Aspiring Medics promptly if, in OpenAI’s opinion, an instruction from The Aspiring Medics violates applicable Data Protection Laws; f. require (i) persons employed by it and (ii) other persons engaged to perform on OpenAI’s behalf to be subject to a duty of confidentiality with respect to The Aspiring Medics Data and to comply with the data protection obligations applicable to OpenAI under the Agreement and this DPA; g. engage the organizations or persons listed at platform.openai.com/subprocessors to process The Aspiring Medics Data (each a “Subprocessor,” and the list at the foregoing URL, the “Subprocessor List”) to help OpenAI satisfy its obligations in accordance with this DPA or to delegate all or part of the processing activities to such Subprocessors. The Aspiring Medics hereby consents to the use of such Subprocessors. If The Aspiring Medics subscribes to email notifications as provided on the Subprocessor List website, then OpenAI will notify The Aspiring Medics of any changes OpenAI intends to make to the Subprocessor List at least 15 days before the changes take effect (which may be via email, a posting, or notification on an online portal for our services or other reasonable means). In the event that The Aspiring Medics does not wish to consent to the use of such additional Subprocessor, The Aspiring Medics may notify OpenAI that The Aspiring Medics does not consent within fifteen (15) days on reasonable grounds relating to the protection of The Aspiring Medics Data by following the instructions set forth in the Subprocessor List or contacting privacy@openai.com. In such case, OpenAI shall have the right to cure the objection through one of the following options: (i) OpenAI will cancel its plans to use the Subprocessor with regards to processing The Aspiring Medics Data or will offer an alternative to provide its Services or services without such Subprocessor; (ii) OpenAI will take the corrective steps requested by The Aspiring Medics in The Aspiring Medics objection notice and proceed to use the Subprocessor; (iii) OpenAI may cease to provide, or The Aspiring Medics may agree not to use whether temporarily or permanently, the particular aspect or feature of the OpenAI Services or services that would involve the use of such Subprocessor; or (iv) The Aspiring Medics may cease providing The Aspiring Medics Data to OpenAI for processing involving such Subprocessor. If none of the above options are commercially feasible, in OpenAI’s reasonable judgment, and the objection(s) have not been resolved to the satisfaction of the parties within thirty (30) days of OpenAI’s receipt of The Aspiring Medics’s objection notice, then either party may terminate any subscriptions, order forms or usage regarding the Services that cannot be provided without the use of the new Subprocessor for cause and in such case, The Aspiring Medics will be refunded any pre-paid fees for the applicable subscriptions, order forms or usage to the extent they cover periods or terms following the date of such termination. Such termination right is The Aspiring Medics’s sole and exclusive remedy if The Aspiring Medics objects to any new Subprocessor. OpenAI shall enter into contractual arrangements with each Subprocessor binding them to provide a comparable level of data protection and information security to that provided for herein. Subject to the limitations of liability included in the Agreement, OpenAI agrees to be liable for the acts and omissions of its Subprocessors to the same extent OpenAI would be liable under the terms of the DPA if it performed such acts or omissions itself; h. upon reasonable request no more than once per year, provide The Aspiring Medics with OpenAI’s privacy and security policies and other such information necessary to demonstrate compliance with the obligations set forth in this DPA and applicable Data Protection Laws; i. where required by law and upon reasonable notice and appropriate confidentiality agreements, cooperate with assessments, audits, or other steps performed by or on behalf of The Aspiring Medics at The Aspiring Medics’s sole expense and in a manner that is minimally disruptive to OpenAI’s business that are necessary to confirm that OpenAI is processing The Aspiring Medics Data in a manner consistent with this DPA. Where permitted by law, OpenAI may instead make available to The Aspiring Medics a summary of the results of a third-party audit or certification reports relevant to OpenAI’s compliance with this DPA. Such results, and/or the results of any such assessments, audits, or other steps shall be the Confidential Information of OpenAI; j. to the extent that The Aspiring Medics permits or instructs OpenAI to process The Aspiring Medics Data subject to U.S. Privacy Laws in a deidentified, anonymized, and/or aggregated form as part of the Services, OpenAI shall (i) adopt reasonable measures to prevent such deidentified data from being used to infer information about, or otherwise being linked to, a particular natural person or household; (ii) not attempt to reidentify the information, except that OpenAI may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes comply with Data Protection Laws or are functioning as intended; and (iii) before sharing deidentified data with any other party, including Subprocessors, contractually obligate any such recipients to comply with the requirements of this provision; k. where the The Aspiring Medics Data is subject to the CCPA, not (i) retain, use, disclose, or otherwise process The Aspiring Medics Data except as necessary for the business purposes specified in the Agreement or this DPA; (ii) retain, use, disclose, or otherwise process The Aspiring Medics Data in any manner outside of the direct business relationship between OpenAI and The Aspiring Medics; or (iii) combine any The Aspiring Medics Data with Personal Data that OpenAI receives from or on behalf of any other third party or collects from OpenAI’s own interactions with individuals, provided that OpenAI may so combine The Aspiring Medics Data for a purpose permitted under the CCPA if directed to do so by The Aspiring Medics or as otherwise permitted by the CCPA; l. where required by law, grant The Aspiring Medics the rights to (i) take reasonable and appropriate steps to ensure that OpenAI uses The Aspiring Medics Data in a manner consistent with Data Protection Laws by exercising the audit provisions set forth in this DPA above; and (ii) stop and remediate unauthorized use of The Aspiring Medics Data, for example by requesting that OpenAI provide written confirmation that applicable The Aspiring Medics Data has been deleted.
Notice to The Aspiring Medics. OpenAI will inform The Aspiring Medics if OpenAI becomes aware of: a. any legally binding request for disclosure of The Aspiring Medics Data by a law enforcement authority, unless OpenAI is otherwise forbidden by law to inform The Aspiring Medics, for example to preserve the confidentiality of an investigation by law enforcement authorities; b. any notice, inquiry or investigation by an independent public authority established by a member state pursuant to Article 51 of the GDPR (a “Supervisory Authority”) with respect to The Aspiring Medics Data; or c. any complaint or request (in particular, requests for access to, rectification or blocking of The Aspiring Medics Data) received directly from The Aspiring Medics’s data subjects. OpenAI will not respond to any such request without The Aspiring Medics’s prior written authorization.
Assistance to The Aspiring Medics. OpenAI will provide reasonable assistance to The Aspiring Medics regarding: a. information necessary, taking into account the nature of the processing, to respond to requests received pursuant to Data Protection Laws from The Aspiring Medics’s data subjects in respect of access to or the rectification, erasure, restriction, portability, objection, blocking or deletion of The Aspiring Medics Data that OpenAI processes for The Aspiring Medics. In the event that a data subject sends such a request directly to OpenAI, OpenAI will promptly send such request to The Aspiring Medics; b. the investigation of any breach of OpenAI’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to The Aspiring Medics Data processed by OpenAI for The Aspiring Medics (a “Personal Data Breach”); and c. where appropriate, the preparation of data protection impact assessments with respect to the processing of The Aspiring Medics Data by OpenAI and, where necessary, carrying out consultations with any supervisory authority with jurisdiction over such processing.
Required Processing. If OpenAI is required by Data Protection Laws to process any The Aspiring Medics Data for a reason other than in connection with the Agreement, OpenAI will inform The Aspiring Medics of this requirement in advance of any such processing, unless legally prohibited.
Security. OpenAI will: a. maintain reasonable and appropriate organizational and technical security measures (including with respect to personnel, facilities, hardware and software, storage and networks, access controls, monitoring and logging, vulnerability and breach detection, incident response, and encryption) to protect against unauthorized or accidental access, loss, alteration, disclosure or destruction of The Aspiring Medics Data and to protect the rights of the subjects of that The Aspiring Medics Data; b. take appropriate steps to confirm that OpenAI personnel are protecting the security, privacy and confidentiality of The Aspiring Medics Data consistent with the requirements of this DPA; and c. notify The Aspiring Medics of any Personal Data Breach by OpenAI, its Subprocessors, or any other third parties acting on OpenAI’s behalf without undue delay after OpenAI becomes aware of such Personal Data Breach.
Obligations of The Aspiring Medics. a. The Aspiring Medics represents, warrants and covenants that it has and shall maintain throughout the term all necessary rights, consents and authorizations to provide The Aspiring Medics Data to OpenAI and to authorize OpenAI to use, disclose, retain and otherwise process The Aspiring Medics Data as contemplated by this DPA, the Agreement and/or other processing instructions provided to OpenAI. b. The Aspiring Medics shall comply with all applicable Data Protection Laws. c. The Aspiring Medics shall reasonably cooperate with OpenAI to assist OpenAI in performing any of its obligations with regard to any requests from The Aspiring Medics’s data subjects. d. Without prejudice to OpenAI’s security obligations in Section 5 of this DPA, The Aspiring Medics acknowledges and agrees that it, rather than OpenAI, is responsible for certain configurations and design decisions for the services and that The Aspiring Medics, and not OpenAI, is responsible for implementing those configurations and design decisions in a secure manner that complies with applicable Data Protection Laws. e. The Aspiring Medics shall not provide The Aspiring Medics Data to OpenAI except through agreed mechanisms. For example, The Aspiring Medics shall not include The Aspiring Medics Data other than technical contact information, or in technical support tickets, transmit user The Aspiring Medics Data to OpenAI by email. Without limitation to the foregoing, The Aspiring Medics represents, warrants and covenants that it shall only transfer The Aspiring Medics Data to OpenAI using secure, reasonable and appropriate mechanisms, to the extent such mechanisms are within The Aspiring Medics’s control. f. The Aspiring Medics shall not take any action that would (i) render the provision of The Aspiring Medics Data to OpenAI a “sale” under U.S. Privacy Laws or a “share” under the CCPA (or equivalent concepts under U.S. Privacy Laws); or (ii) render OpenAI not a “service provider” under the CCPA or “processor” under U.S. Privacy Laws.
Standard Contractual Clauses. a. OpenAI will process The Aspiring Medics Data that originates in the European Economic Area in accordance with the standard contractual clauses adopted by the EU Commission on June 4, 2021 (“EU SCCs”) which are deemed entered into (and incorporated into this DPA by this reference) and completed as follows: i. Module Two (Controller to Processor) of the EU SCCs apply when The Aspiring Medics is a controller and OpenAI is processing The Aspiring Medics Data as a processor. ii. Module Three (Processor to Sub-Processor) of the EU SCCs apply when The Aspiring Medics is a processor and OpenAI is processing The Aspiring Medics Data as a sub-processor. b. For each module of the EU SCCs, where applicable, the following applies: i. The optional docking clause in Clause 7 does not apply; ii. In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of sub-processor changes shall be as set forth in Section 1(g) of this DPA. iii. In Clause 11, the optional language does not apply; iv. All square brackets in Clause 13 are hereby removed; v. In Clause 17 (Option 1), the EU SCCs will be governed by the EU member state where the data exporter is located; vi. In Clause 18(b), disputes will be resolved before the courts of the EU member state where the data exporter is located; vii. Exhibit A to this DPA contains the information required in Annex I and Annex III of the EU SCCs; viii. Exhibit B to this DPA contains the information required in Annex II of the EU SCCs; and c. The Aspiring Medics Data originating from Switzerland shall be processed in accordance with the EU SCCs with the following amendments: i. “FDPIC” means the Swiss Federal Data Protection and Information Commissioner. ii. “Revised FADP” means the revised version of the FADP of 25 September 2020, which is scheduled to come into force on 1 January 2023. Continuing from where the previous text left off:
iii. The term “EU Member State” must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility for suing their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c). iv. The EU SCCs also protect the data of legal entities until the entry into force of the Revised FADP. v. The FDPIC shall act as the “competent supervisory authority” insofar as the relevant data transfer is governed by the FADP.
d. With respect to The Aspiring Medics Data originating from the United Kingdom, the parties will comply with the terms of Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the Information Commissioner’s Office and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses (the “UK Addendum”). The parties also agree (i) that the information included in Part 1 of the UK Addendum is as set out in Annex I of Appendix A to this DPA and (ii) that either party may end the UK Addendum as set out in Section 19 of the UK Addendum.