Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Terms of Use between you ("Practitioner", "you", or "your") and Advasist Solutions Private Limited ("Company", "we", "our", or "us") governing your access to and use of Naurist (the "Services").

This DPA sets out the responsibilities of each party in relation to the processing of personal data of your clients ("Client Data") when you use Naurist to manage your practice.

By accepting this DPA, you agree to the terms below in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023 (India).

• Client Data means any personal information relating to your clients that you collect, upload, store, or process through Naurist, including name, age, gender, height, weight, health goals, dietary preferences, allergies, meal plans, consultation notes, and any other information you enter into the platform.
• Data Principal means the individual (your client) to whom the Client Data relates.
• Data Fiduciary means the person who determines the purpose and means of processing personal data. For Client Data, you are the Data Fiduciary.
• Data Processor means the person who processes personal data on behalf of a Data Fiduciary. For Client Data, we act as the Data Processor.
• Processing means any operation performed on personal data, including collection, storage, use, transmission, or deletion.
• Applicable Law means the Digital Personal Data Protection Act, 2023, and any other data protection laws applicable to your use of the Services.

You, as the nutrition professional, are the Data Fiduciary for all Client Data. You determine what Client Data is collected and the purposes for which it is processed.

We, as Naurist, act solely as the Data Processor and process Client Data only on your documented instructions and as necessary to provide the Services.

We do not own, sell, or independently use Client Data for our own purposes.

As the Data Fiduciary, you are solely responsible for:

• Obtaining valid, informed, and specific consent from each of your clients before collecting, uploading, or processing their personal or health data through Naurist.
• Ensuring you have a lawful basis for processing Client Data under Applicable Law.
• Informing your clients about how their data will be used, stored, and shared.
• Ensuring the accuracy and lawfulness of the Client Data you upload.
• Responding to requests from your clients to access, correct, update, or delete their data.
• Complying with all obligations of a Data Fiduciary under Applicable Law.

You confirm that your clients are happy to share any health data you handle through Naurist, and that you have obtained all necessary permissions to do so.

As the Data Processor, we will:

• Process Client Data only on your instructions and to provide and improve the Services.
• Not use Client Data for our own purposes or disclose it except as permitted under this DPA or required by law.
• Implement appropriate technical and organizational security measures to protect Client Data.
• Ensure that personnel authorized to process Client Data are bound by confidentiality obligations.
• Assist you, where reasonably possible, in responding to requests from your clients exercising their rights.
• Notify you without undue delay if we become aware of a personal data breach affecting Client Data.

We implement industry-standard administrative, technical, and organizational safeguards to protect Client Data, including:

• Encryption of data in transit using TLS 1.3.
• Encryption of sensitive data at rest using AES-256.
• Role-based access controls.
• Secure authentication mechanisms.
• Infrastructure monitoring and logging.
• Encrypted backups.
• Periodic security assessments.

While we employ industry-standard safeguards, no system can guarantee absolute security.

You authorize us to engage trusted third-party service providers ("Sub-Processors") to support the delivery of the Services, including cloud hosting providers, payment gateways, email service providers, and analytics providers.

We remain responsible for ensuring that any Sub-Processor is bound by appropriate confidentiality and security obligations consistent with this DPA.

In the event of a personal data breach affecting Client Data, we will notify you without undue delay and provide reasonable information to help you meet your own notification obligations under Applicable Law.

You remain responsible for notifying the relevant authorities and affected clients where required by law.

We retain Client Data for as long as your account remains active or as necessary to provide the Services.

Upon termination of your account, or upon your written request, we will delete or return Client Data in accordance with our data retention practices, unless retention is required by law.

Where Client Data is processed or stored outside India by us or our Sub-Processors, we will ensure that appropriate safeguards are in place consistent with Applicable Law.

Each party’s liability under this DPA is subject to the limitations set out in the Terms of Use.

You remain solely responsible for your compliance obligations as a Data Fiduciary, including obtaining client consent and lawful basis for processing.

We may update this DPA from time to time to reflect changes in our Services, legal requirements, or security practices. When material changes are made, we will update the Last Updated date and, where appropriate, notify you.

Your continued use of Naurist after such updates constitutes acceptance of the revised DPA.

If you have any questions regarding this DPA, please contact us.

Advasist Solutions Private Limited

HD 308, 4th Floor, Spectrum Tower Mindspace, Malad West Mumbai, Maharashtra 400064 India Email: hello@naurist.com