Data Processing Agreement

1. Parties

2. Background and Scope

The Customer is a researcher or research institution established in the EU, EEA, or UK that uses the StudyRun platform to conduct digital phenotyping studies. In providing the platform services, Selby Labs processes personal data on behalf of the Customer and transfers that data from the EU to Australia.

This agreement governs the processing relationship in accordance with Regulation (EU) 2016/679 ("GDPR"), including Article 28 (processor obligations) and Chapter V (international data transfers).

3. Definitions

Personal Data, Data Subject, Processing, Controller, Processor have the meanings given in Article 4 GDPR.

Special Category Data means personal data falling within Article 9(1) GDPR, including health data and biometric data used to uniquely identify a natural person.

Study Data means all personal data and other data collected from Participants through the Customer's studies on the Platform.

Sub-processor means any third party engaged by Selby Labs to process personal data on behalf of the Customer.

Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

SCCs means the Standard Contractual Clauses incorporated in Section 11, adopted pursuant to Commission Implementing Decision (EU) 2021/914.

4. Nature, Purpose, and Subject Matter of Processing

5. Customer Obligations (Data Controller)

The Customer, as Data Controller, is responsible for:

• Identifying and documenting a lawful basis under Article 6 GDPR for each category of personal data collected
• Where special category data is processed, identifying a valid basis under Article 9(2) GDPR and documenting it in writing before data collection commences
• Providing Participants with a clear privacy notice under Articles 13 and 14 GDPR before data collection commences, naming StudyRun as a data processor
• Obtaining valid informed consent from Participants where consent is the lawful basis relied upon
• Obtaining all required ethics approvals from the relevant institutional ethics committee or equivalent body
• Maintaining records of processing activities under Article 30 GDPR
• Conducting a DPIA under Article 35 GDPR where required (see Section 9).
• Fulfilling data subject rights requests under Articles 15–22 GDPR within statutory timeframes, including by making requests to Selby Labs for participant-level data actions
• Notifying the relevant supervisory authority within 72 hours under Article 33 GDPR where a breach is notifiable
• Notifying affected data subjects under Article 34 GDPR where required

6. Selby Labs Obligations (Data Processor under Article 28 GDPR)

Selby Labs will:

• Process personal data only on documented instructions from the Customer and for no other purpose, including with regard to transfers to third countries
• Inform the Customer if, in Selby Labs's opinion, an instruction would infringe GDPR or other applicable data protection law
• Ensure all personnel authorised to process personal data are bound by appropriate confidentiality obligations
• Implement and maintain appropriate technical and organisational security measures under Article 32 GDPR as described in Section 7
• Not engage sub-processors without the Customer's prior written authorisation. General written authorisation is provided under Section 8.
• Assist the Customer in fulfilling its obligations to respond to data subject rights requests under Articles 15–22 GDPR
• Assist the Customer in ensuring compliance with security, breach notification, DPIA, and prior consultation obligations under Articles 32–36 GDPR
• Capture a timestamped in-app consent record for each Participant, bound to the Participant's pseudonymous identifier, the study identifier, and the device identifier, before any sensor data collection begins for that Participant. This record is uploaded with Study Data and is available to the Customer through the Platform export tools. This record supplements, and does not replace, the Customer's own informed-consent process under Article 7 GDPR and applicable ethics approvals; Selby Labs does not capture signatures, identity verification, or the exact rendered consent text
• Delete or return all personal data upon termination or upon the Customer's written request as described in Section 13
• Make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits
• Remain fully liable to the Customer for the performance of any sub-processor's obligations

7. Security Measures (Article 32 GDPR)

Selby Labs implements and maintains the following technical and organisational measures:

• Encryption at rest: Server-side personal data is protected by AWS EBS volume encryption (AES-256-XTS) with AWS-managed keys, applied to all paid subscription servers and the shared demo server
• Encryption in transit: TLS 1.2 or higher for all communications; TLS 1.0 and 1.1 rejected
• Pseudonymisation: Study Data is stored against pseudonymous Participant identifiers assigned by the Customer. Selby Labs does not hold or have access to any mapping between those identifiers and the natural persons they refer to; the Customer is responsible for maintaining any such mapping externally and applying appropriate access controls to it
• Access controls: Role-based access control; principle of least privilege enforced
• Audit logging: Comprehensive audit logging of access to personal data. Tamper-evident storage of access logs and a minimum 12-month retention period are on Selby Labs's security roadmap; until delivered, this line should be read as an aspirational commitment consistent with the audit-log language in the Australian and International DPAs. Selby Labs will notify Customers in writing when the immutable-log implementation is live.
• Availability and resilience: Disaster recovery procedures tested annually
• Vulnerability management: Regular security reviews; critical patches within 48 hours
• Incident response: Documented breach response procedure including 48-hour Controller notification
• Data region control: EU customer data stored exclusively in the EU AWS region selected at order (eu-west-1 Ireland or eu-central-1 Frankfurt)
• Remote access controls: Remote access by Selby Labs staff in Australia governed by documented procedures and full audit logging

The Customer may request evidence of compliance. An audit may be conducted with no less than 30 days written notice, at the Customer's cost, subject to confidentiality protections.

8. Sub-processors

The Customer provides general written authorisation for Selby Labs to engage the sub-processors listed below. Selby Labs will inform the Customer of any intended addition or replacement with at least 14 days written notice, providing the Customer an opportunity to object on legitimate data protection grounds. Selby Labs shall impose equivalent obligations on all sub-processors and remains fully liable for sub-processor performance.

Device-platform APIs (not sub-processors): The StudyRun mobile app also reads from and interacts with APIs provided by the operating system of the Participant's own device: Apple HealthKit and Apple Core Motion on iOS; and Google Health Connect, Google Play Services Location Services, and Google ML Kit on-device barcode scanning on Android. Data read through these APIs is read from the Participant's device, not from Apple or Google. Use of Google Play Services Location on Android may cause a limited amount of telemetry to be transmitted to Google in the course of normal Android system operation; Google's handling of that telemetry is governed by Google's own Android-platform privacy documentation. These relationships are disclosed here for transparency and are not sub-processor engagements under Article 28 GDPR.

8.1 Sub-processor change notification

The Customer may subscribe to sub-processor change notifications by sending an email to support@studyrun.org with the subject line "Sub-processor notifications". Subscribed Customers will receive email notice of any intended addition or replacement of a sub-processor at least 14 days before the change takes effect, together with sufficient information to assess the data-protection implications of the change. The current sub-processor list is also maintained at studyrun.org/sub-processors. Objections to a proposed sub-processor change should be sent to the same address; an unresolved legitimate-grounds objection entitles the Customer to terminate this agreement and the underlying Services subscription on 30 days written notice without penalty, and to a pro-rata refund of prepaid fees for the unexpired portion of the subscription.

9. Data Protection Impact Assessment

Selby Labs will provide reasonable assistance to the Customer in carrying out DPIAs under Article 35 GDPR, including providing relevant documentation on the technical and organisational measures implemented.

10. Data Subject Rights

10.1 General assistance

Selby Labs will assist the Customer in fulfilling its obligations to respond to data subject rights requests under Articles 15–22 GDPR, including rights of access, rectification, erasure, restriction, portability, and objection, by providing technical tools within the Platform dashboard.

10.2 Direct requests from data subjects

Where a data subject contacts Selby Labs directly with a rights request, Selby Labs will forward the request to the Customer within 5 business days and will not respond to the data subject without the Customer's prior written authorisation.

10.3 Participant erasure (right to be forgotten)

Where a research participant withdraws consent or requests erasure under Article 17 GDPR, the Customer is responsible for making a verified deletion request to Selby Labs. Upon receiving a verified deletion request from the Customer, Selby Labs will:

• Delete all personal data held for that participant from primary storage, databases, and logs containing identifiable data within 5 business days of receiving the verified request
• Purge backup copies of that personal data on the next rotation of the 7-day backup cycle, so that complete purge completes no later than 7 business days plus 7 calendar days from the verified request
• Provide written confirmation of deletion to the Customer once the backup purge has completed
• Retain a non-identifiable deletion log entry recording the date, pseudonym identifier, and type of deletion action. This log does not constitute retention of personal data and is maintained for audit purposes only.

10.4 Right to restrict processing

Where a participant requests restriction of processing under Article 18 GDPR, Selby Labs will, upon the Customer's instruction, freeze processing for the relevant participant identifier without deleting the data, within 5 business days of the Customer's instruction.

10.5 Data portability

Selby Labs provides export tools within the Platform dashboard enabling the Customer to export all data for a specific participant in machine-readable format (JSON and CSV) to support portability requests under Article 20 GDPR.

10.6 Orphaned-controller fallback

If Selby Labs is made aware that the Customer can no longer be reached (for example because the Customer has ceased to exist as a legal entity, the nominated researcher contact has left the institution and no successor has been appointed, or the Customer's subscription has long since lapsed and all contact attempts have failed) and a data subject whose personal data is still held by Selby Labs for that Customer exercises a right under Articles 15–22 GDPR, Selby Labs may, after at least 30 days of documented unsuccessful attempts to reach the Customer and at Selby Labs's reasonable discretion, respond to the data subject directly to give effect to that right, including by deleting the data subject's personal data. Any such action is documented in the deletion log referred to in Section 13.4.

10.7 Automated decision-making restriction

Selby Labs does not itself use Study Data to carry out automated decisions producing legal or similarly significant effects on Participants within the meaning of Article 22 GDPR. The Customer must not configure the Platform to carry out such decisions, and must not export Study Data from the Platform into downstream systems that carry out such decisions, without an Article 22(2) basis and without providing Participants with the safeguards required by Article 22(3).

11. International Data Transfers and Standard Contractual Clauses

11.1 Transfer mechanism and record-keeping

As noted in Section 2, Australia does not have an EU adequacy decision. The appropriate safeguard for transfers of personal data from the EU/EEA/UK to Australia under this agreement is the Standard Contractual Clauses, adopted pursuant to Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor), as incorporated below.

Selby Labs shall maintain a record of all international transfers of personal data made under this agreement and the safeguards in place for each transfer. This record is available to the Customer on request.

11.1A Support-access disclosure

Selby Labs is established in Australia. Selby Labs personnel located in Australia routinely access EU-hosted infrastructure for platform maintenance, monitoring, incident response, and similar operational purposes. Each such access from Australia constitutes an onward transfer from the EU AWS region to Australia for the purposes of Chapter V GDPR; the parties agree that these transfers are covered by the Standard Contractual Clauses incorporated in Section 11.2. Such access is subject to: (i) least-privilege role-based access controls; (ii) individual named user accounts; (iii) logging of administrative sessions; and (iv) confidentiality obligations on all personnel.

11.1B Transfer Impact Assessment

Selby Labs has carried out, and periodically reviews, a Transfer Impact Assessment (TIA) in respect of transfers of personal data from the EU/EEA/UK to Australia under this agreement, consistent with Clause 14 of the Standard Contractual Clauses and the recommendations of the European Data Protection Board. The TIA considers, among other matters, the surveillance and law-enforcement access regime in Australia (including the Telecommunications (Interception and Access) Act 1979 (Cth), the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (Cth), and the Australian Security Intelligence Organisation Act 1979 (Cth)), and the supplementary technical, contractual, and organisational measures applied by Selby Labs to mitigate the risks identified. A copy of the current TIA will be provided to the Customer on request at support@studyrun.org, subject to reasonable confidentiality protections.

11.1C Transparency regarding access requests by public authorities

In accordance with Clause 15 of the Standard Contractual Clauses, Selby Labs shall: (a) if legally permitted, promptly notify the Customer and, where the Customer cannot be reached, the affected data subjects, of any binding legally-enforceable request from a public authority for access to personal data transferred under this agreement; (b) where Selby Labs is legally prohibited from notifying the Customer, use reasonable efforts to obtain a waiver of the prohibition and document its efforts; (c) provide the minimum amount of personal data permissible when responding to any such request, based on a reasonable interpretation of the request; and (d) challenge any request it considers unlawful or disproportionate under applicable law. Selby Labs publishes aggregate transparency statistics about such requests, to the extent legally permissible, at studyrun.org/transparency.

11.1D Joint-controller fallback

The parties have categorised their relationship as controller-processor, without admission that any contrary categorisation applies. This Section is a contingent fallback only and does not of itself establish joint controllership.

To the extent a competent supervisory authority or court determines, on review of a specific subset of processing activities such as Selby Labs's collection of platform-operational telemetry (crash reports, device-info events) or the choice of retention periods and pseudonymisation scheme for the Platform as a whole, that the parties are joint controllers within the meaning of Article 26 GDPR for that subset only, the parties agree that: (i) Selby Labs is the point of contact for data subjects in respect of platform-technical queries only (for example, questions about the technical operation of the app or data-integrity checks). The "rights exercise where Participants cannot reach the Customer" path is the separate orphaned-controller fallback in Section 10.6 and is subject to the 30-day attempt period described there, not this Section; (ii) the Customer is the point of contact for all study-specific queries (including requests relating to the purposes of processing, consent validity, and the content of surveys and tasks); and (iii) this Section operates as an Article 26 arrangement for the specific subset of processing so found, and for no other processing. A summary of this arrangement will be made available to data subjects on request and at studyrun.org/joint-controllership.

11.2 Incorporation of the Standard Contractual Clauses

The parties incorporate into this agreement, by reference and as if set out in full herein and without modification, Module 2 (Controller-to-Processor) of the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as published in the Official Journal of the European Union, L 199, 7.6.2021, pp. 31-61 (the "Standard Contractual Clauses" or "Clauses").

The official text of the Standard Contractual Clauses is available at eur-lex.europa.eu/eli/dec_impl/2021/914/oj. A plain-text copy of the Clauses will be provided free of charge by Selby Labs on request to support@studyrun.org, and the Data Importer shall make a copy available to any data subject free of charge on request as required by Clause 8.3 of the Clauses.

Where this agreement and the Clauses are inconsistent, the Clauses shall prevail, in accordance with Clause 5 of the Clauses.

For the purposes of the Clauses: the Data Exporter is the Customer identified in the StudyRun account registration; the Data Importer is Selby Labs Pty Ltd. The Annexes to the Clauses are completed in Annex I, Annex II, and Annex III of this agreement.

11.3 Module-specific selections and elected options

The parties record the following selections and options in accordance with the optional provisions of the Clauses:

12. Data Breach Notification

Selby Labs will notify the Customer without undue delay and in any event within 48 hours after becoming aware of a data breach affecting Study Data, to enable the Customer to meet its 72-hour notification obligation under Article 33 GDPR. The notification will include:

• A description of the nature of the breach including categories and approximate number of data subjects and records concerned
• The contact details of Selby Labs's data protection contact
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects

Where information is not available in full at the time of initial notification, Selby Labs will provide it in phases without undue further delay. Selby Labs cooperates fully with the Customer in investigating, remediating, and reporting any breach. Selby Labs maintains an internal breach register in accordance with Article 33(5) GDPR. The Customer, as Data Controller, remains responsible for notifying the supervisory authority under Article 33 and data subjects under Article 34 GDPR where required.

13. Deletion and Return of Data

13.1 On termination or Customer request

Upon termination of services, or upon the Customer's written request at any time during the subscription period, Selby Labs shall, at the Customer's choice, delete or return all personal data and delete all existing copies, unless applicable law requires storage. Deletion shall cascade across all storage systems, databases, backup systems, and logs; because backups rotate on a 7-day cycle, purging of personal data from backups completes no later than 7 days after the primary database deletion. Selby Labs shall provide written confirmation of deletion on the Customer's request.

13.2 At subscription end

A countdown and export reminder are shown in the Platform dashboard throughout the subscription, with prominent notice as the subscription end date approaches. At subscription end the Customer has a 7-day export grace period during which they retain read and export access to their server instance. At the end of that 7-day period the server is terminated, the primary database is deleted, and Study Data is purged from backups on the next rotation of the 7-day backup cycle (no later than 14 days after subscription end). Written confirmation of deletion is provided on request.

13.3 Participant-level deletion

The Customer may request deletion of all data held for a specific participant at any time. Upon receiving a verified deletion request, Selby Labs will delete all identifiable data for that participant, cascading across all systems, within 5 business days, and provide written confirmation. See Section 10.3 for full details.

13.4 Deletion confirmation log

For all deletions, Selby Labs retains a non-identifiable deletion log recording the date, the pseudonym identifier, and the type of deletion action. This log does not constitute retention of personal data and is maintained for audit purposes only.

14. Audit Rights

Selby Labs shall make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and this agreement. The Customer or a mandated auditor may conduct an audit with no less than 30 days written notice, at the Customer's cost, subject to confidentiality protections. Selby Labs may provide relevant third-party certifications or security assessment reports in lieu of on-site audits.

15. Liability and Indemnification

Each party shall be liable to the other for material damage caused by non-compliance with this agreement. The Customer shall indemnify Selby Labs against third-party claims arising from the Customer's failure to have a lawful basis for processing or to obtain valid Participant consent. Selby Labs's liability is subject to the limitation in the Terms of Service, except as required by mandatory law including the GDPR and the SCCs.

16. Order of Precedence

In the event of conflict regarding personal data subject to GDPR: the SCCs (Section 11) take precedence over this DPA, which takes precedence over the Terms of Service. Nothing in the Terms of Service limits the rights of data subjects or the obligations of the parties under the SCCs.

17. Governing Law (DPA)

This Data Processing Agreement (excluding the SCCs which are governed by Irish law) is governed by the laws of Victoria, Australia, without prejudice to mandatory rights of data subjects under GDPR. Disputes shall be referred to the courts of Victoria, Australia, except where mandatory GDPR or SCC provisions require otherwise.