Data Processing Agreement

01When this agreement applies

For people who use Heliva themselves, CA Systems is the controller of their personal data, and our Privacy Policy applies. This Data Processing Agreement ("DPA") doesn't change that.

This DPA applies only when an organisation (for example a clinic, a dietitian's practice, an employer or a research study) has a written agreement with us that refers to it, under which we process personal data on the organisation's behalf. It forms part of that agreement.

It is between:

• the organisation named in the agreement (the "Controller"); and
• CA Systems, Kexvägen 8, 128 69 Sköndal, Sweden, which runs Heliva (the "Processor").

Heliva has no organisation features in the app today, so the agreement sets out what we process for you. If you need a countersigned copy of this DPA, email support@heliva.app.

02Definitions

Terms such as "personal data", "processing", "controller", "processor", "sub-processor", "data subject" and "personal data breach" have the meaning given in the GDPR (Regulation (EU) 2016/679).

"Customer Data" means the personal data we process on the Controller's behalf under the agreement.

03Roles

The Controller decides which of its people use Heliva under the agreement and why. The Processor processes Customer Data only to provide Heliva as described in the agreement.

For the data each person keeps on their own phone, and for the processing described in our Privacy Policy that isn't part of the agreement, the Processor is not acting for the Controller.

04Details of processing

The Controller is responsible for having a valid exception under Art. 9(2) GDPR for health data. Heliva also asks each person for explicit consent before the first AI request.

05Processor obligations

The Processor will:

1. process Customer Data only on the Controller's documented instructions, which are the agreement and this DPA, unless EU or Swedish law requires otherwise; in that case the Processor will tell the Controller first, unless the law forbids it;
2. tell the Controller if an instruction appears to break the GDPR;
3. make sure everyone with access to Customer Data is bound by confidentiality;
4. apply the security measures in Annex 1;
5. help the Controller, with reasonable notice, to answer data subject requests and to meet its obligations under Art. 32 to 36 GDPR, given the nature of the processing and the information the Processor has;
6. delete or return Customer Data at the end of the agreement, as described in section 11;
7. make available the information needed to show compliance, and allow audits under section 10.

06Controller obligations

The Controller is responsible for its lawful basis for the processing, for informing its people, and for not asking the Processor to process data in a way that breaks the GDPR. The Controller must not require its people to use Heliva's AI features as a condition of anything, since their consent must be freely given.

07Sub-processors

The Controller gives general authorisation for the Processor to use the sub-processors listed at heliva.app/subprocessors.

The Processor will update that page at least 30 days before adding or replacing a sub-processor, and tell the Controller by email. The Controller may object on reasonable data protection grounds within that period. If the objection can't be resolved, the Controller may end the agreement for the affected service and receive a pro-rata refund of prepaid fees.

The Processor remains responsible for its sub-processors and places data protection obligations on them equivalent to those in this DPA.

Google Cloud, the AI provider, may keep requests its automated classifiers flag for up to 90 days, in the EU, to check for abuse. The Controller accepts this as part of the authorised processing.

08International transfers

The Processor stores and processes Customer Data only in the EU/EEA. Any future transfer outside the EU/EEA would be announced as a sub-processor change under section 7 and covered by a transfer mechanism under Chapter V GDPR.

09Personal data breaches

The Processor will notify the Controller without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting Customer Data. The notice describes what is known: the nature of the breach, the likely consequences, the measures taken or proposed, and a contact point. Further information follows as it becomes available.

10Audits

On request, no more than once a year unless a breach or a supervisory authority requires otherwise, the Processor will answer reasonable written security questions and provide the documentation it has. If that doesn't meet a legal requirement, the Controller may carry out an audit at its own cost, with at least 30 days' notice, during business hours, under confidentiality and without disrupting the service.

11Deletion and return

When the agreement ends, the Processor deletes the access and usage records it holds for the Controller's people from live systems within 30 days, and they expire from backups within a further 15 days, unless EU or Swedish law requires them to be kept. Subscription records a person bought themselves stay under our Privacy Policy.

Meal photos and descriptions are not stored, so there is nothing of them to return. Cached food-name matches hold no data about any person. Data on each person's phone is under that person's control.

12Liability

Each party's liability under this DPA follows the agreement. Nothing here limits either party's liability to data subjects or supervisory authorities under Art. 82 GDPR.

13Term and precedence

This DPA lasts for as long as the Processor processes Customer Data. If it conflicts with the agreement on data protection, this DPA prevails. Swedish law governs it.

14Changes to this agreement

Each change is listed here with its date.

• 4 November 2026: first version.

Annex 1: Technical and organisational measures

Hosting. The server and its database run on a virtual server at Hetzner Online in Helsinki, Finland. The database is reachable only from the server's private network.

AI processing. Requests go to Google Cloud's EU multi-region only. Caching is turned off. No name, email or Heliva ID is sent. Photos are re-encoded on the phone to remove location and camera details before they leave it.

Data on the phone. Food logs, weights and Apple Health data stay on the person's phone, under the iPhone's data protection. The Processor has no copy.

Encryption. TLS for all traffic between the app and the server, and to Google Cloud.

Access control. Production access is limited to the people who run Heliva. SSH access uses keys only. The admin page is behind a password and accepts forms only from itself.

Application security. Every request carries a short-lived signed token. App Attest can tie each Heliva ID to one phone. Purchases are verified against Apple's signatures before access is given. Each ID has daily limits on AI requests.

Logging. The API logs request paths, not search words, descriptions or model answers. The HTTPS proxy logs IP address, user agent and the address requested. Logs are kept for no more than 14 days.

Backups. A nightly database dump is kept for 15 days.

Organisation. Everyone with access to production data is bound by confidentiality. New staff or contractors sign a confidentiality agreement before they get access.

Incident response. Breaches are assessed, contained and reported as set out in section 9.