Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

This DPA applies when the Customer qualifies as a Controller under applicable data protection law and morphedra processes personal data on the Customer's behalf. For individual consumer accounts, the Privacy Policy applies instead.

This DPA automatically supplements and is incorporated into the morphedra Terms of Service. In the event of conflict on data protection matters, this DPA prevails.

Subject matter: Processing of personal data submitted by the Customer and its authorised users in connection with the morphedra platform.

Duration: For the term of the Customer's subscription and any applicable retention period thereafter.

Nature of processing: Collection, storage, use, disclosure to sub-processors, and deletion.

Purpose of processing:

• Generation of scientific illustrations, graphical abstracts, 2D and 3D visual assets
• Generation of video abstracts and scientific animations
• Generation of social media posts, News & Views summaries, and research communications
• Platform authentication, account management, and billing administration
• Security monitoring, fraud prevention, and abuse detection
• Service improvement using anonymised, aggregated analytics

Categories of Data Subjects: Customer's employees, researchers, students, and other authorised users who access the platform.

Categories of Personal Data: Name, email address, institutional affiliation, usage data, generated content associated with user accounts. The Customer must not submit Special Categories of Personal Data (health data, biometric data, etc.) unless expressly agreed in writing.

4.1 Customer responsibilities (Controller)

• Has a lawful basis for all Personal Data submitted to the platform
• Has provided all required notices and obtained necessary consents from Data Subjects
• Is responsible for responding to Data Subject rights requests originating from its users
• Provides lawful, documented instructions for Processing
• Does not submit Special Categories of Personal Data without prior written agreement
• Maintains a current and accurate list of authorised users

4.2 morphedra responsibilities (Processor)

• Process Personal Data only on documented instructions from the Customer, except where required by law
• To the extent the CCPA applies, not sell or share Personal Data, and not retain, use, or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service
• Notify the Customer if an instruction appears to violate Data Protection Laws before proceeding
• Ensure that authorised personnel are bound by appropriate confidentiality obligations
• Implement and maintain appropriate technical and organisational security measures
• Engage Sub-processors only as set out in this DPA and notify the Customer of changes
• Assist the Customer with Data Subject rights requests within reasonable timeframes
• Assist with Data Protection Impact Assessments (DPIAs) where required
• Delete or return Personal Data upon termination as instructed by the Customer
• Provide information reasonably necessary to demonstrate compliance with this DPA

4.3 Confidentiality of processing

morphedra ensures all personnel authorised to process Personal Data are subject to enforceable confidentiality obligations.

morphedra implements the following technical and organisational measures, taking into account the state of the art, costs of implementation, and the risks to Data Subjects:

morphedra may update these measures over time to reflect improvements in security practice, provided that updates do not materially reduce the level of protection offered.

The Customer provides general written authorisation for morphedra to engage the sub-processors listed below. morphedra will enter into data processing agreements with each sub-processor imposing data protection obligations no less protective than those in this DPA.

morphedra will provide at least 30 days' advance notice of any intended changes to sub-processors (additions or replacements) by email or in-app notification. The Customer may object to any new sub-processor on reasonable data protection grounds within 14 days. If the parties cannot resolve the objection, the Customer may terminate the affected services without penalty.

The notification shall include, to the extent known at the time:

• Nature of the breach and categories of Personal Data affected
• Approximate number of Data Subjects and records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Name and contact details of the data protection contact point

Where full information is not available within 72 hours, morphedra will provide an initial notification and supplement it as information becomes available. The Customer is responsible for notifying supervisory authorities and Data Subjects as required by applicable law.

• Personal Data is retained only as long as necessary to provide the Service
• Upon termination of the Customer's subscription, Personal Data is deleted or returned within 90 days, at the Customer's choice
• Secure backups may persist for up to 180 days after the deletion date
• Billing records are retained for 7 years to comply with tax and legal obligations
• Security and audit logs are retained for 12 months

Upon written request, morphedra will provide a written certification of deletion or anonymisation within 30 days of completing the process.

morphedra will assist the Customer in fulfilling its obligations to respond to Data Subject rights requests under applicable Data Protection Laws, including requests for:

• Access to Personal Data
• Correction of inaccurate data
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability
• Objection to processing

morphedra will promptly forward any Data Subject request it receives directly to the Customer and will not respond independently unless required by law. Assistance will be provided within reasonable timeframes and at no additional charge for standard requests.

Personal Data may be transferred to and processed in the United States and other countries by our sub-processors. We rely on the following transfer mechanisms:

• EU Standard Contractual Clauses (SCCs, 2021/914) — for transfers from the EEA
• UK International Data Transfer Agreement (IDTA) — for transfers from the UK
• Applicable Pakistani law — as applicable to transfers from Pakistan, including any data protection law that comes into force
• Adequacy decisions — where the destination country has been recognised as adequate

Where Personal Data subject to the GDPR is transferred to morphedra, the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) are incorporated into this DPA by reference. Module Two (controller to processor) applies between the Customer and morphedra, and Module Three (processor to processor) applies to onward transfers to sub-processors. For the purposes of the SCCs: (a) the docking clause in Clause 7 applies; (b) in Clause 9(a), Option 2 (general written authorisation) applies, with the notice period set out in Section 6; (c) the optional wording in Clause 11 does not apply; (d) in Clause 17, the SCCs are governed by the law of Ireland; (e) in Clause 18(b), disputes are resolved by the courts of Ireland; (f) the competent supervisory authority in Annex I.C is the authority responsible for the Customer's establishment in the EU; and (g) Annex I is completed by Sections 1 and 3 of this DPA, Annex II by Section 5, and Annex III by Section 6. If the SCCs conflict with this DPA, the SCCs prevail.

A signed copy of the SCCs is available on written request to founder@morphedra.com.

morphedra will provide the Customer with all information reasonably necessary to demonstrate compliance with this DPA and will permit audits and inspections, subject to the following conditions:

• Audits are conducted no more than once per calendar year, except following a confirmed breach
• The Customer provides at least 30 days' written notice of any intended audit
• Audits are conducted during normal business hours and do not unreasonably disrupt operations
• The Customer bears the cost of any third-party auditor engaged

Where morphedra holds current third-party security certifications (e.g., SOC 2 reports from sub-processors), sharing these may satisfy reasonable audit requirements without an on-site inspection.

morphedra commits to the following specific data protection principles:

• No model training: Customer data is never used to train, fine-tune, or improve morphedra's models. morphedra uses its sub-processors' AI services only through paid commercial API plans whose terms state that inputs and outputs are not used to train the provider's models
• Minimisation: Only the minimum content necessary (typically the research abstract or DOI metadata) is transmitted to the providers for generation
• Segregation: Generated outputs are stored segregated by account, and access is restricted by account permissions
• No public display: Customer content is never displayed publicly or used in morphedra marketing materials without the Customer's prior written permission
• Human oversight: morphedra does not make automated decisions with legal or similarly significant effects on Data Subjects
• Accountability: The Customer remains responsible for reviewing and validating generated content before publication or submission

In the event of conflict between this DPA and the Terms of Service, this DPA prevails solely with respect to the Processing of Personal Data and data protection matters. The Terms of Service govern all other matters including intellectual property, content licensing, payment, and liability, except that the no-public-display commitment in Section 12 prevails over any contrary provision of the Terms of Service for Team, Institutional, and Enterprise customers.

This DPA is governed by the laws specified in the Terms of Service, subject to any mandatory provisions of applicable Data Protection Laws that cannot be contractually waived.

This DPA should be read alongside the Privacy Policy and Terms of Service. In the event of any conflict on data protection matters, this DPA prevails.