Data Processing Agreement

This Data Processing Agreement (this “Agreement”) is made between the customer of MORRU HIS, the hospital and clinic management system (“you”), as the data controller, and CRAZYCODE COMPANY LIMITED (“we”, “us”), as the data processor.

1. Background and Order of Precedence

1.1 This Agreement forms part of the Terms and Conditions for Using MORRU HIS (the “Main Terms”) and is made under Section 40 of the Personal Data Protection Act B.E. 2562 (2019) and its related subordinate legislation (the “Law”).

1.2 This Agreement becomes binding when you accept the Main Terms, or when the parties sign a document version of it.

1.3 If the Main Terms conflict with this Agreement on any matter concerning personal data, this Agreement prevails.

1.4 Terms not defined in this Agreement have the meaning given in the Main Terms and the Law.

2. Roles and Scope

2.1 For the personal data of your patients and personnel that you or your users enter into the Service, or that arises from your use of the Service (“Your Data”), you are the data controller and we are the data processor.

2.2 The nature, purposes, types of data and categories of data subjects are set out in Annex 1.

2.3 This Agreement does not apply to data for which we are the data controller, which is governed by our privacy policy, namely (1) your customer account, contact and billing data, and (2) data of individuals who register as members of the MORRU application or website with us directly. When a patient books an appointment or a teleconsultation with you through the MORRU application, we send the data needed for that service into your system, and from the moment it enters your system that data is Your Data under clause 2.1.

3. Processing on Instructions

3.1 We process Your Data only on your instructions, which are (1) the Main Terms and this Agreement, (2) the use and configuration of the Service by you or your users, and (3) your written requests through the channels we designate.

3.2 We will not process Your Data for our own purposes, will not sell or rent it, and will not use it to train or develop artificial intelligence systems.

3.3 If we believe that any of your instructions infringes the Law, we will inform you without undue delay and may suspend that instruction until you confirm or amend it.

3.4 If the Law or an order of a competent authority requires us to disclose Your Data, we will notify you in advance to the extent the law permits and disclose only what is required.

4. Our Personnel

4.1 We give our personnel access to Your Data only as necessary to provide the Service, maintain the system, or resolve issues you request.

4.2 Personnel with access to Your Data are bound by confidentiality obligations during and after their engagement with us.

4.3 We revoke the access of personnel who leave their role without undue delay.

5. Security

5.1 We maintain appropriate technical and organisational security measures, at least as described in Annex 2, taking into account that health data is sensitive personal data.

5.2 We may update these measures from time to time, without materially lowering the overall level of protection.

5.3 You are responsible for the measures on your side, including user permissions, password management and the devices used to access the Service, as set out in clause 10.2 of the Main Terms.

6. Sub-processors

6.1 You authorise us to engage the sub-processors listed in Annex 3.

6.2 If we add or replace a sub-processor, we will notify you at least 30 days in advance by email to your account administrator or by notice on this page. You may object on data protection grounds within that period. If we cannot reach agreement, you may terminate the affected part of the Service.

6.3 We will bind each sub-processor to data protection obligations no less protective than those in this Agreement, to the extent relevant to the service that sub-processor provides.

6.4 We remain responsible to you for the performance of our sub-processors under this Agreement.

7. Data Location and International Transfers

7.1 The databases, files and backup copies of Your Data are stored on cloud infrastructure located in Bangkok, Thailand.

7.2 Some data must be sent to sub-processors located outside Thailand to provide certain functions you choose to use, namely email, video teleconsultation, notifications in your patients' application, payment collection and LINE messaging, as detailed in Annex 3.

7.3 Transfers under clause 7.2 are made in accordance with Sections 28 and 29 of the Law, relying on the standard contractual clauses or other appropriate safeguards provided by each sub-processor.

7.4 We will not transfer Your Data outside Thailand beyond Annex 3 without notifying you under clause 6.2.

8. Assistance to the Controller

8.1 The Service provides tools for you to search, correct and export patient data yourself. For data subject requests you cannot handle yourself, we will assist you in time for you to respond within the period required by the Law.

8.2 If one of your patients submits a request directly to us, we will forward it to you without undue delay and will not respond on your behalf unless you instruct us to.

8.3 We will provide reasonably necessary information to help you carry out data protection impact assessments and respond to the Office of the Personal Data Protection Committee.

9. Personal Data Breaches

9.1 When we become aware of a personal data breach affecting Your Data, we will notify you without undue delay and no later than 24 hours after becoming aware of it, by email to your account administrator.

9.2 The notification will contain the information available at the time, and we will provide further information as it becomes known, including (1) the nature of the breach and when it occurred, (2) the categories and approximate number of data subjects and records affected, (3) the likely consequences, (4) the measures we have taken or will take to address and mitigate the breach, and (5) our contact person for the breach.

9.3 We will take reasonable steps to contain the breach, mitigate its effects and preserve evidence.

9.4 Notifying the Office of the Personal Data Protection Committee and data subjects is your duty as data controller. We will provide the information you need to notify within the required time and will not notify third parties on your behalf unless you instruct us to or the law requires it.

9.5 A notification under this clause is not an admission of fault or liability by us.

10. Records of Processing

10.1 We will prepare and maintain records of processing activities as a data processor under Section 40 of the Law and the related notifications, and will provide them to a competent authority on request.

11. Audits

11.1 We will provide information reasonably necessary to demonstrate our compliance with this Agreement, such as answering a security questionnaire, no more than once a year unless a personal data breach occurs or a competent authority requires it.

11.2 On-site audits are subject to agreement between the parties case by case, at your cost, and must not compromise the security or confidentiality of our other customers.

12. Retention, Return and Deletion

12.1 Throughout your use of the Service, we retain Your Data in the Service.

12.2 When your use of the Service ends, expires or is suspended, we do not delete Your Data automatically. Your account may be limited to read-only access, and you may still ask us to export all of your data. Your Data is kept until you request deletion under clause 12.3. If we decide to set a retention period after the end of the Service, we will notify you at least 90 days in advance.

12.3 Deletion of all data and permanent closure of the account follows these steps: (1) your authorised representative requests permanent closure, (2) we export all of Your Data to you, (3) you confirm in writing that you have received the data and instruct us to delete it, (4) we delete the data. You may cancel the request at any time before step (4).

12.4 On deletion under clause 12.3, Your Data is removed from the database immediately, and files and backup copies are fully deleted within 8 days. We will issue you a deletion certificate.

12.5 Clause 12.4 does not apply to data we are required by law to retain, such as accounting and tax records of the service fees you paid to us.

12.6 The duty to retain medical records for the period required by law is yours. You should keep the data received under clause 12.3 (2) before confirming deletion.

13. Liability

13.1 Each party's liability under this Agreement is governed by clause 14 of the Main Terms, unless the law provides otherwise.

14. Term and Amendment

14.1 This Agreement remains in effect for as long as we process Your Data, even after the Main Terms end.

14.2 Amendments to this Agreement follow clause 16 of the Main Terms. Changes to Annex 3 follow clause 6.2.

14.3 You may contact us about this Agreement and any notifications at morru@morru.com

Annex 1 Details of Processing

Nature of processing Storage, recording, organisation, retrieval, display, transmission, export, backup and deletion through a Software as a Service hospital and clinic management system.

Purposes Providing MORRU HIS to you, including registration, appointments, medical records, ordering and reporting laboratory and imaging results, dispensing and inventory, finance, teleconsultation and communication with patients; maintaining, backing up and troubleshooting the system; and complying with the law.

Duration Throughout the Service and thereafter in accordance with clause 12.

Data subjects Your patients (including their emergency contacts), and your personnel and users.

General patient data Title, first name, last name, national identification number, passport number, nationality, sex, date of birth, address, telephone number, email, photograph, emergency contact, patient number, and LINE account data when you connect a LINE Official Account.

Sensitive personal data (Section 26) Health data, including treatment history, diagnoses, chronic conditions, drug allergies, medicines and procedures, laboratory results, imaging studies and reports, specialty examination records, clinical photographs, medical certificates, and live audio and video of teleconsultations, which are transmitted live and not recorded.

Patient financial data Invoices, receipts, payment records, coupons and vouchers. Payment card data is not stored in the system.

Personnel data Name, email, telephone number, position, signature, practice schedule, access rights, password (encrypted), activity history, IP address and devices used to sign in.

Legal basis Determined by you and your responsibility under clause 5.1 of the Main Terms.

Annex 2 Security Measures

• Location Databases, files and backup copies are hosted on Amazon Web Services in the Bangkok region, Thailand.
• Encryption in transit All user connections use HTTPS with TLS 1.2 or higher, and HTTP requests are redirected to HTTPS automatically.
• Encryption at rest Database storage is encrypted, files are encrypted with AES-256, and application encryption keys are managed through AWS Key Management Service.
• Data separation Each customer's data is separated by application-level access control. Users can access only the data of the accounts and branches they are granted.
• User access control Permissions are set per menu and role by your administrator, and sign-in sessions are recorded in the database and can be revoked.
• Activity records Significant actions in the system are recorded for your administrator to review.
• Backup and recovery Automated database backups can be restored for 7 days, and deleted or overwritten files can be recovered within 30 days.
• System changes Code is deployed to production through an automated process using temporary credentials, with no long-lived keys.
• Payments Payment card data is entered directly with the payment provider and does not pass through or remain in our systems.

Annex 3 Sub-processors

Amazon Web Services

Used throughout the Service for all data in Annex 1. Processing location: Thailand (Bangkok).

Microsoft 365 (Exchange Online)

Used when the system sends appointment, receipt or notification emails. Data involved: name, email, appointment date and time, clinic and doctor names, and receipt items. Processing location: Asia Pacific region.

ThaiBulkSMS

Used when the system sends notification or verification text messages. Data involved: telephone number and message content. Processing location: Thailand.

LINE

Used when you connect your LINE Official Account to the Service, in which case we send messages on your behalf through your account. Data involved: LINE account data, name, and appointment and follow-up message content. Processing location: as set out in LINE's policies.

Zoom Video Communications

Used for video teleconsultation. Data involved: live audio and video, which are not recorded, and the display names of patients and doctors. Processing location: United States.

Expo (650 Industries) via Apple Push Notification service and Firebase Cloud Messaging

Used when patients use the MORRU application. Data involved: device notification tokens and notification titles and messages. Processing location: United States.

Stripe

Used when patients pay through the MORRU application. Data involved: order number and amount, and card data entered by the payer directly with Stripe. Processing location: outside Thailand.

Effective from 9 October 2026