Data Processing Agreement
Version 1.1 · Updated October 20, 2026
This is a translation of the Spanish-language document; in case of any discrepancy, the Spanish version prevails.
This Data Processing Agreement applies to the end Client operating an instance of an Omnisol App, as Data Controller, and to Omnisol, as Data Processor. Effective as of October 20, 2026.
1. Parties and roles
This Data Processing Agreement (“Agreement”) is entered into between Omnisol S.A.S. (in formation, Colombia) (“Omnisol”, the “Processor”) and the end Client operating an instance of an Omnisol App (“Client”, the “Controller”), and supplements the License Agreement.
- The Client is the Data Controller for personal data it enters into its instance, including data about its own patients, clients, or employees.
- Omnisol is the Data Processor: it processes that data only on the Client’s behalf and instructions, to provide the Service.
This Agreement applies to “Client Data”: all information the Client or its authorized users enter, store, or generate within its instance.
2. Controller’s instructions
Omnisol will process Client Data only to: (i) provide and maintain the contracted Service; (ii) provide technical support; (iii) comply with legal obligations; and (iv) any additional purposes the Client expressly authorizes (e.g., letting the AI agent query aggregated commercial data, per AI Terms). Any other Client instruction that Omnisol believes to be unlawful will be communicated before being carried out.
3. What data Omnisol processes and to what extent
- Omnisol does not routinely review or access the content of Client Data; support access is exceptional, requested for a specific reason, authorized by the Client’s administrator, time-limited (24 hours), and logged in the instance’s audit trail.
- Each instance’s AI assistant only queries a commercial schema (
negocio) via read-only views: sales, inventory, appointments, repeat customers, and similar data. It does not query or receive sensitive data such as medical records, diagnoses, or other health information, even if stored in the instance. - Distributors have no access to Client Data or credentials; they only see commercial information about the relationship (plan, payments, usage).
4. International transfer and sub-processing
The Client authorizes Omnisol to use sub-processors to provide the Service, including cloud infrastructure providers (file storage and backups on AWS S3, compute on servers outside Colombia and Ecuador) and AI model providers (e.g., Anthropic), which involves an international transfer of Client Data, mainly to the United States.
Omnisol carries out this international transfer with providers that offer adequate data-protection guarantees, through contractual clauses and internationally recognized standards (standard contractual clauses or equivalents), and with the data subject’s authorization when applicable law requires it. Omnisol requires these sub-processors to assume contractual obligations of confidentiality, security, and purpose-limited use. Omnisol will provide the Client, upon request, with a list of relevant sub-processors.
5. Security measures
Omnisol applies reasonable technical and organizational measures to protect Client Data, including:
- Per-client isolation: independent database and file storage per instance.
- Encryption in transit and access credentials restricted per folder/instance.
- Daily backups, stored in a separate repository.
- Role-based access control and mandatory two-factor authentication for Omnisol’s internal administrative roles.
- Audit logging of exceptional support access.
6. Sub-processors
Omnisol may engage sub-processors (cloud infrastructure, storage, transactional email, AI providers) to provide the Service, imposing data-protection obligations on them equivalent to those in this Agreement. Omnisol is responsible to the Client for its sub-processors’ compliance.
7. Security incidents
If Omnisol detects an incident compromising the confidentiality, integrity, or availability of Client Data, it will notify the Client without undue delay, with available information about the incident, its possible consequences, and the measures taken or proposed, so the Client can meet its own notification obligations to its data subjects and authorities.
8. Assistance to the Controller
Omnisol will provide the Client with reasonable tools or assistance to respond to its own data subjects’ requests (access, correction, deletion, portability), to the extent the Service’s design allows.
9. Return or deletion upon termination
When the relationship between the Client and Omnisol ends:
- The Client may export its Client Data within 60 days of the instance’s shutdown (export button or request to [email protected]).
- After that period, Omnisol permanently deletes Client Data (database, files, and associated backups), keeping only an administrative record without personal data.
- The Client may request early deletion at any time.
10. Audit
The Client may request reasonable information from Omnisol about the security measures applied to demonstrate compliance with this Agreement. Omnisol is not required to allow on-site audits that would compromise the security of other instances or the confidentiality of other clients.
11. Term
This Agreement applies while the Client uses the Service and during the data-retention period described in Section 9.
12. Governing law
This Agreement is governed by Law 1581 of 2012 and its regulations (Colombia), and by the Organic Law on Personal Data Protection (Ecuador) when the Client or its data subjects are located in Ecuador.