1. Controller / processor roles
For Customer Content processed only to provide contracted Services under a customer’s documented instructions, Bayes Pharma generally acts as processor/service provider and the customer generally acts as controller/business or equivalent. For Bayes Pharma’s own account, security, billing, support and business-operation data, Bayes Pharma may act as an independent controller/data fiduciary.
Exact role allocation is defined by the applicable agreement and the law governing the processing.
2. Data Processing Addendum
Enterprise customers may request a DPA appropriate to the scope of processing. The DPA can address subject matter and duration; categories of personal data and data subjects; processing instructions; confidentiality; security measures; subprocessing; rights assistance; breach cooperation; return/deletion; audit/assurance; and international-transfer mechanisms.
3. Documented instructions and confidentiality
Where Bayes Pharma acts as processor, we process Customer Content according to the customer’s documented instructions, the contracted product functions and applicable law. Personnel and contractors with authorized access are subject to appropriate confidentiality obligations and access controls.
If an instruction appears to conflict with applicable data-protection law, we may pause or seek clarification rather than execute it automatically.
4. Service providers and subprocessors
Bayes Pharma may use vetted service providers or subprocessors for functions such as hosting, infrastructure, security, communications, observability and support. The precise subprocessor set can depend on the product, deployment and customer configuration.
For enterprise contracting, Bayes Pharma will make the relevant subprocessor information available through the DPA, security review or customer documentation. We do not publish a static vendor list here because a stale list could be misleading.
5. International transfers
Bayes Pharma serves the United States, Europe and India. Where Customer Content or account data is transferred across borders, we use safeguards required for the relevant transfer and role.
Where needed, mechanisms may include adequacy decisions, EU Standard Contractual Clauses, transfer assessments and supplementary safeguards.
Where needed, we use an approved UK mechanism such as the UK Addendum/IDTA or another lawful basis.
We follow restrictions or conditions under Indian data-protection law as the relevant provisions take effect.
Service-provider/contractor restrictions and customer contractual terms are used where applicable.
6. Security measures
Security controls are selected based on the product, sensitivity and deployment. They may include identity and access management, role-based access, least privilege, tenant isolation, encryption in transit, protected storage, logging, backup/recovery controls, secure development practices, vulnerability remediation and administrative procedures.
Security commitments in a signed customer agreement or security addendum control over this high-level summary. See Security & Data Handling.
7. Security incidents and personal-data breaches
Where Bayes Pharma acts as processor and becomes aware of a qualifying personal-data breach affecting Customer Content, we will notify the customer and provide cooperation according to the DPA and applicable law. The customer remains responsible for controller-side regulatory or individual notifications unless the agreement or law allocates the duty differently.
8. Data-subject / Data Principal assistance
Where a request concerns Customer Content controlled by a customer, Bayes Pharma may direct the requester to that customer and assist the customer as required by the DPA. We do not independently override customer instructions or disclose another customer’s data without authorization or a legal requirement.
9. Return, deletion and retention
At contract end, Customer Content is returned, exported, deleted or retained according to the applicable agreement, product capabilities and lawful retention requirements. Backup copies may persist for a limited period according to backup cycles and security controls before deletion or overwriting.
10. Customer assurance and audits
Bayes Pharma can support proportionate customer security/privacy due diligence using available documentation, questionnaires, architectural evidence and other assurance materials. Formal audit rights, frequency, confidentiality, cost and scope are defined in the applicable DPA or enterprise agreement.
11. Regulated and sensitive data
Contract first. Do not place protected health information, identifiable clinical-trial data, genetic data or other specially regulated data into a Bayes Pharma workspace unless the customer agreement, deployment configuration and legal/privacy assessment expressly authorize that category and use.
Where a US HIPAA-regulated use requires a Business Associate Agreement, or another jurisdiction requires additional contractual terms, those terms must be executed before the relevant regulated processing begins.
12. Contact
For a DPA, transfer assessment, security questionnaire or enterprise privacy review, email info@bayespharma.com.