Last updated: August 2026
Important role distinction
PeakData may act in different data protection roles when providing its services. PeakData acts as a Processor where it processes HCP Personal Data supplied by or on behalf of a Customer solely to provide the contracted services on that Customer’s instructions. PeakData acts as an independent Controller where it supplies or otherwise processes HCP Personal Data obtained, licensed, developed or collected independently through PeakData’s proprietary methods and determines the purposes and means of that processing.
This Data Processing Agreement (the “DPA”) applies where a customer agreement, order form, statement of work or other contract for PeakData services does not contain separate data processing terms. It forms part of the agreement governing the Customer’s use of the Services and applies from the date on which PeakData begins Processing Customer Personal Data on the Customer’s behalf.
This DPA is intended to satisfy the requirements applicable to processor arrangements under Applicable Data Protection Laws. It also sets out the Parties’ responsibilities where each Party acts as an independent Controller. Where the Parties have entered into a separately signed data processing agreement, that separate agreement shall prevail to the extent of any conflict.
1. Definitions
“Applicable Data Protection Laws” means all laws and regulations relating to privacy, data protection and the Processing of Personal Data that apply to the Services or a Party, including, where applicable, Regulation (EU) 2016/679 (EU GDPR), the Swiss New Federal Act on Data Protection (nFADP) and associated implementing laws, in each case as amended, replaced or re-enacted from time to time.
“Customer” means the person or legal entity that purchases, subscribes to or otherwise receives the Services from PeakData.
“Customer Personal Data” means Personal Data Processed by PeakData on behalf of the Customer under the Main Agreement. It does not include PeakData Data.
“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.
“EU SCCs” means the standard contractual clauses adopted by the European Commission under Commission Implementing Decision (EU) 2021/914, as amended or replaced from time to time.
“Main Agreement” means the customer agreement, order form, statement of work, subscription terms or other agreement governing the provision of the Services, including this DPA where applicable.
“PeakData” means PeakData AG, Baarerstrasse 43, 6300 Zug, Switzerland.
“PeakData Data” means Personal Data obtained, licensed, developed, inferred, generated or otherwise collected independently by PeakData, including through PeakData’s proprietary methods, for purposes determined by PeakData. PeakData Data does not become Customer Personal Data merely because it is made available to or used for the benefit of a Customer.
“Personal Data” means any information relating to an identified or identifiable natural person and includes any equivalent term under Applicable Data Protection Laws.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Personal Data transmitted, stored or otherwise Processed.
“Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means. “Process”, “Processes” and “Processed” shall be interpreted accordingly.
“Restricted Transfer” means a transfer of Personal Data that requires an adequacy mechanism, standard contractual clauses or another safeguard under Applicable Data Protection Laws.
“Services” means the services provided by PeakData under the Main Agreement, including HCP data matching, enrichment, identification, research, analytics and insights, to the extent specified in the Main Agreement.
“Sub-Processor” means a third party engaged by PeakData to Process Personal Data on behalf of PeakData, and in connection with the Services.
“Supervisory Authority” means a competent public authority responsible for supervising compliance with Applicable Data Protection Laws.
“Third-Party Data” means Personal Data that is provided to PeakData by or on behalf of the Customer from a third-party source, including a third-party data provider, business partner or service provider, where such Personal Data is supplied for Processing by PeakData solely in connection with the Services and in accordance with the Customer’s documented instructions.
2. Scope and roles of the Parties
2.1 This DPA applies to Processing of Personal Data by PeakData on behalf of the Customer in connection with the Services.
2.2 Where the Customer, or a third party acting on the Customer’s behalf, supplies HCP Personal Data to PeakData and PeakData Processes that data solely on the Customer’s documented instructions for the purpose of providing the Services, the Customer acts as Controller and PeakData acts as Processor.
2.3 Where PeakData supplies, licenses, makes available or otherwise Processes PeakData Data, PeakData acts as an independent Controller. Where the Customer receives PeakData Data and determines its own purposes and means for its subsequent use, the Customer acts as a separate and independent Controller of that Personal Data.
2.4 The Parties do not intend to act as joint Controllers unless they expressly agree otherwise in writing after assessing their respective roles and responsibilities.
2.5 The details of the Processing carried out by PeakData as Processor are set out in Annex 1. The independent Controller provisions are set out in Clause 14.
3. Documented instructions
3.1 PeakData shall Process Customer Personal Data and Third-Party Data only on documented instructions from the Customer, unless Processing is required by applicable law. The Main Agreement, this DPA and the Customer’s authorised use of the Services constitute documented instructions.
3.2 If applicable law requires PeakData to Process Customer Personal Data or Third-Party Data other than on the Customer’s instructions, PeakData shall inform the Customer of that legal requirement before Processing, unless the law prohibits such notification.
3.3 The Customer represents and warrants that:
(a) its instructions comply with Applicable Data Protection Laws;
(b) it has a valid lawful basis for the Processing and disclosure of Customer Personal Data to PeakData;
(c) it has provided all required privacy information and obtained any consent required by law; and
(d) it will not instruct PeakData to Process Personal Data in a manner that would violate Applicable Data Protection Laws.
3.4 PeakData shall inform the Customer without undue delay if, in PeakData’s reasonable opinion, an instruction infringes Applicable Data Protection Laws. PeakData may suspend or refuse the affected instruction until the Parties agree a lawful alternative. Such suspension or refusal shall not, by itself, constitute a breach of the Main Agreement or this DPA.
4. Confidentiality and personnel
4.1 PeakData shall ensure that persons authorised to Process Customer Personal Data and Third-Party Data are subject to appropriate confidentiality obligations, whether contractual or statutory.
4.2 PeakData shall restrict access to Customer Personal Data and Third-Party Data to personnel who require access for the performance of the Services and shall provide appropriate privacy and information security training relevant to their responsibilities.
5. Security of Processing
5.1 PeakData shall implement and maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of the Processing, as well as the risks to Data Subjects.
5.2 The categories of measures maintained by PeakData are described in Annex 2. PeakData may update those measures from time to time, provided that any update does not materially reduce the overall level of protection for Customer Personal Data during the term of the Services.
5.3 The Customer is responsible for configuring and using the Services securely, limiting the Personal Data it provides to what is necessary, managing its authorised users and protecting its credentials and systems.
6. Sub-Processors
6.1 The Customer grants PeakData general written authorisation to appoint Sub-Processors in connection with the Services. PeakData’s current Sub-Processors shall be listed in Annex 3.
6.2 PeakData shall ensure Sub-Processors have data protection and security controls in place that are no less protective, in all material respects relevant to the Sub-Processor’s Processing, than the obligations imposed on PeakData under this DPA.
6.3 Before appointing a new or replacement Sub-Processor, PeakData shall provide reasonable prior notice identifying the Sub-Processor, the relevant service and the Processing location. The Customer may object within fourteen (14) calendar days on reasonable and substantiated data protection grounds.
6.4 If the Customer raises a valid objection, the Parties shall work in good faith to resolve it, including by considering reasonable additional safeguards or an alternative method of providing the affected part of the Services.
7. International transfers
7.1 PeakData shall ensure that any Restricted Transfer of Customer Personal Data is carried out in accordance with Applicable Data Protection Laws and is supported by an appropriate transfer mechanism, including, where applicable:
(a) an adequacy decision recognised under the New Swiss Federal Act on Data Protection (“nFADP”) or the EU GDPR;
(b) the European Commission Standard Contractual Clauses (EU SCCs), as recognised or adapted under applicable Swiss law where required;
(c) the UK International Data Transfer Agreement (“UK IDTA”) or the UK Addendum to the EU SCCs where UK GDPR applies;
(d) approved Binding Corporate Rules; or
(e) any other lawful transfer mechanism recognised under the applicable Data Protection Laws.
7.2 Where required, PeakData shall conduct or support an assessment of the transfer and implement reasonable supplementary measures appropriate to the identified risk.
7.3 Where Applicable Data Protection Laws require the Parties to implement a specific international data transfer mechanism in connection with a Restricted Transfer, the applicable transfer mechanism set out in Annex 4 shall apply automatically to the extent legally required.
7.4 Processing locations and applicable transfer mechanisms shall be identified in Annex 1 and Annex 3.
8. Data Subject rights
8.1 Taking into account the nature of the Processing, PeakData shall provide reasonable assistance, through appropriate technical and organisational measures where possible, to enable the Customer to respond to requests by Data Subjects exercising rights under Applicable Data Protection Laws.
8.2 If PeakData receives a request directly from a Data Subject relating to Customer Personal Data or Third-Party Data, PeakData shall notify the Customer without undue delay and shall not respond except on the Customer’s documented instructions or where required by law.
8.3 This clause does not prevent PeakData from responding independently to a request concerning PeakData Data for which PeakData acts as Controller.
9. Personal Data Breaches
9.1 PeakData shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and, where practicable, within twenty-four (24) hours of awareness.
9.2 The notification shall include, to the extent available:
(a) the nature of the breach;
(b) the categories and approximate number of affected Data Subjects and records;
(c) the likely consequences;
(d) the measures taken or proposed to contain, investigate and remediate the breach; and
(e) a contact from whom further information may be obtained.
9.3 Where all information is not immediately available, PeakData may provide it in phases without undue further delay.
9.4 PeakData shall reasonably cooperate with the Customer’s investigation, mitigation and legally required notifications. Notification under this clause shall not constitute an admission of fault or liability.
10. Assistance and regulatory cooperation
10.1 Taking into account the nature of the Processing and information available to PeakData, PeakData shall provide reasonable assistance with:
(a) the Customer’s security obligations;
(b) data protection impact assessments;
(c) prior consultation with Supervisory Authorities; and
(d) regulatory enquiries directly relating to PeakData’s Processing of Customer Personal Data.
10.2 PeakData may charge reasonable fees for assistance that is materially beyond the standard functionality and information ordinarily provided with the Services, unless the assistance is required because of PeakData’s breach of this DPA.
11. Return, deletion and retention
11.1 PeakData shall retain Customer Personal Data and Third-Party Data only for as long as necessary to provide the Services, comply with the Customer’s documented instructions or meet applicable legal obligations.
11.2 On termination or expiry of the relevant Services, PeakData shall, at the Customer’s choice and subject to the Main Agreement, return or securely delete Customer Personal Data or Third-Party Data and existing copies, unless applicable law requires continued retention.
11.3 Where retention is legally required, PeakData shall continue to protect the retained Customer Personal Data and Third-Party Data, and shall not Process it for any other purpose except as required by law.
11.4 This clause does not require PeakData to delete PeakData Data or information that has been irreversibly anonymised so that it is no longer Personal Data.
11.5 Specific retention periods or criteria shall be stated in Annex 1 of this DPA or the Main Agreement where in place.
12. Information and audit rights
12.1 PeakData shall make available information reasonably necessary to demonstrate compliance with its obligations as Processor under this DPA and Applicable Data Protection Laws.
12.2 The Customer shall first rely on available policies, summaries, questionnaires, independent reports or certifications supplied by PeakData. If those materials are insufficient, the Customer may request an audit by itself or an independent auditor, subject to the following safeguards:
(a) at least thirty (30) days’ prior written notice, unless a Supervisory Authority requires a shorter period or the audit follows a confirmed Personal Data Breach;
(b) no more than once in any twelve-month period, unless required by a Supervisory Authority or following a confirmed Personal Data Breach;
(c) the audit must occur during normal business hours and minimise disruption;
(d) the auditor must be independent, suitably qualified and bound by confidentiality;
(e) the audit must not compromise the security, confidentiality or rights of other customers or third parties; and
(f) the Customer shall bear its own and PeakData’s reasonable audit costs unless the audit identifies a material breach of this DPA by PeakData.
12.3 PeakData may object to an auditor that is a competitor of PeakData or otherwise presents a reasonable confidentiality, security or conflict-of-interest concern.
13. Customer responsibilities
13.1 The Customer shall comply with Applicable Data Protection Laws in relation to Customer Personal Data, Third-Party Data and its use of PeakData Data.
13.2 The Customer shall ensure that Customer Personal Data is accurate, relevant and limited to what is necessary for the Services and that it does not provide patient-level data, protected health information or special category/sensitive Personal Data unless expressly agreed in writing following an appropriate legal and risk assessment.
13.3 The Customer shall respond to reasonable requests from PeakData for information needed to verify the lawfulness of the Customer’s instructions or to complete the Processing details in Annex 1.
13.4 The Customer shall not use PeakData Data or the Services in a manner that is unlawful, discriminatory, misleading or incompatible with the purposes and restrictions in the Main Agreement.
14. Independent Controller provisions
14.1 This clause applies where PeakData and the Customer each act as independent Controllers, including where PeakData supplies PeakData Data to the Customer.
14.2 Each Party shall independently:
(a) identify and document an appropriate lawful basis for its Processing;
(b) provide required privacy information;
(c) respond to Data Subject requests concerning its own Processing;
(d) implement appropriate security measures;
(e) maintain appropriate retention controls; and
(f) make any legally required regulatory notifications.
14.3 Where one Party receives a Data Subject request or regulatory enquiry that primarily concerns the other Party’s Processing, it shall notify the other Party without undue delay and provide reasonable cooperation, subject to legal restrictions and confidentiality obligations.
14.4 If a Personal Data Breach affecting Personal Data shared between the Parties is reasonably likely to affect the other Party’s legal obligations or the rights of Data Subjects, the affected Party shall notify the other Party without undue delay and provide information reasonably necessary for the other Party to meet its own obligations.
14.5 Neither Party may represent that it acts on behalf of the other Party as Controller, or bind the other Party in relation to Data Subjects or Supervisory Authorities, unless expressly authorised in writing.
15. Term, hierarchy and changes
15.1 This DPA applies for as long as PeakData Processes Customer Personal Data on behalf of the Customer and for any additional period during which PeakData retains that data in accordance with this DPA.
15.2 If there is a conflict between documents, the following order of precedence applies in relation to data protection matters:
(a) mandatory transfer clauses;
(b) a separately signed DPA;
(c) this DPA; and
(d) the Main Agreement, unless the Main Agreement expressly states that a particular provision overrides this DPA.
15.3 PeakData may update this website-facing DPA where reasonably necessary to reflect changes in law, regulatory guidance, the Services or PeakData’s Processing practices. PeakData shall not make an update that materially reduces the protection of Customer Personal Data during an active term without reasonable notice, unless the change is required by law.
16. Governing law and jurisdiction
16.1 Where this DPA forms part of, or is incorporated into, a Main Agreement, this DPA shall be governed by the governing law specified in the Main Agreement and any disputes arising under or in connection with this DPA shall be subject to the jurisdiction specified in the Main Agreement.
16.2 Where no Main Agreement exists between the Parties, this DPA shall be governed by the laws of Switzerland and the courts of Zug, Switzerland shall have exclusive jurisdiction to determine any dispute arising out of or in connection with this DPA, except where Applicable Data Protection Laws require otherwise.
Annex 1 – Details of Processing
This Annex describes the Processing carried out by PeakData as Processor.
| Detail | Information |
|---|---|
| Subject matter | Provision of the Services involving Processing of Customer-supplied or third-party-supplied HCP Personal Data on the Customer’s behalf. |
| Duration | For the duration of the relevant Services and any agreed or legally required retention period. |
| Nature of Processing | Receipt, collection, recording, organisation, structuring, storage, matching, comparison, analysis, enrichment, retrieval, consultation, transmission, restriction, deletion and other Processing necessary to provide the Services. |
| Purpose of Processing | To provide the HCP matching, enrichment, identification, market research, analytics and insight services requested by the Customer, as described in the Main Agreement (where applicable), a Statement of Work, Order Form, subscription, service description or other documented instructions agreed between the Parties. |
| Categories of Data Subjects | • Healthcare Professionals (HCPs) • Healthcare ecosystem stakeholders relevant to the Services, including, where applicable, healthcare policymakers, government and public health officials, regulators, payers, health technology assessment (HTA) stakeholders, patient organisation representatives and other healthcare decision-makers or influencers. • Authorised Customer users, where account, authentication or usage data is Processed on the Customer’s behalf. |
| Types of Customer Personal Data | • HCP names • usernames or professional identifiers • public professional handles • professional biography, role, title, employer, industry and professional achievements • country of residence • Customer-supplied HCP list data • Customer employee email and names • and other professional information expressly agreed in the Main Agreement. |
| Special category or sensitive data | None intended. The Customer must not provide patient-level data, protected health information or special category/sensitive Personal Data. |
| Frequency | Continuous or periodic during the provision of the Services, depending on Customer instructions and use of the Services. |
| Retention period or criteria | For Customer Personal Data and Third-Party Data: For the duration of the service. PeakData Data: PeakData Data is retained for as long as necessary to maintain and provide PeakData’s proprietary healthcare intelligence and analytics services. PeakData periodically reviews the relevance and accuracy of PeakData Data and updates, corrects, anonymises or deletes records where they are no longer accurate, relevant, necessary for the purposes for which they are processed, or where retention is otherwise no longer justified under Applicable Data Protection Laws. |
| Primary Processing location(s) | European Union, United States |
| Restricted transfer mechanism(s) | Where Personal Data is transferred to the United States, PeakData shall ensure that the transfer is supported by an appropriate transfer mechanism recognised under Applicable Data Protection Laws, including, where applicable: • the Swiss-U.S. Data Privacy Framework; • the EU-U.S. Data Privacy Framework; • the European Commission Standard Contractual Clauses (with any required Swiss adaptations); • or another lawful transfer mechanism recognised under Applicable Data Protection Laws. |
Annex 2 – Technical and Organisational Measures
PeakData maintains measures appropriate to the risks associated with the Processing. The following describes the categories of controls to be applied. It does not disclose security-sensitive implementation details.
Access Controls
- Role-Based Access Controls (RBAC): Access to systems and data is restricted using RBAC, with permissions granted strictly on a need-to-know basis aligned to each user’s job responsibilities.
- User Access Reviews: Access register maintained and reviewed periodically.
- Multi-Factor Authentication (MFA): MFA is enabled on all tenant accounts (PeakData accounts).
- Principle of Least Privilege: Enforced through the Logical Access Control Policy.
- Onboarding and Offboarding Process: Onboarding and offboarding processes are defined and audited periodically.
Data Security
- Encryption: Data at rest is encrypted using recognised industry standards to prevent unauthorised access (AES-256). Data transmitted over networks is secured using up-to-date transport layer encryption protocols (TLS 1.3).
- Data Minimisation: Only data necessary for defined purposes is collected and processed, in accordance with the principle of data minimisation and enforced by our Internal Data Protection Policy.
- Data Classification: All sensitive or confidential data is identified and classified, in accordance with our Information Security Policy.
Policy & Governance
- Information Security Policy Suite: An Information Security Policy Suite is maintained and reviewed periodically to define roles, responsibilities and controls for information protection.
- Acceptable Use Policy: This policy outlines appropriate and prohibited use of information systems by staff and contractors.
- Data Privacy and Security Awareness Training: Staff receive regular privacy and security awareness training to promote safe data handling practices, awareness of individual obligations and reporting requirements.
- Incident Response Plan: Established to detect, report and respond to security incidents in a timely and coordinated manner.
- Data Protection Impact Assessments (DPIAs): Conducted for high-risk processing activities to evaluate and mitigate potential data protection risks.
Technical Safeguards
- Endpoint Protection: All endpoints are protected with anti-malware and endpoint detection and response (EDR) solutions to detect and prevent unauthorised activity.
- Firewalls and IDS/IPS: Firewalls and intrusion detection/prevention systems (IDS/IPS) are implemented to safeguard network perimeters and monitor malicious activity.
- Vulnerability Scanning and Patch Management: Patch management processes in place and applied regularly.
- Software Development Protocols: Followed in line with best practice, governed by our internal Software and Development Lifecycle Policy.
- Audit Logging and Monitoring: All platform and user activities are logged centrally for review and incident detection.
Vendor & Supply Chain Security
- Due Diligence and Risk Assessment: All vendors are reviewed for data protection compliance and information security procedures prior to onboarding. In some cases, depending on potential impact, some vendors are required to complete a due diligence questionnaire.
- Data Processing Agreement (DPA): DPAs are in place with all processors.
- Contractual Protections: Contracts with vendors and third parties include clauses covering confidentiality, security and breach terms.
Physical & Environmental Controls
- Physical Access: Office access is restricted to authorised personnel.
- Physical Disposal: Secure disposal of physical media and documents are managed in line with our Third-Party Data Destruction Policy.
Business Continuity & Incident Management
- Backup and Recovery Processes: Managed by our Back Up Policy and Disaster Recovery Plan, which is periodically tested.
- Security Incidents: Logged and reported in line with our incident register which also details the risk/impact rating and mitigation plans.
- Breach Notification: Our breach notification process is documented within our internal Data Protection Policy and Logical Access Control Policy, aligned with GDPR.
Annex 3 – Authorised Sub-Processors
The Customer provides PeakData with general written authorisation to engage Sub-Processors in accordance with Clause 6 of this DPA.
The Sub-Processors authorised as at the commencement of the Services are identified in the Sub-Processor Register provided to the Customer in connection with the applicable Statement of Work, Order Form or other agreement governing the Services.
PeakData maintains a current Sub-Processor Register identifying the Sub-Processors engaged to process Customer Personal Data, including their identity, processing activities, processing locations and applicable international data transfer arrangements.
PeakData will notify the Customer of any intended addition or replacement of a Sub-Processor in accordance with Clause 6 of this DPA.
Annex 4 – International Data Transfers
This Annex applies only where Customer Personal Data is transferred between jurisdictions and Applicable Data Protection Laws require a specific safeguard or transfer mechanism.
1. General
PeakData shall ensure that any international transfer of Customer Personal Data or Third-Party Data is carried out in accordance with Applicable Data Protection Laws and is supported by an appropriate safeguard recognised under the applicable law.
Where required, PeakData shall implement the contractual, organisational or technical measures necessary to ensure that the transfer provides an appropriate level of protection for the Personal Data being transferred.
2. Transfers from the Customer to PeakData
Where Applicable Data Protection Laws require the transfer of Customer Personal Data or Third-Party Data from the Customer to PeakData to be supported by a specific international transfer mechanism, the Parties shall cooperate in good faith to implement the transfer mechanism required under the applicable law before the relevant transfer takes place.
3. Onward Transfers by PeakData
Where PeakData transfers Customer Personal Data to a Sub-Processor or other recipient located in a jurisdiction that does not benefit from an adequacy decision or other recognised transfer mechanism under Applicable Data Protection Laws, PeakData shall ensure that the onward transfer is supported by an appropriate safeguard recognised under the applicable law.
Such safeguards may include, where applicable:
- an adequacy decision or equivalent recognition;
- a recognised data privacy or transfer framework;
- standard contractual clauses or equivalent contractual safeguards;
- approved binding corporate rules; or
- any other transfer mechanism recognised under Applicable Data Protection Laws.
4. Sub-Processors
PeakData shall ensure that any Sub-Processor engaged in connection with the Services is contractually required to protect Customer Personal Data and Third-Party Data in accordance with Applicable Data Protection Laws and to implement any transfer safeguards required for the jurisdictions in which the Customer Personal Data is Processed.
5. Co-operation
Where Applicable Data Protection Laws require additional documentation, contractual provisions or other measures to facilitate an international transfer of Customer Personal Data, the Parties shall cooperate in good faith to implement such measures to the extent reasonably necessary.
6. Order of Precedence
To the extent of any inconsistency relating solely to an international transfer of Customer Personal Data, any mandatory transfer mechanism or safeguard required under Applicable Data Protection Laws shall prevail over this DPA to the extent necessary to give effect to the applicable law.