Data Processing Addendum (DPA)

Effective date: April 1, 2026

This page provides an overview of how Qhubio processes data on behalf of its business customers. It is not a substitute for a formal, signed Data Processing Addendum — but it covers the key points so you can evaluate our practices before requesting one.

1. Roles

In the context of the Qhubio platform:

• The customer (your organization) is the data controller for the documents and data you upload to the platform.
• Qhubio acts as the data processor, processing your data solely to provide the services you have requested (e.g., FMEA generation, audit management).

2. Processing Purpose & Instructions

Qhubio processes personal data and business documents only as instructed by the customer through the platform's features. This includes:

• Parsing and extracting text from uploaded source documents.
• Generating FMEA analyses using AI models.
• Storing generated records for retrieval by the customer.
• Managing audit data and evidence on behalf of the customer's organization.

3. Subprocessors

Qhubio engages the following categories of subprocessors to deliver its services:

We will notify customers of any material changes to our subprocessor list.

4. Data Deletion

Upon termination of the service relationship or at the customer's request:

• All customer data (uploaded documents, generated records, audit data) will be deleted from active systems.
• Uploaded source documents are already deleted automatically after processing.
• Data may persist in encrypted backups for up to 30 days after deletion from active systems.

See our Data Retention & Deletion Policy for full details.

5. Security Measures

Qhubio implements appropriate technical and organizational measures to protect customer data:

• Encryption in transit (TLS) and at rest.
• Row-level security policies on all database tables.
• Role-based access control within organizations.
• Automatic purging of temporary files after processing.
• Regular security reviews and dependency audits.

6. International Transfers

Customer data may be processed in Switzerland, the EEA, or the United States depending on the subprocessor involved. Where data is transferred outside Switzerland or the EEA, appropriate safeguards (such as Standard Contractual Clauses) are in place.

7. Requesting a Signed DPA

8. Contact

For any questions about data processing, subprocessors, or to request a DPA, contact: info@qhubio.com.