TOMs annex to the Data Processing Agreement

Document ID: T-03
Version and date: 1.0 - 21 August 2026
Version and cut-off date: 1.0 - 21 August 2026
Authoritative sources: I-04 Actual TOMs and I-09-I-11

Important conclusion: As at the cut-off date, I-09 contains no approval entries. T-03 therefore cannot lawfully or professionally present requirements, code findings or oral confirmations as verified TOMs. The document may be approved as a correct extract of the actual status, but not as a security approval of production.

1. Purpose and delimitation

T-03 contains only measures that meet all of the following criteria:

1. The control is implemented in the relevant production configuration.

2. The acceptance criterion in I-09 is met.

3. The relevant I-11 test protocol has been completed with the expected result.

4. The necessary evidence has been archived with a reference, a date and, where applicable, a hash.

5. A relevant reviewer has approved the result.

6. The next review or other trigger has been determined.

A design requirement, a code feature, a supplier statement, an invoice or a screenshot without a completed control is not sufficient.

2. Status definitions

3. Overall control status

TEST-18 is a cross-cutting document, version and publication control and is not counted as a separate K control.

4. Approved actual measures

There are no entries in this section as at 21 August 2026.

When a control is approved, a new version-bound T-03 extract is created. The previous version is not changed retrospectively.

5. Observed mechanisms that are not approved TOMs

I-04 describes mechanisms that have been observed in code, architecture or the most recent technical baseline. They are relevant to the test plan, but are not included in section 4, because effective configuration, full coverage or negative testing is missing.

6. Restricted controls

Three K-03 controls are recorded as Restricted. A restriction does not mean that the control is approved; it means that the affected feature may be used only within the documented temporary control.

Other open features may also be restricted or disabled under I-03/I-10, even where their K status remains Open. The strictest documented restriction applies.

7. Organisational requirements without approved evidence of effectiveness

FlowDule’s internal policies lay down, among other things:

• named roles and management approval;

• confidentiality and need-based access;

• change management, code review and security testing;

• incident reporting and customer assistance;

• supplier control and documented instructions;

• training in security, privacy and AI;

• risk-based control and documentation.

These requirements are not included as approved TOMs until implementation, participants, date, testing or other appropriate evidence of effectiveness has been recorded. An adopted policy is relevant governance, but is not on its own evidence of actual compliance.

8. Production and risk decision

I-03 permits only continued restricted piloting under specific production restrictions. TEST-03 does not change that decision.

The following continues to apply:

• no new production customers or material expansion of the pilot before the relevant P0 controls have been approved;

• the pilot customer’s I-12 must be completed and accepted;

• minors and guardian/power of attorney models remain outside the approved product scope and must not be used; there is currently no automatic technical age block. Research, anonymous data sets derived from health records and autonomous AI features remain outside scope or disabled as separately described;

• open supplier, sharing, AI, video, push, card and communication flows are used only within documented restrictions;

• a critical fault without sufficient interim control leads to a stop or to further restriction.

It is a management decision to continue the pilot on these conditions. The decision does not make any security control approved.

9. How T-03 is updated

When a control is complete:

1. Carry out the relevant I-11 test protocol with the determined population and negative scenarios.

2. Archive the evidence in the access-restricted evidence archive.

3. Record the test reference, evidence reference/hash, date, reviewer and next review in I-09.

4. Close or update related deviations in I-10.

5. Check that I-04, I-03, I-07, the customer annex and the public texts remain accurate.

6. Generate a new T-03 extract with the approved control in section 4.

7. Version-lock and approve the extract; retain the previous version.

10. Minimum content of an approved TOMs entry

11. Disclosure of raw evidence

T-03 contains status and evidence references, not credentials, raw health record data or unnecessary security details. Raw test extracts, cloud configurations, logs and contracts are disclosed only where they are necessary for the subject matter of the supervision, through a secure channel and following the redaction and recipient control in T-00.

Redaction must not conceal a relevant security problem or make the status misleading.

12. Approval of the extract

The approval confirms that the extract correctly shows zero approved controls as at the cut-off date. It does not confirm that production meets all Article 32 requirements.

13. Legal sources

• Articles 25 and 32 GDPR

• The Danish Data Protection Agency’s (Datatilsynet) catalogue of security measures