Who is the Controller and who is the Processor?

For personal data processed through OPTOVERA, the Customer acts as the Controller and SOBEREYE acts as the Processor, or the equivalent roles under applicable law. Where the Customer agreement does not identify the SOBEREYE entity, the Processor is SOBEREYE INC.

As Controller, the Customer determines how OPTOVERA is configured, who has access to the platform, how results are reviewed, how long data is retained, and how OPTOVERA outputs are used within its internal safety workflow. The Customer is also responsible for determining an appropriate lawful basis, providing required notices, completing required consultations, and responding to Data Subjects and supervisory authorities.

As Processor, SOBEREYE processes personal data only on the Customer’s documented instructions and only as needed to provide, operate, support, and secure the OPTOVERA Service. The Customer agreement, the Data Processing Agreement, the Customer’s configuration and use of the Service, and written instructions consistent with them are the documented instructions.

This distinction is important because the Customer remains responsible for operational policies, result review, access configuration, and decisions taken in response to OPTOVERA outputs.