Data Processing Addendum

• "Personal data" means information relating to an identified or identifiable individual that we process on Customer's behalf under the agreement.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "PHI" means Protected Health Information as defined at 45 C.F.R. § 160.103.
• "Subprocessor" means a third party engaged by us to process personal data on Customer's behalf.
• "Security incident" means a confirmed unauthorized access to, acquisition of, or disclosure of personal data in our custody.
• "Applicable privacy law" means U.S. federal and state privacy and health-data laws applicable to the processing, including HIPAA, the CCPA as amended by the CPRA, and comparable state statutes.

Customer determines the purposes and means of processing and is the controller or business (and, where applicable, the Covered Entity). We process personal data only on Customer's documented instructions and act as processor, service provider, and — for PHI — Business Associate. We do not determine the purposes of processing, and we do not use personal data for our own independent commercial purposes.

Service-provider certifications

As a service provider under the CCPA, we certify that we will not sell or share personal data; will not retain, use, or disclose it except to perform the services, for internal use to build or improve service quality as permitted, to detect security incidents, to comply with law, or as otherwise permitted by statute; will not combine it with personal data received from other sources except as permitted; and will comply with the same restrictions when engaging any subprocessor.

The subject matter, duration, nature, purpose, data categories, and data subjects are described in Annex A. We will notify Customer if, in our reasonable opinion, an instruction would violate applicable privacy law, and may suspend the affected processing until the instruction is amended or confirmed.

Access to personal data is limited to personnel who need it to deliver the services. Personnel are bound by written confidentiality obligations that survive their engagement, receive privacy and security training at hire and annually, and are subject to disciplinary action for violations.

We implement and maintain the technical and organizational measures set out in Annex B, appropriate to the risk. We may update those measures provided the overall level of protection is not materially reduced.

Customer authorizes our use of the subprocessors listed at myorbithealth.com/subprocessors, which is Annex C to this DPA. We remain responsible for their performance, impose written obligations materially equivalent to ours, and execute a Business Associate Agreement with any subprocessor that may encounter PHI.

We will give at least thirty (30) days' notice before adding or replacing a subprocessor. Customer may object on reasonable, documented data-protection grounds within that period; if we cannot provide a commercially reasonable alternative, Customer may terminate the affected service without penalty for the remainder of the then-current term.

We provide functionality allowing Customer to access, correct, export, and delete personal data. If we receive a request directly from an individual whose data we process for Customer, we will not respond substantively — except to acknowledge receipt and redirect — and will forward it to Customer without undue delay. We provide reasonable assistance with data-protection assessments and regulator inquiries relating to the processing.

We will notify Customer's designated contact without undue delay, and in any event within seventy-two (72) hours, after confirming a security incident affecting Customer's personal data, providing the nature of the incident, categories and approximate volume of data involved, likely consequences, and remedial steps taken or planned, as that information becomes available. For PHI, breach reporting follows the Business Associate Agreement and 45 C.F.R. § 164.410. Customer is responsible for any notification to individuals and regulators, and we will provide reasonable assistance. Our notification is not an acknowledgment of fault.

On written request, no more than once in any twelve-month period unless required by a regulator or following a confirmed security incident, we will provide our current third-party audit report, penetration-test executive summary, and completed security questionnaire under NDA. Where that evidence is genuinely insufficient to demonstrate compliance, Customer may conduct an on-site or remote audit on at least thirty (30) days' notice, during business hours, subject to confidentiality, without accessing other customers' data, and at Customer's expense.

Processing occurs in the United States. PHI is not stored or processed outside the United States. We do not offer these services in the European Economic Area, the United Kingdom, or Switzerland, and no standard contractual clauses are incorporated. If Customer requires processing in another region, that must be agreed in writing before any transfer.

On termination or expiry, we will, at Customer's election made within thirty (30) days, make personal data available for export or delete it. Absent an election, we delete personal data from active systems within ninety (90) days, with encrypted backups aging out on their standard cycle. We may retain personal data where required by law, including HIPAA audit-log and medical-record retention obligations, and will continue to protect it under this DPA for as long as we hold it. Deletion certification is available on request.

Each party's liability under this DPA is subject to the limitations of liability in the underlying agreement, except where applicable law prohibits such limitation. This DPA takes effect when the underlying agreement takes effect and continues for as long as we process personal data on Customer's behalf.

Further detail is published on our security page.

The current list of approved subprocessors, including each one's function, data categories, region, and Business Associate Agreement status, is published and maintained at myorbithealth.com/subprocessors and is incorporated into this DPA by reference. To receive email notice of changes, contact privacy@myorbithealth.com.

To request a countersigned DPA or Business Associate Agreement, or to register a data-protection contact for notices, email legal@myorbithealth.com.