Data Processing & Business Associate Terms

1. Application

This DPA applies automatically whenever we process Client Personal Data in providing the Services. Capitalized terms not defined here have the meanings given in the Terms of Service or in applicable data protection law, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss FADP, India's Digital Personal Data Protection Act 2023 (“DPDP Act”), the California Consumer Privacy Act as amended (“CCPA”) and other U.S. state privacy laws, and HIPAA (together, “Data Protection Laws”). The subject matter, duration, nature and purpose of processing, types of Personal Data and categories of data subjects are those described in the applicable Order.

2. Roles of the parties

The Client is the controller (or data fiduciary, business or covered entity, as applicable) and we are the processor (or data processor, service provider or business associate). Where the Client is itself a processor or business associate, we act as its sub-processor or subcontractor business associate. The Client is responsible for the lawfulness of the Personal Data it provides, including providing required notices and obtaining required consents.

3. Processing on instructions

We will process Client Personal Data only on the Client's documented instructions, which consist of the Terms, the Order and the Client's use and configuration of the Services, unless required to do otherwise by applicable law, in which case we will inform the Client before processing where legally permitted. We will promptly inform the Client if, in our opinion, an instruction infringes Data Protection Laws. We will not use Client Personal Data for our own purposes, for advertising, or to train general-purpose AI models.

4. Confidentiality of personnel

We ensure that everyone authorized to process Client Personal Data is bound by written confidentiality obligations, receives privacy and security training at onboarding and at least annually, and accesses data only to the extent necessary for their role. Access is revoked promptly when no longer required.

5. Security measures

We implement and maintain appropriate technical and organizational measures to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, costs, and the nature, scope, context, purposes and risks of the processing. These measures are summarized on our Security & Compliance page and include:

• unique user accounts, role-based least-privilege access, multi-factor authentication and periodic access reviews;
• encryption in transit using TLS 1.2 or higher and encryption at rest using AES-256 or equivalent;
• managed, encrypted and patched endpoints, with removable media and local storage of client data restricted;
• segregated client environments, network firewalls, and hardened, regularly patched servers;
• centralized logging and monitoring of access to systems containing client data;
• backups, tested restoration and documented business continuity arrangements;
• secure development lifecycle, code review, dependency scanning and separation of production data from test environments;
• vendor risk assessment for sub-processors; and
• a documented incident response plan.

We may update these measures provided the overall level of protection is not reduced.

6. Sub-processors

The Client gives general authorization for us to engage sub-processors. We will impose on each sub-processor data protection obligations no less protective than this DPA, and remain liable for their performance. We will maintain a list of sub-processors used for the Client's Services, provide it on request, and give at least fifteen (15) days' notice before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds within that period; the parties will then work in good faith to find a resolution, failing which the Client may terminate the affected Services and receive a refund of any prepaid fees for the unused period. Where an Order requires prior specific approval, we will seek that approval instead.

7. International transfers

We may process Client Personal Data in India and in the countries where our approved sub-processors operate, subject to any data residency requirement in the Order. Where Client Personal Data subject to the GDPR, UK GDPR or Swiss FADP is transferred to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by European Commission Decision 2021/914 (Module Two controller-to-processor, or Module Three processor-to-processor, as applicable), the UK International Data Transfer Addendum and any Swiss amendments are incorporated by reference, with the Client as data exporter and ConsultifyIT as data importer, the optional clauses omitted, the governing law and forum of Ireland for the EU clauses and of England and Wales for the UK Addendum, and the annexes completed with the information in the Order and this DPA. We will carry out and document transfer impact assessments and apply supplementary measures, including encryption and access controls, where needed.

8. Data subject requests and assistance

Taking into account the nature of the processing, we will assist the Client by appropriate technical and organizational measures to respond to requests from individuals exercising their rights. If we receive such a request directly, we will promptly forward it to the Client and not respond except on the Client's instructions or as required by law. We will provide reasonable assistance with data protection impact assessments, prior consultations with regulators and the Client's security obligations.

9. Personal data breaches

We will notify the Client without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Client Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of individuals and records concerned, likely consequences, and measures taken or proposed. We will provide updates as information becomes available, take reasonable steps to contain and remediate the breach, and cooperate with the Client's notification obligations. Notification is not an admission of fault.

10. Audits and information

We will make available information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires, policy summaries and any third-party assessment reports we hold. Where that information is not sufficient to meet a legal requirement, the Client may conduct an audit, no more than once per year (unless following a breach or regulator request), on at least thirty (30) days' notice, during business hours, at its own cost, subject to confidentiality, and without access to other clients' data.

11. Return and deletion

On termination of the Services, and at the Client's choice, we will return Client Personal Data in a commonly used format and/or securely delete it, including copies, within sixty (60) days, except where retention is required by law. Data in backups will be deleted on the normal backup rotation and remains protected under this DPA until then. On request we will certify deletion in writing.

12. U.S. state law terms

Where the CCPA or another U.S. state privacy law applies, we act as a service provider or processor and will not: sell or share Client Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Order, including any commercial purpose other than providing the Services; retain, use or disclose it outside the direct business relationship with the Client; or combine it with personal information from other sources except as permitted by law. We will comply with applicable obligations, provide the same level of privacy protection required of the Client, and notify the Client if we can no longer meet them. The Client may take reasonable steps to stop and remediate unauthorized use.

13. HIPAA Business Associate terms

This section applies when the Client is a covered entity or business associate under HIPAA and we create, receive, maintain or transmit PHI on its behalf. It constitutes a business associate agreement under 45 C.F.R. §§ 164.308, 164.314, 164.502(e) and 164.504(e) unless the parties sign a separate BAA, which then takes precedence. In this section, we are the “Business Associate”.

13.1 Permitted uses and disclosures

Business Associate may use and disclose PHI only to perform the Services in the Order, as required by law, and for its proper management and administration or to carry out its legal responsibilities, provided that any disclosure for those purposes is required by law or made under reasonable written assurances of confidentiality and breach reporting. Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by the covered entity, will limit uses, disclosures and requests to the minimum necessary, and will not sell PHI or use it for marketing. De-identification of PHI requires the Client's written authorization.

13.2 Safeguards

Business Associate will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) with respect to electronic PHI, to prevent use or disclosure of PHI other than as permitted. This includes a designated security official, periodic risk analysis, workforce training and sanctions, access controls, audit controls, integrity controls, transmission security and contingency planning.

13.3 Reporting

Business Associate will report to the Client any use or disclosure of PHI not permitted by this section, any Security Incident, and any Breach of Unsecured PHI as defined at 45 C.F.R. § 164.402, without unreasonable delay and in no case later than five (5) business days after discovery for Breaches (or such shorter period as a signed BAA requires). Reports of Breaches will include, to the extent available, the identity of each affected individual and the information required by 45 C.F.R. § 164.410. The parties agree that this section serves as notice of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans and blocked log-in attempts, for which no further notice is required.

13.4 Subcontractors

Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2).

13.5 Individual rights

To the extent Business Associate maintains PHI in a designated record set, it will, within fifteen (15) days of the Client's request, make PHI available for access under 45 C.F.R. § 164.524, make amendments under § 164.526, and provide information required for an accounting of disclosures under § 164.528. Business Associate will forward to the Client any such request it receives directly from an individual.

13.6 Compliance on behalf of the Client

To the extent Business Associate carries out an obligation of the covered entity under Subpart E of 45 C.F.R. Part 164, it will comply with the requirements of Subpart E that apply to the covered entity in performing that obligation.

13.7 Books and records

Business Associate will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.

13.8 Client obligations

The Client will notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an individual's permission, and any restriction on use or disclosure it has agreed to, to the extent it affects Business Associate. The Client will not ask Business Associate to use or disclose PHI in any manner not permitted under HIPAA if done by the covered entity.

13.9 Term and termination

These terms remain in effect while Business Associate holds PHI. If either party determines that the other has materially breached this section, it may terminate the affected Services if the breach is not cured within thirty (30) days of written notice. On termination, Business Associate will return or destroy all PHI and retain no copies; if return or destruction is infeasible, it will extend these protections to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it holds the PHI.

13.10 Interpretation

Any ambiguity will be resolved to permit compliance with HIPAA. References to HIPAA provisions mean those provisions as amended and in effect. Nothing in this section confers rights on any third party.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Laws or the Standard Contractual Clauses do not permit limitation, or where an Order sets a specific cap for data protection or PHI incidents. In the event of conflict, the Standard Contractual Clauses prevail over this DPA, a signed BAA prevails as to PHI, and this DPA prevails over the Terms of Service and the Order as to the processing of Personal Data.