Data Processing Addendum

Contract draft for review. This addendum contains highlighted business and security details that Auxo must verify before use. It is not legal advice and should be approved by qualified counsel.

This Data Processing Addendum, including its annexes (the "DPA"), forms part of the Master Services Agreement or other written agreement between Auxo Health, Co. ("Auxo") and the customer identified in an Order Form ("Customer"). It applies when Auxo Processes Customer Personal Data in providing the Services.

1. Scope and roles

1.1 Definitions

Applicable Data Protection Law means the privacy, data protection, and data security laws applicable to the Processing under the Agreement. Controller, Data Subject, Personal Data, Process, Processor, and Supervisory Authority have the meanings given by Applicable Data Protection Law. Customer Personal Data means Personal Data Processed by Auxo on Customer's behalf. Security Incident means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. Subprocessor means a third party engaged by Auxo to Process Customer Personal Data.

1.2 Roles

Customer is the Controller or Business that determines the purposes and means of Processing. Auxo is the Processor or Service Provider that Processes Customer Personal Data on Customer's documented instructions. Each Party will comply with the obligations that apply to its role.

1.3 HIPAA information

If Customer provides Protected Health Information regulated by HIPAA, the Parties must execute Auxo's Business Associate Agreement. The BAA controls to the extent of a conflict concerning Protected Health Information.

2. Processing instructions and limits

Auxo will Process Customer Personal Data only to provide, secure, support, and improve the contracted Services; comply with Customer's documented instructions; or comply with law. The Agreement, Order Forms, configuration choices, support requests, and authorized user actions are Customer's documented instructions.

Auxo will notify Customer if it reasonably believes an instruction violates Applicable Data Protection Law, unless legally prohibited. Auxo may suspend the affected Processing until the Parties resolve the issue.

Auxo will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it outside the direct business relationship, or use it to train a general-purpose artificial intelligence model, except with Customer's express written authorization or as permitted for properly deidentified or aggregated data under the Agreement and applicable law.

Customer is responsible for the lawfulness of its instructions, notices, permissions, and the Customer Personal Data it makes available. Customer will limit Customer Personal Data to what is reasonably necessary for the Services.

3. Confidentiality and personnel

Auxo will ensure that personnel authorized to Process Customer Personal Data are bound by confidentiality obligations, receive appropriate privacy and security training, and access data only as needed for their duties. Auxo remains responsible for its personnel's compliance with this DPA.

4. Security

Auxo will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful Processing and accidental loss, destruction, alteration, or damage. The current measures are described in Annex II. Auxo may update those measures if the overall level of protection does not materially decrease.

Customer is responsible for configuring the Services appropriately, managing authorized users, protecting credentials, and using available security controls.

5. Security Incidents

Auxo will notify Customer without undue delay after confirming a Security Incident and will provide information reasonably available to Auxo about the nature of the incident, affected data and individuals, likely consequences, and measures taken or proposed. Notification is not an admission of fault or liability.

Auxo will take reasonable steps to contain, investigate, mitigate, and remediate a Security Incident and will reasonably cooperate with Customer's legal notification obligations. Customer is responsible for notifying regulators and Data Subjects unless law requires Auxo to do so.

Confirm before signature: Add a firm initial notification deadline if Auxo's incident response plan can support it. A common negotiated term is 24 to 72 hours after awareness or confirmation.

Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked scans, failed logins, or denial-of-service attempts, are not Security Incidents requiring individual notice.

6. Data Subject and compliance assistance

Taking into account the nature of the Processing, Auxo will provide reasonable assistance through appropriate technical and organizational measures so Customer can respond to verified requests to access, correct, delete, restrict, port, or object to Processing. If Auxo receives a request directly about Customer Personal Data, it will direct the requester to Customer unless law requires a direct response.

Auxo will provide information reasonably necessary for Customer's data protection impact assessments, prior consultations, and regulator inquiries relating to the Services. Customer will reimburse reasonable costs for assistance that is unusually burdensome or unrelated to Auxo's noncompliance.

7. Information and audits

Upon reasonable request, Auxo will provide information reasonably necessary to demonstrate compliance with this DPA, which may include then-current third-party reports, summaries, questionnaires, and policies, subject to confidentiality restrictions.

If that information is insufficient, Customer may conduct one audit per year, and additional audits following a material Security Incident or regulator request. Audits must be scheduled with at least 30 days' notice, occur during normal business hours, avoid unreasonable disruption, protect other customers' information, and be performed by an independent auditor that is not Auxo's competitor. Customer bears its audit costs unless the audit identifies Auxo's material breach.

8. Subprocessors

Customer gives Auxo general written authorization to use the Subprocessors listed in Annex III. Auxo will impose data protection obligations on each Subprocessor that are no less protective in substance than the obligations applicable to its Processing under this DPA. Auxo remains responsible for each Subprocessor's performance to the extent required by law.

Auxo will provide reasonable advance notice of a new Subprocessor that will materially Process Customer Personal Data. Customer may object within 15 days on reasonable data protection grounds. The Parties will work in good faith on a commercially reasonable alternative. If none is available, either Party may terminate only the affected Service and Auxo will refund prepaid fees for the unused terminated period.

9. International data transfers

Customer authorizes Auxo and its Subprocessors to Process Customer Personal Data in the countries identified in Annex III, subject to a lawful transfer mechanism where required.

For transfers from the European Economic Area that require contractual safeguards, the European Commission's 2021 Standard Contractual Clauses are incorporated by reference. Module Two applies to Controller-to-Processor transfers and Module Three applies to Processor-to-Processor transfers. Customer is the data exporter and Auxo is the data importer. The docking clause applies, optional Clause 9 uses general authorization with the notice period in Section 8, the optional redress language does not apply, and the law and courts selected for Clause 17 and Clause 18 will be an EU member state that permits third-party beneficiary rights.

Complete before EEA use: Select the EU member state governing the SCCs, complete transfer impact documentation, and verify every processing country in Annex III.

For restricted transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs is incorporated and completed using the information in this DPA. For Switzerland, references in the SCCs will be interpreted to include the Swiss Federal Act on Data Protection and the competent Swiss authority.

10. U.S. state privacy terms

To the extent a U.S. state privacy law applies, Auxo acts as Customer's service provider, processor, or contractor. Auxo will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose it outside the specific business purposes in the Agreement or outside the direct business relationship; or (c) combine it with Personal Data received from another person or from Auxo's own consumer interactions, except as permitted by law.

Auxo will notify Customer if it determines it can no longer meet an applicable obligation. Customer may take reasonable and appropriate steps to help ensure compliant use and to stop and remediate unauthorized use. The Parties acknowledge that Customer provides Customer Personal Data only for the limited and specified purposes described in this DPA and Annex I.

11. Return and deletion

At Customer's written request during the term, Auxo will make Customer Personal Data available for export in a commonly used format where the Services support export. Following termination, Auxo will delete or return Customer Personal Data within the period in the Agreement, unless law requires retention. Data remaining in secure backups may be deleted through Auxo's ordinary backup cycle and will remain protected and unavailable for active use.

Confirm before signature: Set the production export window, active-system deletion period, and maximum backup retention period.

12. General

This DPA begins when the Agreement becomes effective and continues while Auxo Processes Customer Personal Data. If this DPA conflicts with the Agreement on data protection, this DPA controls. Except as modified here, the Agreement remains in effect. The Agreement's governing law and dispute terms apply unless Applicable Data Protection Law requires otherwise.

Annex I. Details of Processing

Subject matterProviding, securing, supporting, and maintaining Auxo's operational intelligence platform and related implementation or support services.

DurationThe term of the Agreement and the limited return, deletion, backup, and legal retention periods that follow.

Nature and purposeReceiving, organizing, retrieving, generating, transmitting, and storing information so Customer can coordinate cases, use shared context, route work to specialized agents, review proposed actions, communicate, and administer the Services.

Data SubjectsCustomer personnel and contractors; patients and prospective patients; guarantors and caregivers; clinicians and referral sources; payer and vendor contacts; and other people whose data Customer chooses to submit.

Data categoriesIdentity and contact information; account and access data; scheduling, referral, coverage, authorization, claims, billing, and payment information; clinical or supporting documents selected by Customer; communications; case status; device, event, and audit metadata; and other data configured by Customer.

Sensitive dataHealth and medical information, insurance and member identifiers, government identifiers, financial information, and other sensitive data only to the extent Customer chooses to submit it and applicable law permits.

FrequencyContinuous or intermittent, depending on Customer's use of the Services and connected systems.

Annex II. Technical and organizational measures

Auxo will maintain a written security program proportionate to the nature of the Services and the sensitivity of Customer Personal Data. The program will address:

Access control: unique accounts, role-based access, least privilege, timely access removal, and multi-factor authentication for privileged or production access.
Encryption: encryption of Customer Personal Data in transit over public networks and at rest using current industry-standard methods.
Environment protection: logical separation of customer data, secure configuration, secrets management, network controls, and controlled production access.
Logging and monitoring: security-relevant event logs, alerting, and review appropriate to the Services.
Secure development: code review, change controls, dependency management, vulnerability assessment, and remediation based on risk.
Resilience: backups, recovery procedures, business continuity planning, and periodic testing appropriate to the Services.
Incident response: documented detection, escalation, containment, investigation, recovery, and notification procedures.
Personnel: confidentiality commitments, security awareness training, and sanctions for policy violations.
Vendor risk: risk-based diligence, contracts, and oversight for Subprocessors.
Data lifecycle: collection limitation, retention controls, secure deletion, and disposal processes.

Security verification required: Confirm that every measure above is operational before signing. Add verified audit reports or certifications only after they exist and counsel approves the wording.

Annex III. Approved Subprocessors

Auxo will maintain an accurate Subprocessor register containing the following information.

Provider	Purpose	Data	Processing location
Complete before production	Cloud hosting and storage	Verify	Verify
Complete before production	AI model or inference service	Verify, including PHI	Verify
Complete before production	Monitoring, support, communications, or other service	Verify	Verify

Acceptance

This DPA is accepted when the Parties execute an Order Form or other agreement that incorporates it. The Parties may also sign below.

Auxo Health, Co.

By: __________________________

Name: ________________________

Title: _________________________

Date: _________________________

Customer: __________________