RUO ProA DSCO product

Legal

Data Processing Addendum

This Data Processing Addendum (“DPA”) governs Company’s processing of End-Customer personal information on Customer’s behalf. It is incorporated into the Platform Subscription Agreement and the Client Services Agreement. In a conflict with the underlying agreement on data protection, this DPA controls.

Last updated September 14, 2026

1. Roles

With respect to End-Customer personal information processed through the Platform, Customer is the “business” or “controller” and Company is the “service provider” or “processor.” Each party complies with applicable privacy law, including the California Consumer Privacy Act and analogous State laws (and the GDPR to the extent applicable).

2. Processing

Scope and Purpose. Company processes personal information only to provide and support the Platform, on Customer’s documented instructions (including this DPA and the agreement), and for no other purpose. Company shall not sell or share personal information, and shall not retain, use, or disclose it outside the direct business relationship.

Confidentiality. Company ensures personnel with access are bound by confidentiality.

3. Security and Subprocessors

Security. Company maintains commercially reasonable administrative, technical, and physical safeguards appropriate to the data, and isolates business data per brand and separately from any clinical systems.

Subprocessors. Customer authorizes Company to engage subprocessors (including hosting, payment-tokenization, communications, and analytics providers) that are bound to protections no less protective than this DPA. Company maintains a subprocessor list and provides notice of material changes.

4. Assistance

Data-Subject Requests. Company shall assist Customer, insofar as reasonably possible, to respond to consumer or data-subject requests (access, deletion, correction, opt-out).

Incidents. Company shall notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data and provide reasonably available information.

5. Return and Deletion

On termination, Company makes Customer Data available for export for thirty (30) days, then deletes or de-identifies it except as required to be retained by law.

6. International Transfers

To the extent personal data is transferred from a jurisdiction requiring a transfer mechanism, the parties will implement Standard Contractual Clauses or another lawful mechanism, incorporated by reference.