Data Processing Addendum

This Data Processing Addendum (“DPA”) is incorporated into the Peerlogic Master Service Agreement (“MSA”) under its Section 7 and governs Peerlogic’s processing of Customer Data. Where Customer Data is PHI, the Business Associate Agreement also applies and controls in a conflict. Capitalized terms not defined here have the meanings in the MSA.

1. Roles and scope

Customer determines the purposes and means of processing Customer Data and is the controller, business or similar party under applicable privacy law; Peerlogic processes Customer Data on Customer’s behalf as a processor or service provider. Customer Data includes call audio and recordings, transcripts, caller and patient identifiers, appointment and billing details surfaced in calls, user account details and usage data tied to identified users. Customer represents that it has the right to provide Customer Data to Peerlogic and has given the notices and obtained the consents required by law, including for call recording and transcription.

2. Processing instructions

Peerlogic processes Customer Data only to provide, secure, support and improve the Services for Customer as described in the MSA and this DPA, on Customer’s documented instructions (which include the MSA, the Orders and Customer’s configuration of the Services), and as required by law, in which case Peerlogic will inform Customer unless legally prohibited. Peerlogic will not sell or share Customer Data, retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Services, or combine it with data from other sources except as the Services require. Peerlogic will tell Customer if it believes an instruction violates applicable law.

3. AI processing

The Services use machine-learning and large-language models to transcribe calls, identify callers and intents, generate summaries and recommendations, and produce analytics. These outputs are Customer Data and are provided to Customer only. Peerlogic uses identifiable Customer Data only to provide the Services to Customer. Peerlogic may create de-identified, aggregated data from Customer Data under MSA Section 5.3 and BAA Section 1(d) and use it to train, evaluate and improve its models and Services; Peerlogic will not attempt to re-identify such data or permit others to do so. Third-party model providers that process Customer Data are listed on the Subprocessors page and are contractually prohibited from using it to train their own models.

4. Security

Peerlogic maintains a written information security program with administrative, technical and physical safeguards appropriate to the sensitivity of Customer Data, including at minimum: encryption of Customer Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent); role-based access controls with multi-factor authentication for Peerlogic personnel; logging and monitoring of access to production systems; vulnerability management with timely patching; secure software-development practices; regular backups with tested restoration; background checks and annual security and privacy training for personnel with access to Customer Data; and a documented incident-response plan. Peerlogic will make available on request its most recent third-party assessment (SOC 2 Type II / HITRUST / penetration-test summary) under confidentiality. Peerlogic may update these measures provided overall protection is not materially reduced.

5. Subprocessors

Customer authorizes Peerlogic to engage the subprocessors on the Subprocessors page, which Peerlogic will keep current. Peerlogic will give at least 30 days’ notice (by updating the list and emailing Customer’s notice contact) before a new subprocessor processes Customer Data. Customer may object in writing on reasonable data-protection grounds within that period; if the parties cannot resolve the objection within 30 days, Customer may terminate the affected Services on written notice and receive a refund of prepaid fees for the unused period, without early-termination charges. Peerlogic imposes written data-protection obligations on each subprocessor at least as protective as this DPA and remains responsible for their performance.

6. Personnel and confidentiality

Peerlogic limits access to Customer Data to personnel who need it to perform the Services and who are bound by confidentiality obligations.

7. Security incidents

Peerlogic will notify Customer without undue delay, and within 72 hours after confirming, of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Data (a “Security Incident”). The notice will describe the nature of the incident, the categories and approximate volume of data and individuals affected, the likely consequences, and the measures taken or proposed, supplemented as information becomes available. Peerlogic will reasonably assist Customer with its notification obligations and will not identify Customer in any public statement without consent unless required by law. Incidents involving PHI are also governed by the BAA, which uses the same 72-hour timeline.

8. Assistance

Taking into account the nature of the processing, Peerlogic will assist Customer, by appropriate technical and organizational measures and at Customer’s reasonable expense where the request is extensive, in responding to requests from individuals to exercise their rights (access, correction, deletion, portability, opt-out) and in completing privacy impact assessments or regulator consultations that relate to the Services. Peerlogic will promptly forward to Customer any request it receives directly from an individual and will not respond except to direct the individual to Customer.

9. Retention, export and deletion

During the Term, Customer may export call recordings, transcripts and reports through the Services. Call recordings are retained for the period configured by Customer (12 months by default) and may be deleted earlier by Customer. For 30 days after the Services end, Customer may export its Customer Data; Peerlogic then deletes Customer Data from production systems within 30 days and from backups within 90 days, unless retention is required by law. On request Peerlogic will confirm deletion in writing.

10. Audit

Peerlogic will make available the information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and the third-party assessments referenced in Section 4. Where those materials are insufficient to meet a legal requirement, Customer (or an independent auditor bound by confidentiality) may audit Peerlogic’s relevant controls no more than once in any 12-month period, on 30 days’ written notice, during business hours, in a manner that does not disrupt Peerlogic’s operations or compromise other customers’ data, and at Customer’s expense.

11. Jurisdiction-specific terms

United States. Peerlogic acts as a service provider or processor under applicable state privacy laws (including the California Consumer Privacy Act) and certifies that it understands and will comply with the restrictions in Section 2. Canada. For Customer Data about individuals in Canada, Peerlogic will process it in compliance with PIPEDA and applicable provincial privacy laws. Customer acknowledges that Customer Data is stored and processed in the United States and may be subject to access by U.S. authorities under U.S. law, and that Customer is responsible for any notice to individuals that this requires. Peerlogic will store and process Customer Data in the United States unless otherwise agreed in writing.

12. Changes and precedence

Peerlogic may update this DPA under MSA Section 7, provided an update does not materially reduce the protections for Customer Data during the then-current Term. For Customer Data, this DPA controls over the MSA; the BAA controls over this DPA for PHI.

13. Authorized Affiliates

Customer may extend the Services to its Affiliates (entities that control, are controlled by or are under common control with Customer) within the quantities and locations in its Orders. This DPA applies to the Personal Data of each such Affiliate as if it were Customer’s own. Customer is responsible for its Affiliates’ compliance, is the sole point of contact and instruction for Peerlogic, and may exercise rights under this DPA on their behalf. Liability under this DPA is a single aggregate amount for Customer and all of its Affiliates together, not a separate amount for each.