Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the RunPractice Terms of Service between Run Practice Inc., a Delaware corporation (“RunPractice,” “we,” “us”), 425 Madison Avenue, Floor 14, New York, NY 10017, and the Customer. It applies to Customer Personal Data to the extent Data Protection Laws apply to its processing.

Protected health information is governed by the Business Associate Agreement, which controls if the two conflict. For other personal data, this DPA controls over the Terms.

• Customer Personal Data means personal data in Customer Data that RunPractice processes on the Customer’s behalf.
• Data Protection Laws means the United States privacy and consumer health data laws that apply to that processing, such as the California Consumer Privacy Act and Washington’s My Health My Data Act.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Subprocessor means a third party that RunPractice engages to process Customer Personal Data.
• Terms such as business, controller, regulated entity, service provider, contractor, processor, consumer, consumer health data, sell and share have the meanings Data Protection Laws give them. Other capitalized terms have the meanings in the Terms.

The Customer is the business, controller or regulated entity for Customer Personal Data. RunPractice is its service provider, contractor or processor.

RunPractice processes Customer Personal Data only on the Customer’s documented instructions. They consist of the Terms, this DPA, the Customer’s Orders, and the Customer’s configuration and use of the Services. RunPractice will tell the Customer if it believes an instruction violates Data Protection Laws.

Details of processing

• Business purposes: providing, securing and supporting the Services, as described in the Terms.
• Nature of processing: hosting, storage, transmission, organization, display, and processing by the AI Features the Customer enables.
• People concerned: the Customer’s patients and prospective patients, the people who contact the practice, and the Customer’s staff.
• Types of data: contact and identity details, appointments, messages and recordings, health and wellness information, forms, payment records (not full card numbers), and account information.
• Duration: the term of the Terms, plus the export and deletion periods they describe.

RunPractice will not:

• sell or share Customer Personal Data;
• retain, use or disclose it for any purpose, including any commercial purpose, other than the business purposes above;
• retain, use or disclose it outside the direct business relationship between RunPractice and the Customer; or
• combine it with personal data RunPractice receives from or on behalf of anyone else, or collects from its own interactions with consumers, except as Data Protection Laws permit.

RunPractice will comply with applicable Data Protection Laws and provide the same level of privacy protection they require of the Customer. It will notify the Customer if it determines that it can no longer meet its obligations under them. The Customer may take reasonable and appropriate steps to ensure that RunPractice uses Customer Personal Data consistently with the Customer’s obligations, as described in Audits and reports. On notice, the Customer may take reasonable and appropriate steps to stop and remediate unauthorized use. RunPractice certifies that it understands and will comply with these restrictions.

RunPractice ensures that the people it authorizes to process Customer Personal Data are bound by confidentiality obligations and have access only to what their role requires.

RunPractice maintains administrative, technical and physical safeguards appropriate to the nature of Customer Personal Data, including:

• encryption in transit and at rest;
• access limited to authorized users, with verified sign-in;
• logging of relevant verification, changes, approvals and handoffs;
• separation of each practice’s information;
• identity verification before patient-specific information is shared or appointments are changed; and
• written contracts with Subprocessors that require equivalent protection.

The Customer authorizes RunPractice to use Subprocessors to provide the Services. RunPractice will:

• bind each Subprocessor by written contract to data protection obligations at least as protective as this DPA;
• provide its current list of Subprocessors on request;
• give at least 30 days’ notice before adding or replacing a Subprocessor, during which the Customer may object on reasonable data protection grounds; and
• remain responsible for its Subprocessors’ performance.

If the parties can’t resolve an objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for it.

• RunPractice will help the Customer respond to consumers’ requests to know, access, correct, delete or port their data, or to opt out, through features of the Services or, where needed, on request.
• If RunPractice receives a request directly from a consumer about Customer Personal Data, it will forward it to the Customer and won’t respond except as the Customer instructs or the law requires.
• RunPractice will provide reasonable information the Customer needs for data protection assessments that Data Protection Laws require.

Where Washington’s My Health My Data Act or a similar law applies, RunPractice processes consumer health data only under this DPA, which is a binding contract that sets out the Customer’s processing instructions and limits RunPractice’s actions. RunPractice will assist the Customer, through appropriate technical and organizational measures and as far as possible, in meeting the Customer’s obligations under those laws. RunPractice won’t sell consumer health data.

RunPractice will notify the Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data, and in any event within the time the law requires. The notice will describe what is known about the incident and the steps taken, and RunPractice will update it as more becomes known. RunPractice will take reasonable steps to contain and remediate the incident and will cooperate with the Customer’s notification obligations. A notice is not an admission of fault.

When the Terms end, the Customer may export its data during the export period the Terms describe. RunPractice will then delete Customer Personal Data from active systems, and from backups in their normal cycle, unless the law requires it to keep some of it. It will protect anything it keeps under this DPA and confirm deletion in writing on request.

Once every 12 months, or after a Security Incident or a regulator’s request, the Customer may ask RunPractice to show its compliance with this DPA. RunPractice will answer reasonable security and privacy questionnaires and provide summaries of its controls and other information reasonably needed for that purpose. Anything shared is RunPractice’s Confidential Information.

This DPA lasts for as long as RunPractice processes Customer Personal Data. To the extent the law allows, each party’s liability under this DPA is subject to the limitations in the Terms.