Data Processing Addendum

1. Definitions

For purposes of this DPA:

Personal Data means any information relating to an identified or identifiable individual processed by Health of Your Space on behalf of Customer.

Controller means the entity that determines the purposes and means of processing Personal Data.

Processor means the entity that processes Personal Data on behalf of the Controller.

Applicable Privacy Laws include privacy and data protection laws that apply to the processing of Personal Data under the Agreement, including where applicable:

• Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)
• the EU General Data Protection Regulation (GDPR)
• the UK GDPR
• other applicable privacy or data protection laws

Terms such as process, processing, data subject, and supervisory authority have the meanings provided by applicable privacy law.

2. Roles of the Parties

Customer acts as the Controller of Personal Data.

Health of Your Space acts as a Processor, processing Personal Data solely on behalf of Customer.

Customer determines:

• what Personal Data is collected
• the purposes of processing
• how Personal Data is used or disclosed

Health of Your Space processes Personal Data only according to Customer instructions and as necessary to provide the Services.

3. Nature and Purpose of Processing

Health of Your Space processes Personal Data in order to provide the Services described in the Terms of Service.

Processing activities may include the processing of Personal Data in connection with the Services, including:

• Digital intake forms, questionnaires, disclosures, consents, and document workflows
• Patient-submitted images, documents, signatures, and uploads
• Appointment-based automations, reminders, and patient communications
• Two-way messaging through SMS and email
• Integration and synchronization with Dolphin Management
• Real-time data synchronization between Provider systems and the platform
• Patient check-in links, status tracking, and workflow management
• Patient Overview and patient engagement tools
• Comments & Notes synchronization with Dolphin Management
• Form Builder, configurable forms, conditional logic, and workflow automation tools
• New Patient Call Sheet configuration and generation
• Analytics, reporting, dashboards, and activity monitoring
• Payment workflows, payment account management, and related administrative tools
• Workspace administration, team management, user roles, and access controls
• Provider branding, white-label configurations, and practice customization
• Administrative dashboards and operational workflow management
• Data processing, transmission, storage, and synchronization services necessary to provide the Services

Personal Data processed through the Services may include:

• patient names and contact details
• health history or clinical information
• appointment details
• patient images, signatures, and uploaded documents
• communication records and messaging content
• payment-related information and payment metadata
• provider staff account information
• user account information and role assignments
• form responses and workflow-related information
• activity, audit, synchronization, and operational records necessary to provide the Services

Processing occurs solely to support Customer’s clinical and administrative workflows.

Health of Your Space may also process operational, administrative, security, audit, synchronization, messaging, payment, reporting, and analytics information necessary to provide, secure, maintain, monitor, and improve the Services.

4. Customer Responsibilities

Customer is responsible for ensuring that:

• It has the legal authority and appropriate legal basis to collect and process Personal Data
• Appropriate consent or authorization has been obtained where required
• Personal Data submitted to the Services complies with applicable laws

Customer remains responsible for responding to data subject access requests, corrections, or deletion requests under applicable privacy laws.

Health of Your Space will provide reasonable assistance to Customer where necessary to respond to such requests.

Customer remains responsible for determining the content of any custom forms, disclosures, consents, questionnaires, workflows, communications, or other Customer-configured content created through the Services.

Customer remains responsible for providing any notices, disclosures, consents, or authorizations required under applicable privacy laws.

5. Security Measures

Health of Your Space implements appropriate administrative, technical, and organizational safeguards to protect Personal Data, including:

• encryption in transit using TLS
• encryption at rest using industry-standard encryption methods
• role-based access controls
• authentication and credential management
• system logging and monitoring
• secure cloud infrastructure providers
• regular system backups
• audit logging
• incident detection

Health of Your Space continuously evaluates and improves security practices consistent with industry standards.

Additional information about Health of Your Space security practices may be found at: https://healthofyourspace.com/security

6. Subprocessors

Customer authorizes Health of Your Space to engage trusted third-party service providers (“Subprocessors”) to assist in delivering the Services.

Examples may include:

• cloud hosting providers (such as AWS)
• SMS delivery providers (such as Twilio)
• payment service providers (such as GoDaddy)
• email delivery services
• logging and monitoring providers
• authentication services

Health of Your Space requires all Subprocessors to maintain appropriate security and privacy safeguards consistent with applicable privacy laws.

Health of Your Space remains responsible for the processing of Personal Data performed by its Subprocessors.

A current list of Subprocessors will be provided upon reasonable written request.

7. Data Breach Notification

Health of Your Space will notify Customer without undue delay upon becoming aware of a confirmed security incident involving Personal Data processed on behalf of Customer.

Such notification will include reasonable information known at the time regarding:

• the nature of the incident
• the categories of data involved
• actions taken to mitigate the incident

Health of Your Space will cooperate with Customer in responding to the incident as required by applicable law.

8. International Data Transfers

Health of Your Space is a company based in the United States.

Personal Data processed through the Services may be transferred to and stored in the United States or other jurisdictions where service providers operate.

Where required by applicable law, Health of Your Space will implement appropriate contractual, organizational, technical, and legal safeguards to support international transfers of Personal Data.

9. Confidentiality

Health of Your Space personnel authorized to process Personal Data are subject to confidentiality obligations and may access Personal Data only as necessary to perform their job responsibilities.

10. Term and Termination

This DPA remains in effect for as long as Health of Your Space processes Personal Data on behalf of Customer.

Upon termination of the Services, Personal Data will be handled according to:

• Customer instructions
• applicable legal obligations
• Health of Your Space retention policies

Health of Your Space may retain archival, backup, security, audit, disaster recovery, and legally required records for as long as reasonably necessary to satisfy legal, regulatory, contractual, security, or operational requirements.

11. Relationship to Other Agreements

This Agreement supplements and is incorporated into the following documents, each of which is incorporated herein by reference:

Terms of Service https://healthofyourspace.com/terms-of-service

Privacy Policy https://healthofyourspace.com/privacy-policy

Master Services Agreement As executed between the parties, or where applicable: https://healthofyourspace.com/master-service-agreement

Security Overview https://healthofyourspace.com/security

In the event of a conflict, this Agreement shall control with respect to the processing of Personal Data.

12. Governing Agreement

This DPA forms part of the Health of Your Space Terms of Service.

Health of Your Space

A Place For Apps LLC1607 San Charles DriveDunedin FL 34698United States

support@healthofyourspace.com