Data Processing Addendum

1. Roles of the parties

For personal data contained in Customer Data, the Customer is the controller (or, where the Customer acts on behalf of a third party, the processor), and Automate Admits is the processor (or subprocessor) acting on the Customer’s documented instructions. Automate Admits processes personal data only to provide and support the Service, as set out in this DPA, our Terms, and our Privacy Policy, or as otherwise instructed by the Customer in writing and as permitted by law.

2. Subject matter, duration & purpose

The subject matter is the provision of the Service. Processing continues for the duration of the Customer’s use of the Service and until data is deleted or returned as described below. The purpose is to receive, store, organize, transmit, and respond to messages and lead information through the Customer’s connected channels, including the optional AI agent.

3. Types of data & data subjects

• Types of personal data: contact identifiers (such as names, usernames, phone numbers, email addresses, and platform-scoped IDs), message content and media, call recordings and transcripts, insurance and benefits information (including date of birth and member ID) where eligibility verification is used, contact and lead details the parties choose to exchange, scheduling information, and account information for the Customer’s team.
• Special categories: because Customers are healthcare and treatment organizations, the personal data processed is likely to include health data, and may include substance use disorder records subject to 42 CFR Part 2 (see our QSOA).
• Categories of data subjects: the Customer’s end users (people who message the Customer’s connected accounts) and the Customer’s own team members and account users.

4. Processor obligations

• Process personal data only on the Customer’s documented instructions, including for international transfers, unless required by law (in which case we will inform the Customer where permitted).
• Ensure that personnel authorized to process personal data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (see Section 7).
• Assist the Customer, taking into account the nature of processing, in responding to data subject requests and in meeting the Customer’s security, breach-notification, and impact-assessment obligations.
• Make available information reasonably necessary to demonstrate compliance with this DPA.

5. Subprocessors

The Customer authorizes Automate Admits to engage the subprocessors below to provide the Service. We impose written data-protection obligations on each subprocessor and we remain responsible for their performance under this DPA. Where a business associate agreement is in place we say so; where one is not, we say that too.

• Amazon Web Services, Inc. (United States): application hosting, database, object storage, and backups, the system of record where all Customer Data including protected health information is stored and processed; and Amazon Bedrock, which runs the AI models that generate replies from the contact record and conversation content, without using that data for training or sharing it with the companies that develop the models. Amazon Bedrock requests may be processed in other AWS Regions (see Section 11). Business associate agreement in place.
• Paubox, Inc. (United States) — delivery of transactional and service email to the Customer’s team. Business associate agreement in place.
• Stedi, Inc. (United States) — insurance eligibility and benefits verification; receives patient name, date of birth, and insurance member ID together with the Customer’s provider identifiers. Business associate agreement in place.
• Anthropic, PBC (United States): an AI assistant our own staff use when investigating a support request or a problem; it can see only the parts of a conversation or contact record needed for that investigation and is never used to generate automated replies. No business associate agreement.
• Meta Platforms, Inc. (United States) — receiving and sending messages through the Facebook Pages and Instagram accounts the Customer connects. No business associate agreement.
• Telnyx LLC (United States): transport of SMS and voice, phone numbers, call recording, and speech-to-text transcription (which routes voice messages leads send on connected messaging channels, and call audio when call transcription is on, to OpenAI Whisper via Telnyx). No business associate agreement.
• Apple Inc. (United States): delivery of optional alerts to the Automate Admits iPhone app through the Apple Push Notification service; an alert can include a contact’s name, the lead stage or channel, and a link to the contact’s profile photo that expires within an hour, and never includes message content. No business associate agreement.
• Cloudflare, Inc. (United States) — public marketing site, static-asset delivery, DNS, and CDN/DDoS protection. No protected health information.
• Stripe, Inc. (United States) — payment processing for Customer subscriptions. Billing data only.

Of the subprocessors without a business associate agreement, Meta, Telnyx, and Apple each support an optional feature the Customer can leave disabled, and Anthropic provides an AI assistant used only by our own staff when investigating a support request or a problem. The current status of each is published on our Trust page and updated when it changes.

We will give notice of intended changes to subprocessors so the Customer has an opportunity to object on reasonable data-protection grounds.

6. Data subject requests

Taking into account the nature of the processing, Automate Admits will assist the Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling the Customer’s obligations to respond to requests from data subjects to exercise their rights. Where we receive a request directly from a data subject relating to Customer Data, we will, where lawful, direct them to the Customer or forward the request.

7. Security measures

Automate Admits maintains technical and organizational measures designed to protect personal data, including encryption in transit (TLS, with HSTS and enforced TLS to the database and object storage) and encryption at rest across all database storage (AWS RDS PostgreSQL), object storage (AWS S3), and backups using customer managed AWS KMS keys with rotation, role based access control, two factor authentication, PBKDF2 password hashing, per organization audit logging, brute force lockout, signature verification of incoming platform webhooks, automated daily backups with cross region replication, and logical isolation of each Customer’s data in our multi tenant environment enforced by an automated tenant isolation audit in our release process. Further detail, including the controls we have not yet implemented, is on our Security page.

8. Personal data breach

Automate Admits will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably available to help the Customer meet its notification obligations.

9. Deletion or return of data

Upon termination of the Service, and at the Customer’s choice, Automate Admits will delete or make available for return the Customer’s personal data, and delete existing copies unless retention is required by law. During the term, Customer Data is retained until the Customer deletes it — there is no automatic expiry — and Customers can delete individual contacts and conversations, disconnect channels, and request deletion of account data at any time, as described in our Privacy Policy.

10. Audits

Automate Admits will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable confidentiality, scheduling, and security conditions.

11. International transfers

The Service processes personal data in the United States, except that Amazon Bedrock may process AI requests in other AWS commercial Regions, inside or outside the United States, that AWS selects to serve the request. That data stays on the AWS network and is encrypted in transit. Subprocessors that operate global networks, such as Meta and Apple, may also process personal data outside the United States under their own terms. Where required by applicable law, the parties will put in place an appropriate transfer mechanism.

12. General

If there is a conflict between this DPA and the Terms regarding the processing of personal data, this DPA controls. Where Customer Data includes protected health information, the Business Associate Agreement controls as to that subject matter; where it includes records subject to 42 CFR Part 2, the Qualified Service Organization Agreement controls as to that subject matter. This DPA is governed by the laws of the State of Wyoming, consistent with the Terms.