Quillmark Health - Data Processing Agreement v1

Roles of the parties

Quillmark Health is the controller of the personal data, or the covered entity or business associate where HIPAA applies. BG-Demo acts only as processor. BG-Demo will not use the data for its own purposes, will not combine it with data from other customers and will not sell it.

Processing instructions

• BG-Demo processes personal data only on the documented instructions of Quillmark Health, which include the configuration of connectors and the use of the brain.
• If BG-Demo believes an instruction breaches the law, it will say so promptly and may pause that processing until the position is clarified.
• The categories of data and the nature of the processing are described in the order form and may be updated in writing.

Location of processing

The brain is built and run inside the customer's own Snowflake account. BG-Demo does not keep a separate copy of customer data outside that account, except for support material the customer has chosen to share. Any change to where data is processed requires the customer's prior written agreement.

Confidentiality

BG-Demo will limit access to personal data to staff who need it to deliver the service, and will make sure they are bound by written confidentiality obligations that continue after their engagement ends.

Security measures

BG-Demo will maintain technical and organisational measures appropriate to the sensitivity of the data. These include:

• access controls based on single sign-on and role-based permissions;
• encryption of data in transit and at rest within the customer's account;
• logging of administrative access, available to the customer on request;
• regular testing of controls and a documented process for fixing weaknesses.

The detailed controls are described in the security documentation supplied during the review.

Sub-processors

BG-Demo will use only the sub-processors on the agreed list. It will tell the customer in advance of any addition or replacement and give a reasonable opportunity to object. BG-Demo remains responsible for the acts of its sub-processors. The list is not yet final and is shown as an open point below.

Assistance to the customer

BG-Demo will, taking account of the nature of the processing:

• help Quillmark Health respond to requests from individuals exercising their rights;
• help it meet its obligations on security, impact assessments and consultation with regulators;
• provide the information reasonably needed to show compliance with this agreement.

Security incidents

BG-Demo will notify Quillmark Health of a security incident without undue delay after becoming aware of it. The notice will describe the nature of the incident, the data affected so far as known, the steps taken and the contact for follow-up. The exact notice wording is an open point.

Audit

Quillmark Health may audit BG-Demo's compliance with this agreement, on reasonable notice and in a way that does not disrupt service for other customers. Scope and frequency are open points. BG-Demo will cooperate and provide documentation, and may satisfy reasonable requests with independent assessment reports where appropriate.

Return and deletion

On termination, BG-Demo will, at the customer's choice, delete or return personal data and confirm in writing that it has done so, unless the law requires it to be kept. Because the data lives in the customer's Snowflake account, deletion mainly means removing BG-Demo's access and the derived indexes it built.

Liability and term

Liability under this agreement follows the limits in the master agreement and order form, unless the business associate agreement or the law provides otherwise. This agreement runs for as long as BG-Demo processes personal data for the customer.

Open points

Signatures

This draft has not been signed. The signature blocks below will be completed on execution.

For BG-Demo Name: Jordan Pike Title: Account Executive, US Date: on execution

For Quillmark Health Name: Tasha Greene Title: Procurement Director Date: on execution